dcrat | f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd

Analysis

max time kernel
135s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe
Size 1.5MB
Sample240706-cez3lsvflc
SHA256 f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd
MD5 1e9a88aba7de675e6d7d385cfba393e9
SHA1 891b6ae195a1b10fdeb94474d0c174671501a164
SHA512 2e2a8ea45085a2d9069ffb330a14879f8554bb52a04f9cb36a43dac5344ca410bee32e792576c3b7cd0835af0c43c2bbeb71543eb3c73ce9a8228fd49891464f
SSDEEP 24576:U2G/nvxW3Ww0tWT0hI40WPkGHSaGQhY9sb0jKKO4YNlSMjiz:UbA30WT6fM+b0jjGNDI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2072	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3568	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3968	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3492	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	920	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2212	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	2212	schtasks.exe	91

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000234f8-10.dat	dcrat
behavioral2/memory/232-13-0x0000000000960000-0x0000000000A92000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	msserverreview.exe

Executes dropped EXE 2 IoCs

pid	Process
232	msserverreview.exe
1032	wininit.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\cmd.exe	msserverreview.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\e6c9b481da804f	msserverreview.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\69ddcba757bf72	msserverreview.exe
File created	C:\Program Files (x86)\Windows Mail\7a0fd90576e088	msserverreview.exe
File created	C:\Program Files (x86)\Microsoft\RuntimeBroker.exe	msserverreview.exe
File created	C:\Program Files (x86)\Microsoft\9e8d7a4ca61bd9	msserverreview.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	msserverreview.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5b884080fd4f94	msserverreview.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	msserverreview.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe	msserverreview.exe
File created	C:\Program Files\Windows Mail\wininit.exe	msserverreview.exe
File created	C:\Program Files\Windows Mail\56085415360792	msserverreview.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\886983d96e3d3e	msserverreview.exe
File created	C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe	msserverreview.exe
File created	C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe	msserverreview.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\smss.exe	msserverreview.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe	msserverreview.exe
File created	C:\Program Files (x86)\Windows Mail\explorer.exe	msserverreview.exe
File created	C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9	msserverreview.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe	msserverreview.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\services.exe	msserverreview.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\c5b4cb5e9653cc	msserverreview.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\Registration\CRMLog\sysmon.exe	msserverreview.exe
File created	C:\Windows\Registration\CRMLog\121e5b5079f7c0	msserverreview.exe
File created	C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\spoolsv.exe	msserverreview.exe
File created	C:\Windows\Fonts\dllhost.exe	msserverreview.exe
File created	C:\Windows\Fonts\5940a34987c991	msserverreview.exe
File created	C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\f3b6ecef712a24	msserverreview.exe
File created	C:\Windows\Vss\Writers\Application\TextInputHost.exe	msserverreview.exe
File created	C:\Windows\Vss\Writers\Application\22eafd247d37c3	msserverreview.exe
File created	C:\Windows\security\database\spoolsv.exe	msserverreview.exe
File created	C:\Windows\security\database\f3b6ecef712a24	msserverreview.exe
File created	C:\Windows\ServiceState\EventLog\Data\dllhost.exe	msserverreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe
Key created	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000_Classes\Local Settings	msserverreview.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4552	schtasks.exe
3044	schtasks.exe
1384	schtasks.exe
1732	schtasks.exe
4440	schtasks.exe
3492	schtasks.exe
4012	schtasks.exe
4576	schtasks.exe
540	schtasks.exe
2072	schtasks.exe
4764	schtasks.exe
1200	schtasks.exe
4532	schtasks.exe
3992	schtasks.exe
4788	schtasks.exe
4956	schtasks.exe
5016	schtasks.exe
4336	schtasks.exe
680	schtasks.exe
3576	schtasks.exe
1660	schtasks.exe
2160	schtasks.exe
2576	schtasks.exe
1448	schtasks.exe
3292	schtasks.exe
2044	schtasks.exe
788	schtasks.exe
1536	schtasks.exe
920	schtasks.exe
3312	schtasks.exe
4812	schtasks.exe
4064	schtasks.exe
2384	schtasks.exe
2748	schtasks.exe
4920	schtasks.exe
3968	schtasks.exe
4072	schtasks.exe
1248	schtasks.exe
3368	schtasks.exe
3460	schtasks.exe
2608	schtasks.exe
1784	schtasks.exe
964	schtasks.exe
3568	schtasks.exe
1088	schtasks.exe
212	schtasks.exe
536	schtasks.exe
4156	schtasks.exe
3224	schtasks.exe
752	schtasks.exe
4344	schtasks.exe
2372	schtasks.exe
4768	schtasks.exe
2976	schtasks.exe
1992	schtasks.exe
4836	schtasks.exe
4204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
232	msserverreview.exe
1032	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	232	msserverreview.exe
Token: SeDebugPrivilege	1032	wininit.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2640	1280	f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe	87
PID 1280 wrote to memory of 2640	1280	f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe	87
PID 1280 wrote to memory of 2640	1280	f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe	87
PID 2640 wrote to memory of 4792	2640	WScript.exe	88
PID 2640 wrote to memory of 4792	2640	WScript.exe	88
PID 2640 wrote to memory of 4792	2640	WScript.exe	88
PID 4792 wrote to memory of 232	4792	cmd.exe	90
PID 4792 wrote to memory of 232	4792	cmd.exe	90
PID 232 wrote to memory of 4200	232	msserverreview.exe	149
PID 232 wrote to memory of 4200	232	msserverreview.exe	149
PID 4200 wrote to memory of 3380	4200	cmd.exe	151
PID 4200 wrote to memory of 3380	4200	cmd.exe	151
PID 4200 wrote to memory of 1032	4200	cmd.exe	152
PID 4200 wrote to memory of 1032	4200	cmd.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe
"C:\Users\Admin\AppData\Local\Temp\f3f9b1658338c551bb07cd481170b4177408df088d9686b8912e6bbb6f6551cd.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BridgeproviderComponentWeb\CMsHZr.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BridgeproviderComponentWeb\nWoDGncQ9swsrnWdh.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\BridgeproviderComponentWeb\msserverreview.exe
      "C:\BridgeproviderComponentWeb\msserverreview.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:232
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZSl7YTHxoO.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4200
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3380
      - C:\Program Files\Windows Mail\wininit.exe
        
        "C:\Program Files\Windows Mail\wininit.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\Registration\CRMLog\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\CRMLog\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\SystemResources\Microsoft.Windows.SecHealthUI\pris\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\Application\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Windows\Vss\Writers\Application\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\BridgeproviderComponentWeb\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\BridgeproviderComponentWeb\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\BridgeproviderComponentWeb\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\security\database\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\security\database\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\security\database\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\BridgeproviderComponentWeb\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\BridgeproviderComponentWeb\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\BridgeproviderComponentWeb\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Fonts\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\BridgeproviderComponentWeb\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\BridgeproviderComponentWeb\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\BridgeproviderComponentWeb\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CMsHZr.vbe

Path C:\BridgeproviderComponentWeb\CMsHZr.vbe
Size 220B
SHA256 d847438f00c73870c460d5509f79b8399766605f444d0c47ff83de789f8612d5
MD5 04c75c67c7b85bd5a73747abc7ac51b3
SHA1 318ed3c6066385775a6c9fd259464bcc043ed8f3
SHA512 069d9bf8309a89df5b8e54a2acc2b03820426e0cf0046be01473f6697cc6ff8e7081b69cb3ce3402fbd3234a920302ddbfd1be0553c04e663fbe04207fd099c6
MD5 SHA1 SHA512

Submit Download

msserverreview.exe

Path C:\BridgeproviderComponentWeb\msserverreview.exe
Size 1.2MB
SHA256 aae27dbee53b9aacb4bf21b9349fe6be453f2020425759f6f3fc85a0058215d1
MD5 f290d1e8b836ffb7a71cbdd5d38b8ad5
SHA1 34080d3c82cb3cd3d5b7bf4ceea2f69722a58598
SHA512 73af5b54a2809780c7b05096c567de10436550a47e9ab4a13a3952e13b963e5508d81f88461dcc628178a8e941fca622b8f0f4382472a5e259f43586ea20ca71
SSDEEP 24576:zT0hI40WPkGHSaGQhY9sb0jKKO4YNlSMji:zT6fM+b0jjGND
MD5 SHA1 SHA512 SSDEEP

Submit Download

nWoDGncQ9swsrnWdh.bat

Path C:\BridgeproviderComponentWeb\nWoDGncQ9swsrnWdh.bat
Size 50B
SHA256 16495af781bf0d6a02ee71d6c59ac8398ba2bc916851236f949ed6451e561876
MD5 2670f34f0133c3d71440528a96e0e650
SHA1 f1df1b26489f870bda982fab884ac8b531937c7e
SHA512 26af6d086397ff57a0e49aec3616364de4514b2988f42194af69984d4a74cb5b996f0d9d24b442ba8090827f5bba3877c154e423526b1ec7864a1bbbc65b7234
MD5 SHA1 SHA512

Submit Download

ZSl7YTHxoO.bat

Path C:\Users\Admin\AppData\Local\Temp\ZSl7YTHxoO.bat
Size 206B
SHA256 6d027b7fcadeb6327e4a7676c9ed9f9c0782968bba39af6b680e3e9ad0c2a380
MD5 d176f012930226d7d6247c0fb0d50cfd
SHA1 a2291c0b806cb7e494e6a5b3bb1b213b8d062ff0
SHA512 6e46ea5e44d73149a0893cf0940e60b899c0fd734bad159517876782445751d8a0c2947f2456126b9f703856e9470a94842bdec1184a46665924e28158a564db
MD5 SHA1 SHA512

Submit Download

memory/232-12-0x00007FFB7BBB3000-0x00007FFB7BBB5000-memory.dmp

Download

memory/232-13-0x0000000000960000-0x0000000000A92000-memory.dmp

Download

memory/232-14-0x000000001B6A0000-0x000000001B6BC000-memory.dmp

Download

memory/232-15-0x000000001B710000-0x000000001B760000-memory.dmp

Download

memory/232-16-0x000000001B6C0000-0x000000001B6D6000-memory.dmp

Download

memory/232-17-0x000000001B6E0000-0x000000001B6EC000-memory.dmp

Download