Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
23/07/2024, 14:55
Behavioral task
behavioral1
Sample
gradlew.exe
Resource
win7-20240708-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
gradlew.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
32 signatures
150 seconds
General
- Target gradlew.exe
- Size 3.1MB
- Sample240723-saqalswblp
- SHA256 c401439e32ff3789bc0f18182d58a13b661396fff40a86c3ffc290c151349356
- MD5 10484b2845bc5be1e77a4ca03b81996f
- SHA1 101a51ec35335cc2eaaa6315309924d5765ce6a5
- SHA512 35974b655d22f4b498f5b306d741ae97be1bb7a3973eee83961b705d5f027b6e2587f37e41ca3d6f4ebb2560553a848f3ace53899c429a81235d29bfab630957
- SSDEEP 98304:ub0FSgj8YFrn8RBXsGKZPEy8+4iQEk70j:uenj8YFrn8MPdj5SEkAj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- DcRat 52 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 1480 schtasks.exe 2296 schtasks.exe 4432 schtasks.exe 2044 schtasks.exe 1824 schtasks.exe 2028 schtasks.exe 2284 schtasks.exe 1012 schtasks.exe 4132 schtasks.exe 2728 schtasks.exe 948 schtasks.exe 3288 schtasks.exe 2864 schtasks.exe 1200 schtasks.exe 664 schtasks.exe 4380 schtasks.exe 1592 schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gradlew.exe 2156 schtasks.exe 2900 schtasks.exe 2040 schtasks.exe 2804 schtasks.exe 2108 schtasks.exe 856 schtasks.exe 3512 schtasks.exe 2544 schtasks.exe 1716 schtasks.exe 1156 schtasks.exe 2848 schtasks.exe 1484 schtasks.exe 1072 schtasks.exe 448 schtasks.exe 3404 schtasks.exe 3856 schtasks.exe 2232 schtasks.exe 3184 schtasks.exe 2440 schtasks.exe 2152 schtasks.exe 4404 schtasks.exe 3176 schtasks.exe 1936 schtasks.exe 4480 schtasks.exe 1196 schtasks.exe 2396 schtasks.exe 1780 schtasks.exe 2468 schtasks.exe 3360 schtasks.exe 1384 schtasks.exe 4012 schtasks.exe 1500 schtasks.exe 1532 schtasks.exe 1212 schtasks.exe - Modifies WinLogon for persistence 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\", \"C:\\reviewsessionDhcp\\wininit.exe\", \"C:\\reviewsessionDhcp\\dllhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\taskhostw.exe\", \"C:\\Users\\Public\\Desktop\\fontdrvhost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\", \"C:\\reviewsessionDhcp\\wininit.exe\", \"C:\\reviewsessionDhcp\\dllhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\taskhostw.exe\", \"C:\\Users\\Public\\Desktop\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Mail\\services.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\lsass.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\", \"C:\\reviewsessionDhcp\\wininit.exe\", \"C:\\reviewsessionDhcp\\dllhost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\", \"C:\\reviewsessionDhcp\\wininit.exe\", \"C:\\reviewsessionDhcp\\dllhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\taskhostw.exe\", \"C:\\Users\\Public\\Desktop\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Mail\\services.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\", \"C:\\reviewsessionDhcp\\wininit.exe\", \"C:\\reviewsessionDhcp\\dllhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\taskhostw.exe\", \"C:\\Users\\Public\\Desktop\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Mail\\services.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\lsass.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\RuntimeBroker.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\", \"C:\\reviewsessionDhcp\\wininit.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\", \"C:\\reviewsessionDhcp\\WmiPrvSE.exe\", \"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\", \"C:\\reviewsessionDhcp\\SppExtComObj.exe\", \"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\reviewsessionDhcp\\conhost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\", \"C:\\reviewsessionDhcp\\wininit.exe\", \"C:\\reviewsessionDhcp\\dllhost.exe\", \"C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\taskhostw.exe\"" Comfont.exe - Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1384 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1780 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2848 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1156 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1716 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2156 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2232 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2028 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2296 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4132 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2804 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3184 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2728 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 664 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4480 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1484 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4012 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1072 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4432 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 448 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3512 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3360 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3404 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1500 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1012 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2544 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2440 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4404 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3176 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 1712 schtasks.exe 91 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2900 1712 schtasks.exe 91 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Comfont.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Comfont.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Comfont.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe - Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
resource yara_rule behavioral2/files/0x00070000000234e5-10.dat dcrat behavioral2/memory/2856-13-0x0000000000E60000-0x000000000112C000-memory.dmp dcrat - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation Comfont.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation conhost.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation gradlew.exe Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation WScript.exe - Executes dropped EXE 2 IoCs
pid Process 2856 Comfont.exe 2232 conhost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 34 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\All Users\\SoftwareDistribution\\TextInputHost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\L2Schemas\\TrustedInstaller.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\reviewsessionDhcp\\wininit.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\taskhostw.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\RuntimeBroker.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\reviewsessionDhcp\\StartMenuExperienceHost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\reviewsessionDhcp\\WmiPrvSE.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\reviewsessionDhcp\\dllhost.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Mail\\services.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\reviewsessionDhcp\\wininit.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Mozilla Firefox\\gmp-clearkey\\0.1\\taskhostw.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Public\\Desktop\\fontdrvhost.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\reviewsessionDhcp\\SppExtComObj.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\reviewsessionDhcp\\SppExtComObj.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\OfficeClickToRun.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\reviewsessionDhcp\\conhost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\lsass.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\RuntimeBroker.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\reviewsessionDhcp\\WmiPrvSE.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\Music\\sihost.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\reviewsessionDhcp\\dllhost.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\lsass.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Java\\jre-1.8\\lib\\unsecapp.exe\"" Comfont.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Public\\Desktop\\fontdrvhost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\Music\\sihost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\reviewsessionDhcp\\conhost.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Google\\Update\\Install\\{B0092916-300D-42A1-8132-6122DFFE037F}\\csrss.exe\"" Comfont.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Mail\\services.exe\"" Comfont.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Comfont.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Comfont.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA conhost.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\lib\unsecapp.exe Comfont.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\ea9f0e6c9e2dcd Comfont.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe Comfont.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\9e8d7a4ca61bd9 Comfont.exe File created C:\Program Files\Java\jre-1.8\lib\29c1c3cc0f7685 Comfont.exe File created C:\Program Files (x86)\Google\Update\Install\{B0092916-300D-42A1-8132-6122DFFE037F}\csrss.exe Comfont.exe File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\taskhostw.exe Comfont.exe File created C:\Program Files\Windows Mail\services.exe Comfont.exe File created C:\Program Files\Windows Mail\c5b4cb5e9653cc Comfont.exe File created C:\Program Files (x86)\Windows Defender\it-IT\lsass.exe Comfont.exe File created C:\Program Files\Windows Sidebar\Gadgets\OfficeClickToRun.exe Comfont.exe File created C:\Program Files (x86)\Google\Update\Install\{B0092916-300D-42A1-8132-6122DFFE037F}\886983d96e3d3e Comfont.exe File created C:\Program Files\Windows Sidebar\Gadgets\e6c9b481da804f Comfont.exe File created C:\Program Files (x86)\Windows Defender\it-IT\6203df4a6bafc7 Comfont.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\L2Schemas\TrustedInstaller.exe Comfont.exe File created C:\Windows\L2Schemas\04c1e7795967e4 Comfont.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gradlew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133662202609960512" chrome.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings gradlew.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings Comfont.exe Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings conhost.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 1496 reg.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2232 schtasks.exe 4480 schtasks.exe 2544 schtasks.exe 1480 schtasks.exe 2028 schtasks.exe 2468 schtasks.exe 2284 schtasks.exe 3856 schtasks.exe 1592 schtasks.exe 4380 schtasks.exe 948 schtasks.exe 1012 schtasks.exe 1200 schtasks.exe 2440 schtasks.exe 2152 schtasks.exe 2108 schtasks.exe 4012 schtasks.exe 3404 schtasks.exe 3184 schtasks.exe 1196 schtasks.exe 4404 schtasks.exe 1484 schtasks.exe 3360 schtasks.exe 1500 schtasks.exe 3288 schtasks.exe 2900 schtasks.exe 1384 schtasks.exe 1780 schtasks.exe 2848 schtasks.exe 1156 schtasks.exe 4432 schtasks.exe 2864 schtasks.exe 1532 schtasks.exe 2296 schtasks.exe 2040 schtasks.exe 1936 schtasks.exe 448 schtasks.exe 3512 schtasks.exe 1212 schtasks.exe 2044 schtasks.exe 2156 schtasks.exe 2804 schtasks.exe 2728 schtasks.exe 664 schtasks.exe 1716 schtasks.exe 4132 schtasks.exe 2396 schtasks.exe 1824 schtasks.exe 3176 schtasks.exe 1072 schtasks.exe 856 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2856 Comfont.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe 2232 conhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2232 conhost.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 2856 Comfont.exe Token: SeDebugPrivilege 2232 conhost.exe Token: SeBackupPrivilege 3404 vssvc.exe Token: SeRestorePrivilege 3404 vssvc.exe Token: SeAuditPrivilege 3404 vssvc.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe Token: SeShutdownPrivilege 1124 chrome.exe Token: SeCreatePagefilePrivilege 1124 chrome.exe - Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe 1124 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 856 3868 gradlew.exe 86 PID 3868 wrote to memory of 856 3868 gradlew.exe 86 PID 3868 wrote to memory of 856 3868 gradlew.exe 86 PID 856 wrote to memory of 2492 856 WScript.exe 94 PID 856 wrote to memory of 2492 856 WScript.exe 94 PID 856 wrote to memory of 2492 856 WScript.exe 94 PID 2492 wrote to memory of 2856 2492 cmd.exe 96 PID 2492 wrote to memory of 2856 2492 cmd.exe 96 PID 2856 wrote to memory of 1664 2856 Comfont.exe 150 PID 2856 wrote to memory of 1664 2856 Comfont.exe 150 PID 2492 wrote to memory of 1496 2492 cmd.exe 152 PID 2492 wrote to memory of 1496 2492 cmd.exe 152 PID 2492 wrote to memory of 1496 2492 cmd.exe 152 PID 1664 wrote to memory of 752 1664 cmd.exe 153 PID 1664 wrote to memory of 752 1664 cmd.exe 153 PID 1664 wrote to memory of 2232 1664 cmd.exe 155 PID 1664 wrote to memory of 2232 1664 cmd.exe 155 PID 2232 wrote to memory of 4472 2232 conhost.exe 156 PID 2232 wrote to memory of 4472 2232 conhost.exe 156 PID 2232 wrote to memory of 4480 2232 conhost.exe 157 PID 2232 wrote to memory of 4480 2232 conhost.exe 157 PID 1124 wrote to memory of 2752 1124 chrome.exe 177 PID 1124 wrote to memory of 2752 1124 chrome.exe 177 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4380 1124 chrome.exe 178 PID 1124 wrote to memory of 4464 1124 chrome.exe 179 PID 1124 wrote to memory of 4464 1124 chrome.exe 179 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 PID 1124 wrote to memory of 2496 1124 chrome.exe 180 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Comfont.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Comfont.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Comfont.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\gradlew.exe"C:\Users\Admin\AppData\Local\Temp\gradlew.exe"1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\reviewsessionDhcp\0xRPN8KD8QUblsv.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\reviewsessionDhcp\p9Za2QKx82X3RV5n3OcR.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\reviewsessionDhcp\Comfont.exe"C:\reviewsessionDhcp\Comfont.exe"4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2856 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lCOvIx39g6.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:752
-
-
C:\reviewsessionDhcp\conhost.exe"C:\reviewsessionDhcp\conhost.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2232 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cab7a2c-e412-4366-8ba6-7d031df14c6c.vbs"7⤵PID:4472
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\149fd995-1303-4776-8c70-def539c54faa.vbs"7⤵PID:4480
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1496
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\reviewsessionDhcp\StartMenuExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\reviewsessionDhcp\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\reviewsessionDhcp\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\reviewsessionDhcp\WmiPrvSE.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\reviewsessionDhcp\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\reviewsessionDhcp\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Windows\L2Schemas\TrustedInstaller.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Windows\L2Schemas\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SoftwareDistribution\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\SoftwareDistribution\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\reviewsessionDhcp\SppExtComObj.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\reviewsessionDhcp\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\reviewsessionDhcp\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\lib\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre-1.8\lib\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Music\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\reviewsessionDhcp\conhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\reviewsessionDhcp\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\reviewsessionDhcp\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\Install\{B0092916-300D-42A1-8132-6122DFFE037F}\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Install\{B0092916-300D-42A1-8132-6122DFFE037F}\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Update\Install\{B0092916-300D-42A1-8132-6122DFFE037F}\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\reviewsessionDhcp\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\reviewsessionDhcp\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\reviewsessionDhcp\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\reviewsessionDhcp\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\reviewsessionDhcp\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\reviewsessionDhcp\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Desktop\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Desktop\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Desktop\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4264
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2a1ecc40,0x7ffb2a1ecc4c,0x7ffb2a1ecc582⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2060,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:4380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1980,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2152 /prefetch:32⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2352 /prefetch:82⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3188,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3092 /prefetch:12⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3324,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3912,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4576 /prefetch:12⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4864,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4872 /prefetch:82⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4904,i,15411412330608661994,8815716176757359663,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4896 /prefetch:82⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:1352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4244
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 8f2f2eb4f6a678d2fa70dbef54662bc492821b5a21fa21f7fe87566b5f4d40d7
- MD5 632a5747695bab5666ec3af9901f239b
- SHA1 f1396e36824d59f01c2ffefd6a2230e369414ba5
- SHA512 7cd543cfc65181400402e3819bda11bc9678bec7511c9f7e8a0f1f01bdddfd03947d5cb6b159273817b783d9153f7a91edebe6fb6db0f0cdb73b4e10b5f82a4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 1KB
- SHA256 fee03cd852cf6a2bfb555f04263e1b30e19dbbcc5fc8c0b894a564fe0ed25e00
- MD5 937c741af8a3c5e8454d04d1eafda1ba
- SHA1 d1705d6c6b450055977075d3d6c07a50d4b77a14
- SHA512 2d742c792f23af87956c4368baa218c279d276a97418178310d9f33e9a18e5e762d59bbd71e4e960523b84b2c5eafe96ca28ff581fa9189cef67c57e8af2f77d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 356B
- SHA256 9868040de19b10fad81c0ce5a6c8bb47af32838f46b4f18671a2f07037bb6383
- MD5 e644199062c57ac9b427614074f042b3
- SHA1 894b717c485041b53ba7dc2cc44831d5ca62f290
- SHA512 178fbef41a310dea4e4c44450bffa8046f85fd9c59baac3e8305a17aed07ef57caf8e42e0256a718a19ebcf46f9b648e74c7fb27f2be73d97de82eef467346a6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 2fadb45e424c0532d20fb1b631f4f466bb73f412a374a06eef4407ed7beb7971
- MD5 b63b65be26cea217a02824e797673b31
- SHA1 42fd1d8a5088b41a4ac7d08db0f55984d4960617
- SHA512 bcd19a56fba79a887fa490fa1029c5aac0504a39d509225fdf004bc9ed3623d3571f9e462c2c3d93eb8edce43223cab84aa956491d8a045b455fcef7cda2d639
- SSDEEP 192:RxLDfVRejadHV+FRPLn296jkwRbFWmNPD6yIsnVdg4:RxLDyaNGRz24jxbFWmw4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 9KB
- SHA256 0d5bc759f2ee1b6498734f6eae941ae029cf08116e3760dd2f78a331f68fffcf
- MD5 f3229d72812c53849ae1a46f9dbad3c6
- SHA1 247c13be3e794266c70216f6c1fe7c9670bb48af
- SHA512 68ac142691cfc9b209867e3b9af410ab78c3fc044e1b6b6d667e176d26c4c6ed2b146e9962cad772dba148bb8267b4ca1a690952828396e9c959e0edfa4e668b
- SSDEEP 192:RxLDfVrejadHV+FRPLn296jkwRbFWmNPD6yIsnVdg4:RxLD0aNGRz24jxbFWmw4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e6982fc4-a2cc-4768-94d7-2484ea60d718.tmp
- Size 15KB
- SHA256 d926479ce421aec48500da6730b9df53f87fbc1eb2bd55bee3aa6a366f59a472
- MD5 4da5e3d0927608f0a937765689523a8a
- SHA1 31f558e07044bafccf39c23ebd157bb9641e370f
- SHA512 0369881958393b06e1e169e27eeebdb3a61776ccc5867b1311472fff96722763d27804c01e6d8f9734ec71ebcaa4afaf4ea14f610ba6b740b694bca166b8dfb2
- SSDEEP 384:7u7WW57pLhLcsBTu7fX/E1kXqKf/pUZNCgVLH2HfPzu7XrU1KHGf8zQI:7u7d57pLhL9hu7P/E1kXqKf/pUZNCgVD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 185KB
- SHA256 d1f0de9d67c3b5f3d9875d700fb6510af16505b53df296bf2a86937ccd0ae92c
- MD5 79ca9e807f92c50c6a3bd8d1b0155530
- SHA1 6f52d829c6ea07f5b8104075bed7a930717b33f3
- SHA512 7abe8154b4b62ed3ae95c170a5bf00dbc2ec954ab35d649060d3683f5a4816a86ed021222dbe820f6665d5db1d8ac1c7748ae08fe9f894b42d8813a6b0b49714
- SSDEEP 3072:IBZzy2a/M29Byx1MQ0KKRgXSCP8SrAwfXbR/Wq8i/cXUWzgM4ANtZHKoQC/Z:I/Oxfyx2PglkdwfbpWHikE/KjqJCR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 185KB
- SHA256 27c3e1d21879081eee16149262b7fdde0838d4c511a20e88ec3edb64aeb06083
- MD5 5455aeb643b4811044b9137ac8d402de
- SHA1 a291e3d6f48102dd0b9e74ffb5a251e10996be67
- SHA512 b11712a6651d1768a7b01126c34a22861ede9cadb4cc5303b2d41bf5fb5047a5971200a9f25783886a4c9cadf58f5b563ebe3b93b4a52201ee0c43dfc493d7ee
- SSDEEP 3072:JBZzy2a/M29Byx1MQ0KKRgXSCP8SrAwfXbR/Wq8i/cXUWzgM4ANtZHKoQC/Z:J/Oxfyx2PglkdwfbpWHikE/KjqJCR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\149fd995-1303-4776-8c70-def539c54faa.vbs
- Size 484B
- SHA256 b2db485b97ea0be8974aa2565af25433823914b41a0a1b4eb3ae82fd5162a303
- MD5 a1fe6d4feb2bd2bbe8e5f5cf0dd83226
- SHA1 d30f9e02ffb8f9806fc357daf1d3c96799ba9de2
- SHA512 694dfd4071e89968467dc69f6eb0f18b936e807e0495edadcd0e92a88cc0583bd2ee09748736bc88a66ea47e8df81c16d19425e5a4e75c3a2aef65226a9a091e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\9cab7a2c-e412-4366-8ba6-7d031df14c6c.vbs
- Size 708B
- SHA256 f96bcc514836dd82084ace3cb18a0be99f73f3c60c2edcf3e256a2dc469eb52d
- MD5 981ca24195d20a141561e8ca357efd48
- SHA1 f658013b4174afb493a9d54f6c38b292e142a00a
- SHA512 432ea1011594dce7afc4afbb958d7b35a62c8856aef46215a5ebb6a1d24d445dbaefa4f3d4514e50ba29158ecbbc24193cb65bf2c1095d393f981efeec928544
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\lCOvIx39g6.bat
- Size 197B
- SHA256 88e680a6671604331349b58caaece14ae27b6ab70d722831b0e761bd501d49ec
- MD5 4b3e165cf6ef2075cfbe98bd2a7cea45
- SHA1 d1644a738177815fa73601c21d6293075165f6c7
- SHA512 80dc6ac9fc58f83bec3c18079ff6b379f109afc8279689f9c42b9a3412b88ee1de6f866798747c84b40b0d6a913967b38c033984db1db7a8d0e07a48d08ba551
- MD5 SHA1 SHA512
- Path C:\reviewsessionDhcp\0xRPN8KD8QUblsv.vbe
- Size 214B
- SHA256 2e30042ec881966603e615db4fa83118b39b452bfe45ad48bad18353f1c81dd8
- MD5 6a24152fcded23d8f5dd4078549c31a3
- SHA1 2a973c865f3bd6cb1f7fe31b6d369f69d6cd6de9
- SHA512 740636b968d0a3f6ffd5eb4c9c1a6d20e7ae41da2e50c00512a28e494e236d9bbc743de945f412858c861d56b2c14ec61843400771b3885944a6581adcfdb4fe
- MD5 SHA1 SHA512
- Path C:\reviewsessionDhcp\Comfont.exe
- Size 2.8MB
- SHA256 0a53faccce89f3a69791697da862b11568debd478981b14fe526ca12822202bc
- MD5 3a33ee7349a6fb39bef079bf65505123
- SHA1 42a9553896cdbfcc6ca639a9ae076a5632cdbc31
- SHA512 b10c9ae2ab03def390440bb441514cd56a3f85fa4b58c4e2e9257579cb1d02e12ecc9d15c9ef791b4f27f8b3a9bec1b57f88d5bca2854b45ab93f9c03a42e1bb
- SSDEEP 49152:W+Fvq5MfG54bL8Mq8cSrn8V/n9rXdyGKWyuY7y6ZSy8+4iTsERuJHDKXy2H:1FSgj8YFrn8RBXsGKZPEy8+4iQEk70
- MD5 SHA1 SHA512 SSDEEP
- Path C:\reviewsessionDhcp\p9Za2QKx82X3RV5n3OcR.bat
- Size 146B
- SHA256 1a2e8412a55161f7a9270e621ebebad0172a2ff026cdf5b2f305fa6eaa7b7eda
- MD5 af5ce85a32783d13bd98affd9f3a37f9
- SHA1 88aa07b0271db6d3caea5cc1b31995491906642d
- SHA512 be5616edde5da2a73cd0e226128421c58a5f46b694c2d69dbeeec98c7bac3c1c5094f7852324a1437b4f43c69a89a6ffadd224088651911d4aa1b26281922b86
- MD5 SHA1 SHA512