Overview

overview

10

Static

static

10

0b57729518...e1.exe

windows7-x64

10

0b57729518...e1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 08:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0b57729518305b0dfe9636beebc0dde1.exe
  • Size 2.0MB
  • Sample240704-j4f5csthkf
  • SHA256 3592f60e97f29ab2d4e60ed3604d154c4455f59c318723aa0d25dd6a5c255f66
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasioninfostealerrattrojan

Malware Config

Signatures

  • DcRat 20 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 42 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 28 IoCs
    evasiontrojan
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 42 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b57729518305b0dfe9636beebc0dde1.exe
    "C:\Users\Admin\AppData\Local\Temp\0b57729518305b0dfe9636beebc0dde1.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\MsProvidercomponentreviewmonitor\MGAQWHNKS4D5qYHMHLnPQQXrg.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\MsProvidercomponentreviewmonitor\lheh2Yi0brFl.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3376
        • C:\MsProvidercomponentreviewmonitor\Mscomponentreview.exe
          "C:\MsProvidercomponentreviewmonitor\Mscomponentreview.exe"
          4⤵
          • DcRat
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4656
          • C:\MsProvidercomponentreviewmonitor\Mscomponentreview.exe
            "C:\MsProvidercomponentreviewmonitor\Mscomponentreview.exe"
            5⤵
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3596
            • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
              "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:3440
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acc5fb3a-89d5-445f-a930-771c2cbd718b.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1388
                • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4524
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b0accc2-63e7-4888-9529-80fe9a340382.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2708
                    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                      "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:2956
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a94886a-78e9-4482-b0cd-343a5cd51c0d.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5016
                        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                          "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:5036
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e85117b3-1155-41d4-a2bc-8a3b8ef8ccc6.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3184
                            • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                              "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2996
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fb3c936-8c32-4551-ba1b-60d2ce59cfae.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1452
                                • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                                  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2532
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4bbcca7b-0f10-4567-9216-f195e89d090b.vbs"
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4084
                                    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                                      "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                                      18⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:4064
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4366fd4f-08ea-45eb-b544-fc8633490fbb.vbs"
                                        19⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:5028
                                        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                                          "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                                          20⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:5116
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\416e1587-a8b9-4569-9cfb-7b79d2f6ca0a.vbs"
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1864
                                            • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                                              "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                                              22⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:3096
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7c06031-50d4-4f50-a1d6-85356893c987.vbs"
                                                23⤵
                                                  PID:2536
                                                  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                                                    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                                                    24⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:4916
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40d28780-59c5-4522-be20-7ba9159279fa.vbs"
                                                      25⤵
                                                        PID:1228
                                                        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                                                          "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                                                          26⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:1740
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89a602ea-7c6a-4c4e-b7cf-2220b7f213d0.vbs"
                                                            27⤵
                                                              PID:4384
                                                              • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe
                                                                "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe"
                                                                28⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:1412
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\344afc9e-7ed8-48ef-9970-47c18c80cea6.vbs"
                                                                  29⤵
                                                                    PID:3948
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35c92638-ed08-4773-90b4-6ff3585b5f46.vbs"
                                                                    29⤵
                                                                      PID:3208
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23d3cb08-ae4c-4aea-86a0-4a12d925edd2.vbs"
                                                                  27⤵
                                                                    PID:4544
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3154f67b-b171-495e-959c-43c8cbc62c27.vbs"
                                                                25⤵
                                                                  PID:4272
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20caeaae-690f-4432-9d22-6823d7157e52.vbs"
                                                              23⤵
                                                                PID:432
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26a7689d-f539-4d68-8bc1-91f98694c63a.vbs"
                                                            21⤵
                                                              PID:2908
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdbd40b5-e538-4c6a-b57e-2039540b5269.vbs"
                                                          19⤵
                                                            PID:4516
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7da8d34c-889d-41c4-8c66-63edf340990d.vbs"
                                                        17⤵
                                                          PID:1460
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\536dad89-f345-4050-8c6a-958abfd08a19.vbs"
                                                      15⤵
                                                        PID:2524
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8c1caa2-d20e-451d-8602-064801cfe49d.vbs"
                                                    13⤵
                                                      PID:4388
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\834c9e9e-604a-4e7c-802c-336663dc0132.vbs"
                                                  11⤵
                                                    PID:2408
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10ba8f1f-5cfe-4ab8-9e6c-53f4d82b1fdb.vbs"
                                                9⤵
                                                  PID:4552
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9e3c0ee-a13d-4c71-b709-dc3685de7d40.vbs"
                                              7⤵
                                                PID:468
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\smss.exe'" /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1376
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Documents\smss.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1216
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Documents\smss.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:5084
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dllhost.exe'" /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4232
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2028
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dllhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4260
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\MsProvidercomponentreviewmonitor\OfficeClickToRun.exe'" /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3100
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\MsProvidercomponentreviewmonitor\OfficeClickToRun.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4016
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\MsProvidercomponentreviewmonitor\OfficeClickToRun.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1692
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\MsProvidercomponentreviewmonitor\RuntimeBroker.exe'" /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3644
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\MsProvidercomponentreviewmonitor\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4620
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\MsProvidercomponentreviewmonitor\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1288
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:5028
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1972
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1904
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe'" /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4476
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3224
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • DcRat
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2912

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        MGAQWHNKS4D5qYHMHLnPQQXrg.vbe
                                        • Path C:\MsProvidercomponentreviewmonitor\MGAQWHNKS4D5qYHMHLnPQQXrg.vbe
                                        • Size 221B
                                        • SHA256 a102fd16fdd47f1feba532b83a1adb31476a5df41e24384cbeb098cb3323d282
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Mscomponentreview.exe
                                        • Path C:\MsProvidercomponentreviewmonitor\Mscomponentreview.exe
                                        • Size 1.7MB
                                        • SHA256 43dc2c22e97c12dd33c05d9836d0211d99df926318db3be703c59c82650bdfab
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        lheh2Yi0brFl.bat
                                        • Path C:\MsProvidercomponentreviewmonitor\lheh2Yi0brFl.bat
                                        • Size 59B
                                        • SHA256 264e64d13e6719a085e4bdc6d022491816ccc497e14bb9492a4e3a9c983cc32e
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        Mscomponentreview.exe.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Mscomponentreview.exe.log
                                        • Size 1KB
                                        • SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        StartMenuExperienceHost.exe.log
                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log
                                        • Size 1KB
                                        • SHA256 2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        2fb3c936-8c32-4551-ba1b-60d2ce59cfae.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\2fb3c936-8c32-4551-ba1b-60d2ce59cfae.vbs
                                        • Size 760B
                                        • SHA256 89f02fd6b0f7a502c7edde48a05fd8b0eaa517bffdc2d248c34c3aa5cab16772
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        344afc9e-7ed8-48ef-9970-47c18c80cea6.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\344afc9e-7ed8-48ef-9970-47c18c80cea6.vbs
                                        • Size 760B
                                        • SHA256 89e23ee54e729c8cd432c1145790db071cba086c73d6bfd3feead37747bb86e9
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        40d28780-59c5-4522-be20-7ba9159279fa.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\40d28780-59c5-4522-be20-7ba9159279fa.vbs
                                        • Size 760B
                                        • SHA256 5ccbefe85c1906f2ad5805c57236effd9a81b520b66534017b56afaf64b55f32
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        416e1587-a8b9-4569-9cfb-7b79d2f6ca0a.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\416e1587-a8b9-4569-9cfb-7b79d2f6ca0a.vbs
                                        • Size 760B
                                        • SHA256 9aaf43be0b192dc98d07447cb042d5ec77870a4b0dbdd77626a2931cdf17734e
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        4366fd4f-08ea-45eb-b544-fc8633490fbb.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\4366fd4f-08ea-45eb-b544-fc8633490fbb.vbs
                                        • Size 760B
                                        • SHA256 d14dac39ac9ccf610ca9323b1a66ab3544013f5a3baa0319c7b4865095e34e19
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        4bbcca7b-0f10-4567-9216-f195e89d090b.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\4bbcca7b-0f10-4567-9216-f195e89d090b.vbs
                                        • Size 760B
                                        • SHA256 ff2bb5db2ed97f3560f620061d688b8f29be5da2a1acce7ab1a4c3bca56d3f69
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        7a94886a-78e9-4482-b0cd-343a5cd51c0d.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\7a94886a-78e9-4482-b0cd-343a5cd51c0d.vbs
                                        • Size 760B
                                        • SHA256 c0a0ccaeb40bc17ffe381b460a66162144c62048c5baf71b0f2aa9d769ebb15a
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        89a602ea-7c6a-4c4e-b7cf-2220b7f213d0.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\89a602ea-7c6a-4c4e-b7cf-2220b7f213d0.vbs
                                        • Size 760B
                                        • SHA256 0da068b6e408265132d7a7036ce9f8ddf28fa30b006bd4fbda95386866e1f811
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        8b0accc2-63e7-4888-9529-80fe9a340382.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\8b0accc2-63e7-4888-9529-80fe9a340382.vbs
                                        • Size 760B
                                        • SHA256 f74b966c770cce63056cc8dba6ef2a074dfe50cbe490bf504659fe4030c06259
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        acc5fb3a-89d5-445f-a930-771c2cbd718b.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\acc5fb3a-89d5-445f-a930-771c2cbd718b.vbs
                                        • Size 760B
                                        • SHA256 20bddc42ec0cf3a77e46b24177e3d97b8d681d83a3faa555028d67a11f2d9bbe
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        c7c06031-50d4-4f50-a1d6-85356893c987.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\c7c06031-50d4-4f50-a1d6-85356893c987.vbs
                                        • Size 760B
                                        • SHA256 aa077fd62fd3cbe084e7b810ac6a9c899f59574cd16eea4a70ce02b5bb798530
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        d9e3c0ee-a13d-4c71-b709-dc3685de7d40.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\d9e3c0ee-a13d-4c71-b709-dc3685de7d40.vbs
                                        • Size 536B
                                        • SHA256 5e525306312bbb04f7b206fd219751a8d97e4bc64b73a9b648291ca372160c65
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        e85117b3-1155-41d4-a2bc-8a3b8ef8ccc6.vbs
                                        • Path C:\Users\Admin\AppData\Local\Temp\e85117b3-1155-41d4-a2bc-8a3b8ef8ccc6.vbs
                                        • Size 760B
                                        • SHA256 2917db1dcac81b60ec8471c548d136786408152d8aff8f9fcc030bffb6cfe0a8
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        memory/4656-18-0x000000001B5E0000-0x000000001B5F0000-memory.dmp
                                        Download

                                        memory/4656-28-0x000000001BF20000-0x000000001BF28000-memory.dmp
                                        Download

                                        memory/4656-29-0x000000001BF30000-0x000000001BF3C000-memory.dmp
                                        Download

                                        memory/4656-27-0x000000001BEB0000-0x000000001BEBC000-memory.dmp
                                        Download

                                        memory/4656-25-0x000000001BC50000-0x000000001BC5E000-memory.dmp
                                        Download

                                        memory/4656-26-0x000000001BEC0000-0x000000001BECE000-memory.dmp
                                        Download

                                        memory/4656-24-0x000000001BF10000-0x000000001BF1A000-memory.dmp
                                        Download

                                        memory/4656-23-0x000000001BC40000-0x000000001BC4C000-memory.dmp
                                        Download

                                        memory/4656-22-0x000000001BC30000-0x000000001BC3C000-memory.dmp
                                        Download

                                        memory/4656-21-0x000000001BC20000-0x000000001BC2C000-memory.dmp
                                        Download

                                        memory/4656-20-0x000000001BC10000-0x000000001BC1C000-memory.dmp
                                        Download

                                        memory/4656-19-0x000000001B5F0000-0x000000001B5FA000-memory.dmp
                                        Download

                                        memory/4656-17-0x000000001B550000-0x000000001B558000-memory.dmp
                                        Download

                                        memory/4656-16-0x000000001B5C0000-0x000000001B5D6000-memory.dmp
                                        Download

                                        memory/4656-15-0x000000001BC60000-0x000000001BCB0000-memory.dmp
                                        Download

                                        memory/4656-14-0x0000000002B50000-0x0000000002B6C000-memory.dmp
                                        Download

                                        memory/4656-13-0x00000000007D0000-0x0000000000990000-memory.dmp
                                        Download

                                        memory/4656-12-0x00007FFDB2EA3000-0x00007FFDB2EA5000-memory.dmp
                                        Download