Analysis
-
max time kernel
107s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
21-07-2024 13:04
Behavioral task
behavioral1
Sample
c830d62f6f45993891816dee47dee340N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c830d62f6f45993891816dee47dee340N.exe
Resource
win10v2004-20240709-en
General
-
Target
c830d62f6f45993891816dee47dee340N.exe
-
Size
1.7MB
-
MD5
c830d62f6f45993891816dee47dee340
-
SHA1
4284963ed30b687ccd47a2d69e6809e4290f0c78
-
SHA256
2338d4f0154b4295202b61eafb9c5e457112de784325f6fc38a587be668024e3
-
SHA512
d7870eca65c6b6b25b3f7dd788414afd64c075db9bdd1d8b099e932ab571449fe20126d5bde0bd3aaebd2c10ac4160c6ffee1899d8b2b37874f0a996af886fdc
-
SSDEEP
24576:mwtlgjpoyMl1W9Rl/3XF9R95g9f53Lv+6gJUHGHhuf9QkGuW+4HcWb1JB4nS:BtyotW9RN+f53i1JUHG4xGuDkcY1JB
Malware Config
Signatures
-
DcRat 21 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3656 schtasks.exe 3572 schtasks.exe 2804 schtasks.exe 116 schtasks.exe 996 schtasks.exe 3340 schtasks.exe 2192 schtasks.exe 3128 schtasks.exe 2924 schtasks.exe 1880 schtasks.exe 2224 schtasks.exe 3536 schtasks.exe 2320 schtasks.exe 4988 schtasks.exe 4420 schtasks.exe 4764 schtasks.exe 3780 schtasks.exe 3760 schtasks.exe 2640 schtasks.exe 2576 schtasks.exe 456 schtasks.exe -
Modifies WinLogon for persistence 2 TTPs 7 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exec830d62f6f45993891816dee47dee340N.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\", \"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\", \"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\", \"C:\\Users\\Admin\\OneDrive\\c830d62f6f45993891816dee47dee340N.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\", \"C:\\Windows\\addins\\winlogon.exe\"" c830d62f6f45993891816dee47dee340N.exe -
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 456 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3656 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2576 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2224 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3128 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2804 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3340 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3536 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2192 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2640 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4764 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4420 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 116 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 996 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3572 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3780 4012 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3760 4012 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/1428-1-0x0000000000930000-0x0000000000AE2000-memory.dmp dcrat C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2376 powershell.exe 4124 powershell.exe 3464 powershell.exe 4788 powershell.exe 1180 powershell.exe 1204 powershell.exe 4276 powershell.exe 2360 powershell.exe 1092 powershell.exe -
Drops file in Drivers directory 1 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts c830d62f6f45993891816dee47dee340N.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c830d62f6f45993891816dee47dee340N.exec830d62f6f45993891816dee47dee340N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation c830d62f6f45993891816dee47dee340N.exe Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation c830d62f6f45993891816dee47dee340N.exe -
Executes dropped EXE 2 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exeSearchApp.exepid process 1548 c830d62f6f45993891816dee47dee340N.exe 2376 SearchApp.exe -
Adds Run key to start application 2 TTPs 14 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exec830d62f6f45993891816dee47dee340N.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\RuntimeBroker.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c830d62f6f45993891816dee47dee340N = "\"C:\\Users\\Admin\\OneDrive\\c830d62f6f45993891816dee47dee340N.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\addins\\winlogon.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\csrss.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\addins\\winlogon.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\Panther\\setup.exe\\SearchApp.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c830d62f6f45993891816dee47dee340N = "\"C:\\Users\\Admin\\OneDrive\\c830d62f6f45993891816dee47dee340N.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" c830d62f6f45993891816dee47dee340N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\taskhostw.exe\"" c830d62f6f45993891816dee47dee340N.exe -
Drops file in Program Files directory 12 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exedescription ioc process File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe c830d62f6f45993891816dee47dee340N.exe File created C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe c830d62f6f45993891816dee47dee340N.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\886983d96e3d3e c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX9DF7.tmp c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCX9FFC.tmp c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXA405.tmp c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe c830d62f6f45993891816dee47dee340N.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\9e8d7a4ca61bd9 c830d62f6f45993891816dee47dee340N.exe File created C:\Program Files\Microsoft Office 15\ClientX64\ea9f0e6c9e2dcd c830d62f6f45993891816dee47dee340N.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe c830d62f6f45993891816dee47dee340N.exe -
Drops file in Windows directory 7 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exec830d62f6f45993891816dee47dee340N.exedescription ioc process File created C:\Windows\Panther\setup.exe\SearchApp.exe c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Windows\Panther\setup.exe\SearchApp.exe c830d62f6f45993891816dee47dee340N.exe File created C:\Windows\Panther\setup.exe\38384e6a620884 c830d62f6f45993891816dee47dee340N.exe File created C:\Windows\addins\winlogon.exe c830d62f6f45993891816dee47dee340N.exe File created C:\Windows\addins\cc11b995f2a76d c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Windows\addins\RCXA201.tmp c830d62f6f45993891816dee47dee340N.exe File opened for modification C:\Windows\addins\winlogon.exe c830d62f6f45993891816dee47dee340N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exec830d62f6f45993891816dee47dee340N.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c830d62f6f45993891816dee47dee340N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c830d62f6f45993891816dee47dee340N.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2576 schtasks.exe 3128 schtasks.exe 3536 schtasks.exe 996 schtasks.exe 2320 schtasks.exe 456 schtasks.exe 3656 schtasks.exe 2804 schtasks.exe 3340 schtasks.exe 2640 schtasks.exe 4764 schtasks.exe 3780 schtasks.exe 1880 schtasks.exe 2192 schtasks.exe 4420 schtasks.exe 3572 schtasks.exe 3760 schtasks.exe 4988 schtasks.exe 2224 schtasks.exe 2924 schtasks.exe 116 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exec830d62f6f45993891816dee47dee340N.exepid process 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 2360 powershell.exe 2360 powershell.exe 3464 powershell.exe 3464 powershell.exe 2376 powershell.exe 2376 powershell.exe 4124 powershell.exe 4124 powershell.exe 1092 powershell.exe 1092 powershell.exe 4276 powershell.exe 4276 powershell.exe 2360 powershell.exe 1428 c830d62f6f45993891816dee47dee340N.exe 3464 powershell.exe 4124 powershell.exe 2376 powershell.exe 1092 powershell.exe 4276 powershell.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1428 c830d62f6f45993891816dee47dee340N.exe 1548 c830d62f6f45993891816dee47dee340N.exe 1548 c830d62f6f45993891816dee47dee340N.exe 1548 c830d62f6f45993891816dee47dee340N.exe 1548 c830d62f6f45993891816dee47dee340N.exe 1548 c830d62f6f45993891816dee47dee340N.exe 1548 c830d62f6f45993891816dee47dee340N.exe 1548 c830d62f6f45993891816dee47dee340N.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exec830d62f6f45993891816dee47dee340N.exepowershell.exepowershell.exepowershell.exeSearchApp.exedescription pid process Token: SeDebugPrivilege 1428 c830d62f6f45993891816dee47dee340N.exe Token: SeDebugPrivilege 3464 powershell.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeDebugPrivilege 2376 powershell.exe Token: SeDebugPrivilege 4124 powershell.exe Token: SeDebugPrivilege 1092 powershell.exe Token: SeDebugPrivilege 4276 powershell.exe Token: SeDebugPrivilege 1548 c830d62f6f45993891816dee47dee340N.exe Token: SeDebugPrivilege 4788 powershell.exe Token: SeDebugPrivilege 1180 powershell.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeDebugPrivilege 2376 SearchApp.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
c830d62f6f45993891816dee47dee340N.exec830d62f6f45993891816dee47dee340N.exedescription pid process target process PID 1428 wrote to memory of 4276 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 4276 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 2360 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 2360 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 2376 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 2376 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 4124 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 4124 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 3464 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 3464 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 1092 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 1092 1428 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1428 wrote to memory of 1548 1428 c830d62f6f45993891816dee47dee340N.exe c830d62f6f45993891816dee47dee340N.exe PID 1428 wrote to memory of 1548 1428 c830d62f6f45993891816dee47dee340N.exe c830d62f6f45993891816dee47dee340N.exe PID 1548 wrote to memory of 4788 1548 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1548 wrote to memory of 4788 1548 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1548 wrote to memory of 1180 1548 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1548 wrote to memory of 1180 1548 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1548 wrote to memory of 1204 1548 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1548 wrote to memory of 1204 1548 c830d62f6f45993891816dee47dee340N.exe powershell.exe PID 1548 wrote to memory of 2376 1548 c830d62f6f45993891816dee47dee340N.exe SearchApp.exe PID 1548 wrote to memory of 2376 1548 c830d62f6f45993891816dee47dee340N.exe SearchApp.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe"C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\winlogon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe"C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c830d62f6f45993891816dee47dee340N.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\setup.exe\SearchApp.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\Panther\setup.exe\SearchApp.exe"C:\Windows\Panther\setup.exe\SearchApp.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\winlogon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\addins\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\addins\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\Panther\setup.exe\SearchApp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Windows\Panther\setup.exe\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "c830d62f6f45993891816dee47dee340Nc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "c830d62f6f45993891816dee47dee340N" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "c830d62f6f45993891816dee47dee340Nc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\OneDrive\c830d62f6f45993891816dee47dee340N.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5c830d62f6f45993891816dee47dee340
SHA14284963ed30b687ccd47a2d69e6809e4290f0c78
SHA2562338d4f0154b4295202b61eafb9c5e457112de784325f6fc38a587be668024e3
SHA512d7870eca65c6b6b25b3f7dd788414afd64c075db9bdd1d8b099e932ab571449fe20126d5bde0bd3aaebd2c10ac4160c6ffee1899d8b2b37874f0a996af886fdc
-
Filesize
1KB
MD57800fca2323a4130444c572374a030f4
SHA140c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA25629f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
SHA512c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5b4b6d4cc52b5a3a71149b1f33d94d5de
SHA197d3dbdd24919eab70e3b14c68797cefc07e90dd
SHA256da8c02ce00d5b1e6d4c3667465c7bbc14d7cd5227eb634f3d9690afd488267fe
SHA512fc894f03709b83df7d2fca2779e1e60549078b67bcdbff0b61c8e5a802982210ae971309c1f92577573299288963ab5c95c6b38cbaedf53dc6062812c57a97af
-
Filesize
944B
MD55cfe303e798d1cc6c1dab341e7265c15
SHA1cd2834e05191a24e28a100f3f8114d5a7708dc7c
SHA256c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab
SHA512ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82