dcrat | 2427a920af83a8799fd2f22f53b7a3a92992480d3efa6e23c928eb0b77afec27

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
Size 1008KB
Sample240702-bt7kkavepp
SHA256 2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f
MD5 579e5cbaf7b4ad7e0e0f2f991d072a6b
SHA1 338cb0a75e4d1d84e5cb3dcf11faa9c764d48e00
SHA512 6a9cebaefe5ec375f9a932445fdc5b77945a46ac25c09fd8b3bc57c4b0b4d453eb5fffe70effdcabf0d46da63c73003aa109e342d648eef06c85d05e7b8dae92
SSDEEP 12288:7EC9yggsC9b/ySBhfEWO+QxckmsPnvKhxauZUYf9LT+wqR/Zk:7EnjsC9b/yofEWcHms6nZFlLT+Z/Zk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	452	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	444	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	444	schtasks.exe	83

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2924-1-0x0000000000410000-0x0000000000514000-memory.dmp	dcrat
behavioral2/files/0x0007000000023459-14.dat	dcrat

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 14 IoCs

pid	Process
4776	Idle.exe
1568	Idle.exe
3248	Idle.exe
3104	Idle.exe
4588	Idle.exe
3976	Idle.exe
2532	Idle.exe
3788	Idle.exe
2344	Idle.exe
5040	Idle.exe
4196	Idle.exe
1184	Idle.exe
4532	Idle.exe
4320	Idle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
26	pastebin.com
58	pastebin.com
59	pastebin.com
79	pastebin.com
34	pastebin.com
64	pastebin.com
35	pastebin.com
76	pastebin.com
77	pastebin.com
80	pastebin.com
25	pastebin.com
49	pastebin.com
50	pastebin.com
51	pastebin.com
78	pastebin.com

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\host\22eafd247d37c3	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ea9f0e6c9e2dcd	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Common Files\DESIGNER\f3b6ecef712a24	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Windows Security\ea1d8f6d871115	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files (x86)\Microsoft\Temp\5b884080fd4f94	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File opened for modification	C:\Program Files\dotnet\host\TextInputHost.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\6ccacd8608530f	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\121e5b5079f7c0	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Internet Explorer\uk-UA\9e8d7a4ca61bd9	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\taskhostw.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files (x86)\Microsoft\Temp\fontdrvhost.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\dotnet\host\TextInputHost.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Common Files\DESIGNER\spoolsv.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Program Files\Windows Security\upfc.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uk-UA\Idle.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Windows\uk-UA\6ccacd8608530f	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
File created	C:\Windows\diagnostics\index\spoolsv.exe	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3200	schtasks.exe
1100	schtasks.exe
2452	schtasks.exe
4856	schtasks.exe
5044	schtasks.exe
2724	schtasks.exe
3896	schtasks.exe
4916	schtasks.exe
1956	schtasks.exe
5112	schtasks.exe
2092	schtasks.exe
2156	schtasks.exe
1844	schtasks.exe
4760	schtasks.exe
1252	schtasks.exe
4556	schtasks.exe
4904	schtasks.exe
2136	schtasks.exe
5020	schtasks.exe
4468	schtasks.exe
4036	schtasks.exe
2588	schtasks.exe
5056	schtasks.exe
1448	schtasks.exe
4596	schtasks.exe
4560	schtasks.exe
3580	schtasks.exe
3808	schtasks.exe
2132	schtasks.exe
3148	schtasks.exe
3796	schtasks.exe
3468	schtasks.exe
2500	schtasks.exe
1520	schtasks.exe
2328	schtasks.exe
4780	schtasks.exe
4584	schtasks.exe
2732	schtasks.exe
452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
4776	Idle.exe
1568	Idle.exe
3248	Idle.exe
3104	Idle.exe
4588	Idle.exe
3976	Idle.exe
2532	Idle.exe
3788	Idle.exe
2344	Idle.exe
5040	Idle.exe
4196	Idle.exe
1184	Idle.exe
4532	Idle.exe
4320	Idle.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
Token: SeDebugPrivilege	4776	Idle.exe
Token: SeDebugPrivilege	1568	Idle.exe
Token: SeDebugPrivilege	3248	Idle.exe
Token: SeDebugPrivilege	3104	Idle.exe
Token: SeDebugPrivilege	4588	Idle.exe
Token: SeDebugPrivilege	3976	Idle.exe
Token: SeDebugPrivilege	2532	Idle.exe
Token: SeDebugPrivilege	3788	Idle.exe
Token: SeDebugPrivilege	2344	Idle.exe
Token: SeDebugPrivilege	5040	Idle.exe
Token: SeDebugPrivilege	4196	Idle.exe
Token: SeDebugPrivilege	1184	Idle.exe
Token: SeDebugPrivilege	4532	Idle.exe
Token: SeDebugPrivilege	4320	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4776	2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe	123
PID 2924 wrote to memory of 4776	2924	2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe	123
PID 4776 wrote to memory of 4740	4776	Idle.exe	132
PID 4776 wrote to memory of 4740	4776	Idle.exe	132
PID 4740 wrote to memory of 2868	4740	cmd.exe	134
PID 4740 wrote to memory of 2868	4740	cmd.exe	134
PID 4740 wrote to memory of 1568	4740	cmd.exe	137
PID 4740 wrote to memory of 1568	4740	cmd.exe	137
PID 1568 wrote to memory of 1084	1568	Idle.exe	138
PID 1568 wrote to memory of 1084	1568	Idle.exe	138
PID 1084 wrote to memory of 1272	1084	cmd.exe	140
PID 1084 wrote to memory of 1272	1084	cmd.exe	140
PID 1084 wrote to memory of 3248	1084	cmd.exe	141
PID 1084 wrote to memory of 3248	1084	cmd.exe	141
PID 3248 wrote to memory of 2456	3248	Idle.exe	142
PID 3248 wrote to memory of 2456	3248	Idle.exe	142
PID 2456 wrote to memory of 4448	2456	cmd.exe	144
PID 2456 wrote to memory of 4448	2456	cmd.exe	144
PID 2456 wrote to memory of 3104	2456	cmd.exe	146
PID 2456 wrote to memory of 3104	2456	cmd.exe	146
PID 3104 wrote to memory of 4864	3104	Idle.exe	149
PID 3104 wrote to memory of 4864	3104	Idle.exe	149
PID 4864 wrote to memory of 5000	4864	cmd.exe	151
PID 4864 wrote to memory of 5000	4864	cmd.exe	151
PID 4864 wrote to memory of 4588	4864	cmd.exe	152
PID 4864 wrote to memory of 4588	4864	cmd.exe	152
PID 4588 wrote to memory of 1944	4588	Idle.exe	153
PID 4588 wrote to memory of 1944	4588	Idle.exe	153
PID 1944 wrote to memory of 4492	1944	cmd.exe	155
PID 1944 wrote to memory of 4492	1944	cmd.exe	155
PID 1944 wrote to memory of 3976	1944	cmd.exe	156
PID 1944 wrote to memory of 3976	1944	cmd.exe	156
PID 3976 wrote to memory of 5048	3976	Idle.exe	157
PID 3976 wrote to memory of 5048	3976	Idle.exe	157
PID 5048 wrote to memory of 1608	5048	cmd.exe	159
PID 5048 wrote to memory of 1608	5048	cmd.exe	159
PID 5048 wrote to memory of 2532	5048	cmd.exe	160
PID 5048 wrote to memory of 2532	5048	cmd.exe	160
PID 2532 wrote to memory of 1424	2532	Idle.exe	163
PID 2532 wrote to memory of 1424	2532	Idle.exe	163
PID 1424 wrote to memory of 3312	1424	cmd.exe	165
PID 1424 wrote to memory of 3312	1424	cmd.exe	165
PID 1424 wrote to memory of 3788	1424	cmd.exe	166
PID 1424 wrote to memory of 3788	1424	cmd.exe	166
PID 3788 wrote to memory of 3132	3788	Idle.exe	167
PID 3788 wrote to memory of 3132	3788	Idle.exe	167
PID 3132 wrote to memory of 4664	3132	cmd.exe	169
PID 3132 wrote to memory of 4664	3132	cmd.exe	169
PID 3132 wrote to memory of 2344	3132	cmd.exe	170
PID 3132 wrote to memory of 2344	3132	cmd.exe	170
PID 2344 wrote to memory of 3424	2344	Idle.exe	171
PID 2344 wrote to memory of 3424	2344	Idle.exe	171
PID 3424 wrote to memory of 1700	3424	cmd.exe	173
PID 3424 wrote to memory of 1700	3424	cmd.exe	173
PID 3424 wrote to memory of 5040	3424	cmd.exe	181
PID 3424 wrote to memory of 5040	3424	cmd.exe	181
PID 5040 wrote to memory of 2560	5040	Idle.exe	182
PID 5040 wrote to memory of 2560	5040	Idle.exe	182
PID 2560 wrote to memory of 2552	2560	cmd.exe	184
PID 2560 wrote to memory of 2552	2560	cmd.exe	184
PID 2560 wrote to memory of 4196	2560	cmd.exe	185
PID 2560 wrote to memory of 4196	2560	cmd.exe	185
PID 4196 wrote to memory of 364	4196	Idle.exe	186
PID 4196 wrote to memory of 364	4196	Idle.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe
"C:\Users\Admin\AppData\Local\Temp\2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cwtcXGf4Cf.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\peQnm3nkJb.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1084
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1272
      - C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4448
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IJ9EkrtYDM.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4864
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:5000
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mrWoaKD2ur.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4492
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\P6ENo64DAh.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1608
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lmMgPtgxf2.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:3312
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4664
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1700
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lmMgPtgxf2.bat"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2552
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat"
        23⤵
        
        PID:364
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4612
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1184
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat"
        25⤵
        
        PID:3196
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4828
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4532
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"
        27⤵
        
        PID:3600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1928
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat"
        29⤵
        
        PID:1616
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\host\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\host\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\uk-UA\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\uk-UA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\uk-UA\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Videos\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre-1.8\legal\jdk\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\legal\jdk\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jre-1.8\legal\jdk\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\DESIGNER\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\DESIGNER\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Security\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\uk-UA\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Temp\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Temp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

taskhostw.exe

Path C:\Program Files\Java\jre-1.8\legal\jdk\taskhostw.exe
Size 1008KB
SHA256 2b4d2a49f21bb03260121613a9d00d054dce9acfeb4c76c4bd54be7568c4c45f
MD5 579e5cbaf7b4ad7e0e0f2f991d072a6b
SHA1 338cb0a75e4d1d84e5cb3dcf11faa9c764d48e00
SHA512 6a9cebaefe5ec375f9a932445fdc5b77945a46ac25c09fd8b3bc57c4b0b4d453eb5fffe70effdcabf0d46da63c73003aa109e342d648eef06c85d05e7b8dae92
SSDEEP 12288:7EC9yggsC9b/ySBhfEWO+QxckmsPnvKhxauZUYf9LT+wqR/Zk:7EnjsC9b/yofEWcHms6nZFlLT+Z/Zk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Idle.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log
Size 1KB
SHA256 27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249
MD5 3ad9a5252966a3ab5b1b3222424717be
SHA1 5397522c86c74ddbfb2585b9613c794f4b4c3410
SHA512 b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6
MD5 SHA1 SHA512

Submit Download

3fa1oyizme.bat

Path C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat
Size 228B
SHA256 1f7f6d70eb4fa0d05374f218123c92c1b3887d53b91815de67ee527684616720
MD5 c30535283d7eed84ec1ec16278594d9b
SHA1 579ea9fd7187c69f52b7ada1fd6ede93986582cf
SHA512 a4cdbfe0d8f4556cb1a9b3efa723e2aef70b2524bdf1fe1f05aed82ec6782409545c123f6093515448c43d915580b7ed2cf0bddc840103a92eeff75bccae2219
MD5 SHA1 SHA512

Submit Download

AKY6NrPTox.bat

Path C:\Users\Admin\AppData\Local\Temp\AKY6NrPTox.bat
Size 228B
SHA256 9204cb380265b5b0478675d6d42c162377da6bf0ba6f2262d66e84a07958d751
MD5 9f478861918f705cf63cec2501a1eea7
SHA1 93e6f8f554722eb91c798835808c23aadaff7f18
SHA512 e25a7d1478bda635a04dbe0c1694f583d8229a9e365cc2feeee6f0c54f0d55639fd2b77811b838ffb728c3a44766af1e69ea92ad740447ada1e1c3f6d4f81a6a
MD5 SHA1 SHA512

Submit Download

GN7B3lpeta.bat

Path C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat
Size 228B
SHA256 4b496b39650d8c5fb05d1cca71456628ccd6bdf54d6364a028e7fb92168e16b3
MD5 da07d2da48271daa26c3ca014b87eebc
SHA1 2af845488da1f9fdcf3b948047714abcf620187c
SHA512 92bc4bb1ae8ace5cd26c856f403f32fad8bc66bb9bf7e62361235bdcdb3c6c47ceb12288b7a236d373083ecd872bc7d3b29266485a3dd1af3f688d1b17ef80db
MD5 SHA1 SHA512

Submit Download

IJ9EkrtYDM.bat

Path C:\Users\Admin\AppData\Local\Temp\IJ9EkrtYDM.bat
Size 228B
SHA256 be6671b68f1fad6e31c2f8d69c1ab4d0ef81f483aa057253ab8701342cbce48b
MD5 160d9352922a31c75cfa0bb959205594
SHA1 be441fb5767188582eec798fe8b76576e788ba2e
SHA512 9d8fa66ff76acf13046caf4c27aefe7fcdd8cda87baf761d052d5df0c4e0674935f1fdfaedeed6aab2e2db56100ace00ef5d64896d0a6321584c2c7477ecfd5d
MD5 SHA1 SHA512

Submit Download

P6ENo64DAh.bat

Path C:\Users\Admin\AppData\Local\Temp\P6ENo64DAh.bat
Size 228B
SHA256 45517f43f3d39f250d8c4385f6a7e06fd17b34c8d1e2b74d40bf0a06e97dd408
MD5 3db6a2ec8cb5f8d8c3b47a922928a678
SHA1 ef9be75cfdeaa86f0907da7f617faf711addfb92
SHA512 5b33eaac72b02549692bc7e4d92f0a62ed7c9de795a4e4860ff459eb96eac2495a900502ca053dbde1ecc34774d436efbc3b5730af00698510a37584bc504226
MD5 SHA1 SHA512

Submit Download

cwtcXGf4Cf.bat

Path C:\Users\Admin\AppData\Local\Temp\cwtcXGf4Cf.bat
Size 228B
SHA256 32fba68fc7d1e6010185d2094e5a7a30ea9e0c3676d8ecd6fc9679c319996178
MD5 89fb6d178f07adae87c77be8ad2af2d7
SHA1 20016c49253a97346caf14e15ca1a83ae94dbc81
SHA512 3b4ef9039efaa81f7457df51cb18c8846741113592a1b8bdd2c1b3a903196a2afa53b65dd4fe9735e234258f532191c150ede4ad6446dcdb5f48930bfdee2263
MD5 SHA1 SHA512

Submit Download

dnlY2uCtHd.bat

Path C:\Users\Admin\AppData\Local\Temp\dnlY2uCtHd.bat
Size 228B
SHA256 3d3f9397dbc3811874210f19a2e9564c838a70b1ef74b39e05be7ce8f1773bac
MD5 8cf339cbe6182c4d095e39e3d15c778b
SHA1 6d9c8233325fcffdfbcf011d53481ac3591d6445
SHA512 6df6bf2695bfbd8a3d07a573683576633f1a9b12ce46c45615a3d983e84605f3dc721462f38962b0230c2bab5be8e46b5ed114ac6e7470bdd22aab5cee1acefa
MD5 SHA1 SHA512

Submit Download

iqKdioc4MG.bat

Path C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat
Size 228B
SHA256 a8340cd324812dcf2730ce8afbeef4f63dd5676c06cde256f84174360581a7ec
MD5 bc05d82dc549800bf10df4680ab2019e
SHA1 b3ec8a0d694763c5d069118e43b66faf67975630
SHA512 4d52e070fd9731b3bb64991445f691ec521484f54b379a16ee7abf9046396c661a9ad3d900709a995caeaba1716649297bdf88e5e86e087fa46f57876c086f53
MD5 SHA1 SHA512

Submit Download

lmMgPtgxf2.bat

Path C:\Users\Admin\AppData\Local\Temp\lmMgPtgxf2.bat
Size 228B
SHA256 4d6d37f31050423cbb57d7806ce4817ccbb1df7e9d23e12e9015c336d9e5747d
MD5 f70dcfece920e459de8e75c624c1357f
SHA1 143afe736c3199b4ffae29b9a0ba9ebb444bc19a
SHA512 a029454c1a7d54b773e178cdaa1c67294e61ee735723d9b82e3b4cceaf9afc5819931028fa786e42564b01fd0ad849d1ccb4162502abcdb9b7e2dc58790d32bd
MD5 SHA1 SHA512

Submit Download

mrWoaKD2ur.bat

Path C:\Users\Admin\AppData\Local\Temp\mrWoaKD2ur.bat
Size 228B
SHA256 10969cc57d399a95c6486e51f7319044030925bc3077b3fc599818d9a32beb32
MD5 683e0c5907037b2e053548d7b37419cc
SHA1 00d21eeb69940305bc8af7ac82f14cd6cb99cd9b
SHA512 2346c26cd5294e28b8b67e19be2cb223ef153a707818318462d21ae612199e82cb965388b3611c22b22e3df8c280244e1f4f5637deba6a34638adcd07ddbd09b
MD5 SHA1 SHA512

Submit Download

peQnm3nkJb.bat

Path C:\Users\Admin\AppData\Local\Temp\peQnm3nkJb.bat
Size 228B
SHA256 154cbabb64222d9581c2e1a17fe6a92653fd6e489db664a535ad08c3df3bfba3
MD5 02e2c4de6bb15ec2a6ca1de103be4517
SHA1 ca7c4034963835eac7fcad8f433e1ac0b3cc7d38
SHA512 fd1aa58ebda87923a5b6ffb19cc599e96947377eb041cddb91c75aab13d6f12dc47b58142e3c6021e9de023d5b2fcec34a90bf5a03b931d75b0c5cc79d4fb151
MD5 SHA1 SHA512

Submit Download

memory/1184-116-0x000000001C6C0000-0x000000001C82A000-memory.dmp

Download

memory/2924-0-0x00007FFBE39D3000-0x00007FFBE39D5000-memory.dmp

Download

memory/2924-43-0x00007FFBE39D0000-0x00007FFBE4491000-memory.dmp

Download

memory/2924-4-0x000000001B1A0000-0x000000001B1F0000-memory.dmp

Download

memory/2924-5-0x0000000002760000-0x0000000002768000-memory.dmp

Download

memory/2924-3-0x0000000002590000-0x00000000025AC000-memory.dmp

Download

memory/2924-2-0x00007FFBE39D0000-0x00007FFBE4491000-memory.dmp

Download

memory/2924-1-0x0000000000410000-0x0000000000514000-memory.dmp

Download

memory/4320-130-0x000000001C700000-0x000000001C8A9000-memory.dmp

Download

memory/4532-123-0x000000001C150000-0x000000001C2F9000-memory.dmp

Download