dcrat | 131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe
Size 1.6MB
Sample240714-kmncsawdkf
SHA256 131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac
MD5 1849f89a807de47190139035f6148366
SHA1 0e23f3cfc246483f5dd17815fea3d5011f6611c7
SHA512 49398d7a4f763caf39385945abbc3c028be655fa4d89f05b638708f2e1d790c94deee45e3fd14c7c34acba71c037f6d155514c69342a2257f1a21c084488d154
SSDEEP 24576:05YLUm55/+Bo4L+n5iSFjw0bAtnG/E4yUzJu/iPenTjabqlfii9m2JKSTMGsWq1x:05o52O4LCBinG/hXuGkSGKgy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer ransomware rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1260	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1228	1408	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	1408	schtasks.exe	93

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000900000002349a-7.dat	dcrat
behavioral2/files/0x00070000000234f9-127.dat	dcrat
behavioral2/memory/1960-129-0x0000000000790000-0x00000000008FA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe

Executes dropped EXE 4 IoCs

pid	Process
5068	NVIDIA Container.exe
2424	Locker.exe
1960	NVIDIA Container.exe
4160	dllhost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	Locker.exe
File opened (read-only)	\??\s:	Locker.exe
File opened (read-only)	\??\q:	Locker.exe
File opened (read-only)	\??\r:	Locker.exe
File opened (read-only)	\??\v:	Locker.exe
File opened (read-only)	\??\b:	Locker.exe
File opened (read-only)	\??\g:	Locker.exe
File opened (read-only)	\??\h:	Locker.exe
File opened (read-only)	\??\l:	Locker.exe
File opened (read-only)	\??\m:	Locker.exe
File opened (read-only)	\??\y:	Locker.exe
File opened (read-only)	\??\z:	Locker.exe
File opened (read-only)	\??\j:	Locker.exe
File opened (read-only)	\??\k:	Locker.exe
File opened (read-only)	\??\n:	Locker.exe
File opened (read-only)	\??\w:	Locker.exe
File opened (read-only)	\??\x:	Locker.exe
File opened (read-only)	\??\u:	Locker.exe
File opened (read-only)	\??\e:	Locker.exe
File opened (read-only)	\??\i:	Locker.exe
File opened (read-only)	\??\o:	Locker.exe
File opened (read-only)	\??\p:	Locker.exe
File opened (read-only)	\??\t:	Locker.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x00080000000234f0-15.dat	autoit_exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wl.jpg"	Locker.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\System.exe	NVIDIA Container.exe
File created	C:\Program Files\Windows Mail\winlogon.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\9e8d7a4ca61bd9	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\e1ef82546f0b02	NVIDIA Container.exe
File created	C:\Program Files\Microsoft Office\root\Client\27d1bcfc3c54e0	NVIDIA Container.exe
File created	C:\Program Files\Windows Mail\cc11b995f2a76d	NVIDIA Container.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe	NVIDIA Container.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\SppExtComObj.exe	NVIDIA Container.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\e1ef82546f0b02	NVIDIA Container.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\OCR\csrss.exe	NVIDIA Container.exe
File created	C:\Windows\Registration\CRMLog\NVIDIA Container.exe	NVIDIA Container.exe
File created	C:\Windows\Registration\CRMLog\35158c38368e73	NVIDIA Container.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\Desktop	Locker.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	NVIDIA Container.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
536	schtasks.exe
548	schtasks.exe
2140	schtasks.exe
4644	schtasks.exe
2356	schtasks.exe
2404	schtasks.exe
1556	schtasks.exe
4056	schtasks.exe
1228	schtasks.exe
2756	schtasks.exe
2840	schtasks.exe
2280	schtasks.exe
1128	schtasks.exe
4584	schtasks.exe
2312	schtasks.exe
4552	schtasks.exe
4380	schtasks.exe
1500	schtasks.exe
2820	schtasks.exe
3620	schtasks.exe
4120	schtasks.exe
3640	schtasks.exe
4248	schtasks.exe
2836	schtasks.exe
1348	schtasks.exe
4696	schtasks.exe
2192	schtasks.exe
3376	schtasks.exe
3152	schtasks.exe
4344	schtasks.exe
2144	schtasks.exe
1880	schtasks.exe
5112	schtasks.exe
3544	schtasks.exe
1648	schtasks.exe
4872	schtasks.exe
3420	schtasks.exe
1612	schtasks.exe
2732	schtasks.exe
3648	schtasks.exe
4580	schtasks.exe
3984	schtasks.exe
2888	schtasks.exe
3960	schtasks.exe
2360	schtasks.exe
2968	schtasks.exe
4960	schtasks.exe
2788	schtasks.exe
1076	schtasks.exe
3468	schtasks.exe
1260	schtasks.exe
1240	schtasks.exe
1160	schtasks.exe
1640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
1960	NVIDIA Container.exe
4160	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	NVIDIA Container.exe
Token: SeDebugPrivilege	4160	dllhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5068	3028	131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe	86
PID 3028 wrote to memory of 5068	3028	131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe	86
PID 3028 wrote to memory of 5068	3028	131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe	86
PID 3028 wrote to memory of 2424	3028	131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe	87
PID 3028 wrote to memory of 2424	3028	131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe	87
PID 3028 wrote to memory of 2424	3028	131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe	87
PID 5068 wrote to memory of 1436	5068	NVIDIA Container.exe	88
PID 5068 wrote to memory of 1436	5068	NVIDIA Container.exe	88
PID 5068 wrote to memory of 1436	5068	NVIDIA Container.exe	88
PID 1436 wrote to memory of 964	1436	WScript.exe	90
PID 1436 wrote to memory of 964	1436	WScript.exe	90
PID 1436 wrote to memory of 964	1436	WScript.exe	90
PID 964 wrote to memory of 1960	964	cmd.exe	92
PID 964 wrote to memory of 1960	964	cmd.exe	92
PID 1960 wrote to memory of 4160	1960	NVIDIA Container.exe	148
PID 1960 wrote to memory of 4160	1960	NVIDIA Container.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe
"C:\Users\Admin\AppData\Local\Temp\131c1efa923313555608e90d97f0a2d8fdf3fbe4695397278ca391009148f9ac.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
  "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
        
        "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1960
      - C:\NVIDIA\DisplayDriver\dllhost.exe
        
        "C:\NVIDIA\DisplayDriver\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4160
- C:\Users\Admin\AppData\Local\Temp\Locker.exe
  "C:\Users\Admin\AppData\Local\Temp\Locker.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Sets desktop wallpaper using registry
  - Modifies Control Panel
  PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\NVIDIA\DisplayDriver\535.21\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\NVIDIA\DisplayDriver\535.21\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\root\Client\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Client\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\root\Client\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\NVIDIA\DisplayDriver\535.21\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\NVIDIA\DisplayDriver\535.21\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\NVIDIA\DisplayDriver\535.21\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\NVIDIA\DisplayDriver\535.21\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.106\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.106\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.106\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\ssh\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\ssh\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Documents\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\NVIDIA\DisplayDriver\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA ContainerN" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\CRMLog\NVIDIA Container.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA Container" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\NVIDIA Container.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NVIDIA ContainerN" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\NVIDIA Container.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\NVIDIA\DisplayDriver\535.21\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\535.21\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

NVIDIA Container.exe

Path C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
Size 1.4MB
SHA256 b495e22042b08f27b690da18986ec74d5054a65d05d5cf41fdecd5751482ccbd
MD5 4a591f46c87b49a7de93f5ac771cd4ab
SHA1 e0992350818e5c56d3f2e3a6db340d1f5b8f3314
SHA512 b498445d1e427853690250aebff35cbd7e28e85a89ad868e3483930b16ec13198357cfcd5feb45567b1bc8f3d9f97c5ecf2d242c8a5e9d758a536d0498ba7955
SSDEEP 24576:gi39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yv+aX7:gwRVQysEUCHaiy9Gvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxJne99RtKqQDunPUGdos.bat

Path C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat
Size 53B
SHA256 0385dbf94fc27705560cf0b6b04e9a37181db486ee8f7573c5ad2217d18f4ca0
MD5 7784d810f5ff3afa8df50e360eb90e7d
SHA1 f04802a991ff6461aa1c35b7c0f68e43d5a114c6
SHA512 80038ae2bfd5f8ca3f4812ab5c342878f98978007125c9dca5edb915701a5383916131cdc3082c054c49c508cd210aff70319ac0fc498cbdd6cee776df672cac
MD5 SHA1 SHA512

Submit Download

zajaYJ4rqwpmDK2a6yrvwdV.vbe

Path C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe
Size 225B
SHA256 d3bf5c54de984dd2d1d779494deb8a995cc062eb5f25c465d0de78d99b8cc52b
MD5 d7df2670ad0c6c7b9cc48122f20f086c
SHA1 e69bf8c214d8c4b768125ca03e402e1c871cc233
SHA512 05ed88410790bf74dc7ab880f893e555c4859c133e79a89f28b5e1a68c36f4a4f28d3b7b6532953c04b6d23a21faf53e60107efde9e6acb492a9235d48943f03
MD5 SHA1 SHA512

Submit Download

Locker.exe

Path C:\Users\Admin\AppData\Local\Temp\Locker.exe
Size 793KB
SHA256 7a923db27ae488a02e77242b1bbceb9a64898b9c2d085372a5ef5fca06b2a4be
MD5 a83185ef7c03bfe0e0fbe10098876a34
SHA1 b166fed95e9bcc9f8b0ac4deafa9c45c21e91d0d
SHA512 283e698b326d044480c49351531249ab9ed3a851c1d2c4a36c87fc5ecbaf2771af58f39cc0fc1551d08a4674ad766a3d4b96b6ee6ca1e6e967727f320f599f4c
SSDEEP 12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a734lIP5J1:oRmJkcoQricOIQxiZY1iaD4MJ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NVIDIA Container.exe

Path C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
Size 1.8MB
SHA256 67942630366d114efa35f3f4a79741a4a4eb2c3b0c8ffaac07af527f84d4489a
MD5 531bf67134a7c1fb4096113ca58cc648
SHA1 99e0fc1fb7a07c0685e426b327921d3e6c34498c
SHA512 8facae8335a4f33f54e48c64814946eb8b480800b4453612fffcef64117946a35d493f433d4e27186ee864603da756319f816e70c3bfc08b8bb1861fc7030ff4
SSDEEP 24576:92G/nvxW3WDGkIJ1i39O3pP/GFPWjOo8hSrOfT4tPSNUIF+lL+FsxQ/MR9Gv6Yvg:9bA3gy1wRVQysEUCHaiy9Gvkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

autEAEC.tmp

Path C:\Users\Admin\AppData\Local\Temp\autEAEC.tmp
Size 138KB
SHA256 b75685e5fe51601632066ae2cb162738b340c9873f3b30cd4eb0b6f80cc27643
MD5 7c30424c525cb64760083e066ca1f77d
SHA1 69c369028e3db4fe5c2fbc69cbd837d66496c480
SHA512 59d726222ffc846ada2e7c6d040e0f0114e2cb92e72f81f23489aa6681b07a1c8cfceb7e81f9b7d7678d33b313302d9cf39c345d862e43f2768e145df14ef8df
SSDEEP 3072:kKX/dVHIbK37nNt1GBpgOnsB2h5YOwuKPpuDh6v2v1/5OIS:DPHf37nNnoSMsBs5YOwuSuL5OIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1960-145-0x0000000001170000-0x0000000001186000-memory.dmp

Download

memory/1960-129-0x0000000000790000-0x00000000008FA000-memory.dmp

Download

memory/1960-143-0x0000000001150000-0x000000000116C000-memory.dmp

Download

memory/1960-144-0x00000000011D0000-0x0000000001220000-memory.dmp

Download

memory/1960-146-0x0000000001190000-0x00000000011A0000-memory.dmp

Download

memory/1960-150-0x00000000011B0000-0x00000000011BE000-memory.dmp

Download

memory/1960-149-0x00000000011A0000-0x00000000011AE000-memory.dmp

Download

memory/1960-152-0x0000000001220000-0x000000000122C000-memory.dmp

Download

memory/3028-4-0x00007FFA422C0000-0x00007FFA42D81000-memory.dmp

Download

memory/3028-1-0x0000000000F60000-0x000000000110C000-memory.dmp

Download

memory/3028-0-0x00007FFA422C3000-0x00007FFA422C5000-memory.dmp

Download

memory/3028-24-0x00007FFA422C0000-0x00007FFA42D81000-memory.dmp

Download