dcrat | 374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe
Size 3.5MB
Sample240705-bla7dsyekq
SHA256 374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0
MD5 4bf2b73b872ff49fbffe6ff7a73f97a8
SHA1 6c4e33d77e9b7a85b140048f4711d52380d866fc
SHA512 17821b08818ca4d81385a90f0c911f49bbcdb49d7793e26c53752c2a4f0281a435400a69dc9217b8c53d4209be8f9509cd775e42e1c2af5b1729f83f1a7f2695
SSDEEP 49152:/bA3Ds2r2n5E4UfeAn6ITBLXenQ36kxLGKlHbR7WKzjznJbRVL0x4FCE1zsbq0PI:/bW2nQt6x6l7WUXJ5FhNsW0w
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\lsass.exe\""	fontreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\""	fontreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\""	fontreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	fontreview.exe

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	340	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2624	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2624	schtasks.exe	88

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023491-15.dat	dcrat
behavioral2/memory/4560-17-0x0000000000710000-0x0000000000A5A000-memory.dmp	dcrat
behavioral2/files/0x00080000000234a3-86.dat	dcrat
behavioral2/files/0x000b0000000234a2-96.dat	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\Control Panel\International\Geo\Nation	fontreview.exe

Executes dropped EXE 2 IoCs

pid	Process
4560	fontreview.exe
4816	sihost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	fontreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Mail\\lsass.exe\""	fontreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Mail\\lsass.exe\""	fontreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	fontreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	fontreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	fontreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	fontreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	fontreview.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontreview.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ipinfo.io
19	ipinfo.io
9	ip-api.com

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\lsass.exe	fontreview.exe
File created	C:\Program Files (x86)\Windows Mail\6203df4a6bafc7	fontreview.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX66C6.tmp	fontreview.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX66F5.tmp	fontreview.exe
File created	C:\Program Files (x86)\Windows Mail\lsass.exe	fontreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fontreview.exe
Key created	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-771719357-2485960699-3367710044-1000_Classes\Local Settings	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3864	schtasks.exe
636	schtasks.exe
2240	schtasks.exe
212	schtasks.exe
700	schtasks.exe
4604	schtasks.exe
2996	schtasks.exe
340	schtasks.exe
4504	schtasks.exe
4508	schtasks.exe
4732	schtasks.exe
4336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4560	fontreview.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe
4816	sihost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4816	sihost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	fontreview.exe
Token: SeDebugPrivilege	4816	sihost.exe
Token: SeBackupPrivilege	3088	vssvc.exe
Token: SeRestorePrivilege	3088	vssvc.exe
Token: SeAuditPrivilege	3088	vssvc.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1056	2256	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe	83
PID 2256 wrote to memory of 1056	2256	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe	83
PID 2256 wrote to memory of 1056	2256	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe	83
PID 2256 wrote to memory of 1044	2256	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe	84
PID 2256 wrote to memory of 1044	2256	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe	84
PID 2256 wrote to memory of 1044	2256	374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe	84
PID 1056 wrote to memory of 1968	1056	WScript.exe	85
PID 1056 wrote to memory of 1968	1056	WScript.exe	85
PID 1056 wrote to memory of 1968	1056	WScript.exe	85
PID 1968 wrote to memory of 4560	1968	cmd.exe	87
PID 1968 wrote to memory of 4560	1968	cmd.exe	87
PID 4560 wrote to memory of 4816	4560	fontreview.exe	101
PID 4560 wrote to memory of 4816	4560	fontreview.exe	101
PID 4816 wrote to memory of 4800	4816	sihost.exe	102
PID 4816 wrote to memory of 4800	4816	sihost.exe	102
PID 4816 wrote to memory of 1364	4816	sihost.exe	103
PID 4816 wrote to memory of 1364	4816	sihost.exe	103

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sihost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe
"C:\Users\Admin\AppData\Local\Temp\374290f4bc29e1d5a3295b8f23c281393075beae64db51cd5a5e96c03f9ef8b0.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Media\ptTa5jsNCfUXu0BBuzB.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Media\r8iyEc3qvUngPTm4Ix.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Users\Admin\AppData\Roaming\Media\fontreview.exe
      "C:\Users\Admin\AppData\Roaming\Media\fontreview.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4560
    - - C:\Recovery\WindowsRE\sihost.exe
        
        "C:\Recovery\WindowsRE\sihost.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4816
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6bbb153-fa41-4e40-bdf1-5c60868da1bb.vbs"
        6⤵
        
        PID:4800
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc2d57f9-d31d-4aa6-b75c-b2276f780794.vbs"
        6⤵
        
        PID:1364
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Media\file.vbs"
  2⤵
  PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX6968.tmp

Path C:\Recovery\WindowsRE\RCX6968.tmp
Size 3.3MB
SHA256 e04e0c0b8d9adb45df5e4f016e961ed055feed1bed4c73060427a6687fc01c35
MD5 553b95b8cf4fc79cf8731c931dc80b5b
SHA1 3b61ea6d4d25355cd3b0bbf4f8db66aa335a73dd
SHA512 27d2d52d2cdd6eb4cf6480b9d5999368a14b159d82219777df34527bdeb428a15b1f62ae806e8a8bd2499aad6262a5a558a42ddc3bfd68532c5a9ae60ad6612e
SSDEEP 49152:d2r2n5E4UfeAn6ITBLXenQ36kxLGKlHbR7WKzjznJbRVL0x4FCE1zsbq0P:U2nQt6x6l7WUXJ5FhNsW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Recovery\WindowsRE\lsass.exe
Size 3.3MB
SHA256 805e7c36f99552b41fdaf1d05331ec0c1ca28a40bc899adf38d25621fef6a9ce
MD5 52a2cf4770974309e66830ca7a340f1e
SHA1 85038d8ed28b12b26eddd8a552021f14c5bcaef9
SHA512 2102f9b8387a4c7675552477a19240ade644efca766d5ba3559f4d5bf5c3c9987025006f273ff1fa21f4392f46ed860567d41af346e7f7571113d5da5ba78e36
SSDEEP 49152:t2r2n5E4UfeAn6ITBLXenQ36kxLGKlHbR7WKzjznJbRVL0x4FCE1zsbq0P:E2nQt6x6l7WUXJ5FhNsW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc2d57f9-d31d-4aa6-b75c-b2276f780794.vbs

Path C:\Users\Admin\AppData\Local\Temp\cc2d57f9-d31d-4aa6-b75c-b2276f780794.vbs
Size 484B
SHA256 9c9ec4ff8c44a45200d15dbc322affe7802a5ebd5c06ea073761683b760b6dc7
MD5 5a1f7d56ab50a1b01343c51b15671bd9
SHA1 34c180b4f0fa13362efa51f4b4394e7cdefc9e2e
SHA512 97c0faffef0ae05b8695c92585deb436db1e8b82fd795fca00b7ddc55aebe97fe027c4a0bc4b47112f2002196fafc9e826062974e923aca080da5c6a74065d56
MD5 SHA1 SHA512

Submit Download

e6bbb153-fa41-4e40-bdf1-5c60868da1bb.vbs

Path C:\Users\Admin\AppData\Local\Temp\e6bbb153-fa41-4e40-bdf1-5c60868da1bb.vbs
Size 708B
SHA256 6bea818540f6774e76a1082ff4c7f0ca57e16c9b9a35323771dc38127614a1a4
MD5 5fc997382f17d699a3a35eff212194cc
SHA1 158cdd38880e08177f82568e44a327e443fdab42
SHA512 b01bde2eac97df18ef386aec5571b63e24213f6dbb776c760b2d0b45420411e7af6337c1ce2b0c615cd3fdcc5407076672a9bed4ae9ed3749ee619e6452d166f
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\Users\Admin\AppData\Roaming\Media\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

fontreview.exe

Path C:\Users\Admin\AppData\Roaming\Media\fontreview.exe
Size 3.3MB
SHA256 f76ce5581a109be6e0d8358e0dc15a8dea066cb27256628a315e6edd94264b0c
MD5 ee603f48c1f35659899993e21fd33d8f
SHA1 86ee8bd079b178b31df3522c08a040aac575a6c6
SHA512 02ea39ee7d7cd30a588846d3da89ed89b8a4f322b1a58db1753633fd20d9066d2921bfe5685322f79c76d6466190fd34b8555f14363ed2607f759d64c254b0d8
SSDEEP 49152:92r2n5E4UfeAn6ITBLXenQ36kxLGKlHbR7WKzjznJbRVL0x4FCE1zsbq0P:02nQt6x6l7WUXJ5FhNsW0
MD5 SHA1 SHA512 SSDEEP

Submit Download

ptTa5jsNCfUXu0BBuzB.vbe

Path C:\Users\Admin\AppData\Roaming\Media\ptTa5jsNCfUXu0BBuzB.vbe
Size 204B
SHA256 8c2161c0de7a3e07e53766e6e267fe23f98c2cdeef31220eaa68be1bf48e0eb7
MD5 022c5590f72d752d578df8eb3f03d355
SHA1 9519d3ea40324448e06863b196dd23e7d4a12dac
SHA512 269369042c72fc985823e7938cd8635bf85f9c59e07a3065742321d7639c3a7865b807470ffb4efabb5573ecb1413463c0d270a6aa309786905286b6ad6db01a
MD5 SHA1 SHA512

Submit Download

r8iyEc3qvUngPTm4Ix.bat

Path C:\Users\Admin\AppData\Roaming\Media\r8iyEc3qvUngPTm4Ix.bat
Size 32B
SHA256 f1fc9c92abe5e1a915c0f3dfdbe9df00bc60a6163025574a33c1e48a8ae9eefb
MD5 c1ba58455a6a3970b127d9a7e1314cf0
SHA1 9855d4f713ba963f0976df6d5e1616d471265b70
SHA512 56a782da20e4e5e4233a530e32f564e94dfd4cb0643b7a63d07d6f3f4ef51ae0cbf0cff21cc9472b5ff0774afc753151a3da40871d1559ccd340307dfc9edd0c
MD5 SHA1 SHA512

Submit Download

memory/4560-35-0x000000001C4C0000-0x000000001C4C8000-memory.dmp

Download

memory/4560-39-0x000000001C4F0000-0x000000001C4FC000-memory.dmp

Download

memory/4560-23-0x000000001C260000-0x000000001C270000-memory.dmp

Download

memory/4560-22-0x000000001C250000-0x000000001C258000-memory.dmp

Download

memory/4560-21-0x000000001C2A0000-0x000000001C2F0000-memory.dmp

Download

memory/4560-26-0x000000001C2F0000-0x000000001C302000-memory.dmp

Download

memory/4560-27-0x000000001C420000-0x000000001C42C000-memory.dmp

Download

memory/4560-28-0x000000001C400000-0x000000001C408000-memory.dmp

Download

memory/4560-29-0x000000001C410000-0x000000001C420000-memory.dmp

Download

memory/4560-30-0x000000001C430000-0x000000001C43A000-memory.dmp

Download

memory/4560-31-0x000000001C440000-0x000000001C496000-memory.dmp

Download

memory/4560-32-0x000000001C490000-0x000000001C49C000-memory.dmp

Download

memory/4560-34-0x000000001C4B0000-0x000000001C4BC000-memory.dmp

Download

memory/4560-33-0x000000001C4A0000-0x000000001C4A8000-memory.dmp

Download

memory/4560-25-0x000000001C290000-0x000000001C298000-memory.dmp

Download

memory/4560-36-0x000000001C4D0000-0x000000001C4E2000-memory.dmp

Download

memory/4560-37-0x000000001CA10000-0x000000001CF38000-memory.dmp

Download

memory/4560-24-0x000000001C270000-0x000000001C286000-memory.dmp

Download

memory/4560-38-0x000000001C4E0000-0x000000001C4EC000-memory.dmp

Download

memory/4560-40-0x000000001C500000-0x000000001C508000-memory.dmp

Download

memory/4560-41-0x000000001C510000-0x000000001C51C000-memory.dmp

Download

memory/4560-42-0x000000001B730000-0x000000001B73C000-memory.dmp

Download

memory/4560-44-0x000000001B750000-0x000000001B75C000-memory.dmp

Download

memory/4560-43-0x000000001C760000-0x000000001C768000-memory.dmp

Download

memory/4560-46-0x000000001B760000-0x000000001B76E000-memory.dmp

Download

memory/4560-49-0x000000001C740000-0x000000001C74C000-memory.dmp

Download

memory/4560-48-0x000000001C730000-0x000000001C738000-memory.dmp

Download

memory/4560-47-0x000000001C720000-0x000000001C728000-memory.dmp

Download

memory/4560-45-0x000000001B740000-0x000000001B74A000-memory.dmp

Download

memory/4560-50-0x000000001C750000-0x000000001C758000-memory.dmp

Download

memory/4560-51-0x000000001C870000-0x000000001C87A000-memory.dmp

Download

memory/4560-52-0x000000001C770000-0x000000001C77C000-memory.dmp

Download

memory/4560-19-0x000000001B770000-0x000000001B778000-memory.dmp

Download

memory/4560-20-0x000000001C230000-0x000000001C24C000-memory.dmp

Download

memory/4560-18-0x0000000002BE0000-0x0000000002BEE000-memory.dmp

Download

memory/4560-17-0x0000000000710000-0x0000000000A5A000-memory.dmp

Download