dcrat | c401439e32ff3789bc0f18182d58a13b661396fff40a86c3ffc290c151349356

Analysis

max time kernel
1800s
max time network
1804s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gradlew.exe
Size 3.1MB
Sample240723-sdt3zayfmd
SHA256 c401439e32ff3789bc0f18182d58a13b661396fff40a86c3ffc290c151349356
MD5 10484b2845bc5be1e77a4ca03b81996f
SHA1 101a51ec35335cc2eaaa6315309924d5765ce6a5
SHA512 35974b655d22f4b498f5b306d741ae97be1bb7a3973eee83961b705d5f027b6e2587f37e41ca3d6f4ebb2560553a848f3ace53899c429a81235d29bfab630957
SSDEEP 98304:ub0FSgj8YFrn8RBXsGKZPEy8+4iQEk70j:uenj8YFrn8MPdj5SEkAj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat credential_access discovery evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat 59 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		588	schtasks.exe
		3044	schtasks.exe
		2960	schtasks.exe
		1748	schtasks.exe
		544	schtasks.exe
		3068	schtasks.exe
		1248	schtasks.exe
		2724	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		gradlew.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\bef1add2734030		Comfont.exe
		1092	schtasks.exe
		1096	schtasks.exe
		2916	schtasks.exe
		1292	schtasks.exe
		2292	schtasks.exe
		1860	schtasks.exe
		1372	schtasks.exe
		1976	schtasks.exe
		2260	schtasks.exe
		1940	schtasks.exe
		1364	schtasks.exe
		1804	schtasks.exe
		2684	schtasks.exe
		2748	schtasks.exe
		2068	schtasks.exe
		2284	schtasks.exe
		2764	schtasks.exe
		2084	schtasks.exe
		664	schtasks.exe
		2180	schtasks.exe
		2956	schtasks.exe
		1484	schtasks.exe
		608	schtasks.exe
		2240	schtasks.exe
		2756	schtasks.exe
		2364	schtasks.exe
		2544	schtasks.exe
		768	schtasks.exe
		1948	schtasks.exe
		2876	schtasks.exe
		1708	schtasks.exe
		2188	schtasks.exe
		2884	schtasks.exe
		1864	schtasks.exe
		2732	schtasks.exe
		1760	schtasks.exe
		1400	schtasks.exe
		1984	schtasks.exe
		2248	schtasks.exe
		1636	schtasks.exe
		2264	schtasks.exe
		1848	schtasks.exe
		1084	schtasks.exe
		2968	schtasks.exe
		1152	schtasks.exe
		1060	schtasks.exe
		2304	schtasks.exe
		836	schtasks.exe
		2568	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 19 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\", \"C:\\Windows\\security\\audit\\Comfont.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\", \"C:\\Windows\\SchCache\\OSPPSVC.exe\", \"C:\\reviewsessionDhcp\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\", \"C:\\Windows\\security\\audit\\Comfont.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\", \"C:\\Windows\\security\\audit\\Comfont.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\", \"C:\\Windows\\security\\audit\\Comfont.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\", \"C:\\Windows\\SchCache\\OSPPSVC.exe\", \"C:\\reviewsessionDhcp\\smss.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\", \"C:\\Windows\\security\\audit\\Comfont.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\", \"C:\\Windows\\SchCache\\OSPPSVC.exe\", \"C:\\reviewsessionDhcp\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\en-US\\csrss.exe\", \"C:\\Users\\Default\\dllhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\", \"C:\\Windows\\security\\audit\\Comfont.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\", \"C:\\Windows\\SchCache\\OSPPSVC.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\", \"C:\\Windows\\security\\audit\\Comfont.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\", \"C:\\Windows\\SchCache\\OSPPSVC.exe\", \"C:\\reviewsessionDhcp\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\en-US\\csrss.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\", \"C:\\reviewsessionDhcp\\cmd.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\", \"C:\\reviewsessionDhcp\\winlogon.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\", \"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\", \"C:\\MSOCache\\All Users\\conhost.exe\""	Comfont.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2960	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	1056	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	1056	schtasks.exe	35

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Comfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Comfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Comfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

DCRat payload 32 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0006000000018b3e-9.dat	dcrat
behavioral1/memory/2664-13-0x00000000008E0000-0x0000000000BAC000-memory.dmp	dcrat
behavioral1/memory/1684-77-0x0000000000DA0000-0x000000000106C000-memory.dmp	dcrat
behavioral1/memory/1860-119-0x0000000000030000-0x00000000002FC000-memory.dmp	dcrat
behavioral1/memory/1584-120-0x00000000010E0000-0x00000000013AC000-memory.dmp	dcrat
behavioral1/memory/1980-122-0x0000000001210000-0x00000000014DC000-memory.dmp	dcrat
behavioral1/memory/1176-125-0x0000000000B40000-0x0000000000E0C000-memory.dmp	dcrat
behavioral1/memory/1972-130-0x0000000001080000-0x000000000134C000-memory.dmp	dcrat
behavioral1/memory/1912-131-0x0000000001150000-0x000000000141C000-memory.dmp	dcrat
behavioral1/memory/2492-136-0x00000000000A0000-0x000000000036C000-memory.dmp	dcrat
behavioral1/memory/1968-137-0x0000000000280000-0x000000000054C000-memory.dmp	dcrat
behavioral1/memory/2100-144-0x00000000010D0000-0x000000000139C000-memory.dmp	dcrat
behavioral1/memory/1560-146-0x00000000009B0000-0x0000000000C7C000-memory.dmp	dcrat
behavioral1/memory/1536-147-0x0000000000F10000-0x00000000011DC000-memory.dmp	dcrat
behavioral1/memory/184-152-0x0000000000260000-0x000000000052C000-memory.dmp	dcrat
behavioral1/memory/1980-154-0x0000000000F70000-0x000000000123C000-memory.dmp	dcrat
behavioral1/memory/3032-156-0x0000000001170000-0x000000000143C000-memory.dmp	dcrat
behavioral1/memory/2520-161-0x0000000001270000-0x000000000153C000-memory.dmp	dcrat
behavioral1/memory/1628-163-0x00000000001D0000-0x000000000049C000-memory.dmp	dcrat
behavioral1/memory/2152-167-0x0000000000220000-0x00000000004EC000-memory.dmp	dcrat
behavioral1/memory/2064-168-0x00000000008F0000-0x0000000000BBC000-memory.dmp	dcrat
behavioral1/memory/3044-174-0x0000000000160000-0x000000000042C000-memory.dmp	dcrat
behavioral1/memory/2368-175-0x00000000003B0000-0x000000000067C000-memory.dmp	dcrat
behavioral1/memory/2788-181-0x0000000000CE0000-0x0000000000FAC000-memory.dmp	dcrat
behavioral1/memory/896-182-0x0000000000390000-0x000000000065C000-memory.dmp	dcrat
behavioral1/memory/2336-184-0x00000000002C0000-0x000000000058C000-memory.dmp	dcrat
behavioral1/memory/1524-187-0x0000000000B00000-0x0000000000DCC000-memory.dmp	dcrat
behavioral1/memory/1580-191-0x0000000000E50000-0x000000000111C000-memory.dmp	dcrat
behavioral1/memory/1924-192-0x0000000000310000-0x00000000005DC000-memory.dmp	dcrat
behavioral1/memory/1248-194-0x0000000000050000-0x000000000031C000-memory.dmp	dcrat
behavioral1/memory/2144-195-0x00000000000C0000-0x000000000038C000-memory.dmp	dcrat
behavioral1/memory/2260-196-0x0000000000FA0000-0x000000000126C000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 51 IoCs

pid	Process
2664	Comfont.exe
1684	conhost.exe
1584	smss.exe
1860	dllhost.exe
1980	Comfont.exe
1176	cmd.exe
1912	explorer.exe
1972	csrss.exe
2492	lsm.exe
1968	System.exe
916	smss.exe
1140	Comfont.exe
1536	dllhost.exe
2100	taskhost.exe
1560	audiodg.exe
2116	conhost.exe
184	winlogon.exe
1980	OSPPSVC.exe
3032	cmd.exe
2948	csrss.exe
1672	explorer.exe
2520	dllhost.exe
2760	Comfont.exe
1628	smss.exe
2064	System.exe
2152	lsm.exe
2808	cmd.exe
1560	dllhost.exe
1852	taskhost.exe
1600	Comfont.exe
2368	smss.exe
3044	audiodg.exe
2516	csrss.exe
3048	explorer.exe
1316	conhost.exe
896	OSPPSVC.exe
2788	winlogon.exe
2336	cmd.exe
1524	smss.exe
2700	dllhost.exe
544	Comfont.exe
1924	System.exe
1580	lsm.exe
1248	csrss.exe
2144	explorer.exe
272	smss.exe
2848	taskhost.exe
2260	audiodg.exe
1532	dllhost.exe
2424	cmd.exe
2888	Comfont.exe

Loads dropped DLL 2 IoCs

pid	Process
2784	cmd.exe
2784	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default User\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Windows\\SoftwareDistribution\\Download\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\SchCache\\OSPPSVC.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\reviewsessionDhcp\\cmd.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\reviewsessionDhcp\\smss.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comfont = "\"C:\\Windows\\security\\audit\\Comfont.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Comfont = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default User\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\reviewsessionDhcp\\cmd.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\audiodg.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\reviewsessionDhcp\\winlogon.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\lsm.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default\\dllhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\System.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\reviewsessionDhcp\\smss.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Defender\\en-US\\csrss.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Defender\\en-US\\csrss.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default\\dllhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\taskhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Comfont = "\"C:\\Windows\\security\\audit\\Comfont.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\dllhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\conhost.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\SchCache\\OSPPSVC.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comfont = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\Comfont.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\winlogon.exe\""	Comfont.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\reviewsessionDhcp\\winlogon.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\ba13f242-3a65-11ef-94cb-d685e2345d05\\explorer.exe\""	Comfont.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\MSOCache\\All Users\\conhost.exe\""	Comfont.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Comfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Comfont.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Comfont.exe	Comfont.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Comfont.exe	Comfont.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\bef1add2734030	Comfont.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe	Comfont.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\088424020bedd6	Comfont.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\csrss.exe	Comfont.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\886983d96e3d3e	Comfont.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\lsm.exe	Comfont.exe
File created	C:\Windows\SoftwareDistribution\Download\101b941d020240	Comfont.exe
File created	C:\Windows\security\audit\Comfont.exe	Comfont.exe
File created	C:\Windows\security\audit\bef1add2734030	Comfont.exe
File created	C:\Windows\SchCache\OSPPSVC.exe	Comfont.exe
File created	C:\Windows\SchCache\1610b97d3ab4a7	Comfont.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gradlew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1720	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2968	schtasks.exe
2248	schtasks.exe
2260	schtasks.exe
1864	schtasks.exe
1848	schtasks.exe
768	schtasks.exe
2068	schtasks.exe
2764	schtasks.exe
836	schtasks.exe
2684	schtasks.exe
2364	schtasks.exe
1860	schtasks.exe
1152	schtasks.exe
1060	schtasks.exe
2292	schtasks.exe
2748	schtasks.exe
664	schtasks.exe
2240	schtasks.exe
3044	schtasks.exe
1092	schtasks.exe
2960	schtasks.exe
2756	schtasks.exe
1372	schtasks.exe
2916	schtasks.exe
1804	schtasks.exe
1096	schtasks.exe
2284	schtasks.exe
2732	schtasks.exe
544	schtasks.exe
2188	schtasks.exe
2956	schtasks.exe
2304	schtasks.exe
2264	schtasks.exe
2876	schtasks.exe
1248	schtasks.exe
588	schtasks.exe
1292	schtasks.exe
1976	schtasks.exe
2544	schtasks.exe
1748	schtasks.exe
2180	schtasks.exe
2724	schtasks.exe
1940	schtasks.exe
1400	schtasks.exe
1484	schtasks.exe
1760	schtasks.exe
2084	schtasks.exe
2884	schtasks.exe
1984	schtasks.exe
1708	schtasks.exe
3068	schtasks.exe
2568	schtasks.exe
1364	schtasks.exe
1084	schtasks.exe
1948	schtasks.exe
608	schtasks.exe
1636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
2664	Comfont.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe
1684	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1684	conhost.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	Comfont.exe
Token: SeDebugPrivilege	1684	conhost.exe
Token: SeBackupPrivilege	1316	vssvc.exe
Token: SeRestorePrivilege	1316	vssvc.exe
Token: SeAuditPrivilege	1316	vssvc.exe
Token: SeDebugPrivilege	1860	dllhost.exe
Token: SeDebugPrivilege	1584	smss.exe
Token: SeDebugPrivilege	1980	Comfont.exe
Token: SeDebugPrivilege	1176	cmd.exe
Token: SeDebugPrivilege	1972	csrss.exe
Token: SeDebugPrivilege	1912	explorer.exe
Token: SeDebugPrivilege	1968	System.exe
Token: SeDebugPrivilege	2492	lsm.exe
Token: SeDebugPrivilege	2100	taskhost.exe
Token: SeDebugPrivilege	1140	Comfont.exe
Token: SeDebugPrivilege	1560	audiodg.exe
Token: SeDebugPrivilege	916	smss.exe
Token: SeDebugPrivilege	1536	dllhost.exe
Token: SeDebugPrivilege	1980	OSPPSVC.exe
Token: SeDebugPrivilege	184	winlogon.exe
Token: SeDebugPrivilege	2116	conhost.exe
Token: SeDebugPrivilege	3032	cmd.exe
Token: SeDebugPrivilege	2948	csrss.exe
Token: SeDebugPrivilege	1672	explorer.exe
Token: SeDebugPrivilege	2520	dllhost.exe
Token: SeDebugPrivilege	1628	smss.exe
Token: SeDebugPrivilege	2760	Comfont.exe
Token: SeDebugPrivilege	2808	cmd.exe
Token: SeDebugPrivilege	2152	lsm.exe
Token: SeDebugPrivilege	2064	System.exe
Token: SeDebugPrivilege	1600	Comfont.exe
Token: SeDebugPrivilege	1560	dllhost.exe
Token: SeDebugPrivilege	1852	taskhost.exe
Token: SeDebugPrivilege	2368	smss.exe
Token: SeDebugPrivilege	3044	audiodg.exe
Token: SeDebugPrivilege	3048	explorer.exe
Token: SeDebugPrivilege	2516	csrss.exe
Token: SeDebugPrivilege	896	OSPPSVC.exe
Token: SeDebugPrivilege	2788	winlogon.exe
Token: SeDebugPrivilege	1316	conhost.exe
Token: SeDebugPrivilege	2336	cmd.exe
Token: SeDebugPrivilege	1524	smss.exe
Token: SeDebugPrivilege	544	Comfont.exe
Token: SeDebugPrivilege	2700	dllhost.exe
Token: SeDebugPrivilege	1924	System.exe
Token: SeDebugPrivilege	1580	lsm.exe
Token: SeDebugPrivilege	2144	explorer.exe
Token: SeDebugPrivilege	1248	csrss.exe
Token: SeDebugPrivilege	1532	dllhost.exe
Token: SeDebugPrivilege	2848	taskhost.exe
Token: SeDebugPrivilege	2888	Comfont.exe
Token: SeDebugPrivilege	2260	audiodg.exe
Token: SeDebugPrivilege	2424	cmd.exe
Token: SeDebugPrivilege	272	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2816	2288	gradlew.exe	31
PID 2288 wrote to memory of 2816	2288	gradlew.exe	31
PID 2288 wrote to memory of 2816	2288	gradlew.exe	31
PID 2288 wrote to memory of 2816	2288	gradlew.exe	31
PID 2816 wrote to memory of 2784	2816	WScript.exe	32
PID 2816 wrote to memory of 2784	2816	WScript.exe	32
PID 2816 wrote to memory of 2784	2816	WScript.exe	32
PID 2816 wrote to memory of 2784	2816	WScript.exe	32
PID 2784 wrote to memory of 2664	2784	cmd.exe	34
PID 2784 wrote to memory of 2664	2784	cmd.exe	34
PID 2784 wrote to memory of 2664	2784	cmd.exe	34
PID 2784 wrote to memory of 2664	2784	cmd.exe	34
PID 2664 wrote to memory of 1684	2664	Comfont.exe	93
PID 2664 wrote to memory of 1684	2664	Comfont.exe	93
PID 2664 wrote to memory of 1684	2664	Comfont.exe	93
PID 2784 wrote to memory of 1720	2784	cmd.exe	94
PID 2784 wrote to memory of 1720	2784	cmd.exe	94
PID 2784 wrote to memory of 1720	2784	cmd.exe	94
PID 2784 wrote to memory of 1720	2784	cmd.exe	94
PID 1684 wrote to memory of 2120	1684	conhost.exe	95
PID 1684 wrote to memory of 2120	1684	conhost.exe	95
PID 1684 wrote to memory of 2120	1684	conhost.exe	95
PID 1684 wrote to memory of 556	1684	conhost.exe	96
PID 1684 wrote to memory of 556	1684	conhost.exe	96
PID 1684 wrote to memory of 556	1684	conhost.exe	96
PID 1680 wrote to memory of 1584	1680	taskeng.exe	103
PID 1680 wrote to memory of 1584	1680	taskeng.exe	103
PID 1680 wrote to memory of 1584	1680	taskeng.exe	103
PID 1680 wrote to memory of 1860	1680	taskeng.exe	102
PID 1680 wrote to memory of 1860	1680	taskeng.exe	102
PID 1680 wrote to memory of 1860	1680	taskeng.exe	102
PID 1680 wrote to memory of 1980	1680	taskeng.exe	104
PID 1680 wrote to memory of 1980	1680	taskeng.exe	104
PID 1680 wrote to memory of 1980	1680	taskeng.exe	104
PID 1680 wrote to memory of 1176	1680	taskeng.exe	105
PID 1680 wrote to memory of 1176	1680	taskeng.exe	105
PID 1680 wrote to memory of 1176	1680	taskeng.exe	105
PID 1680 wrote to memory of 1972	1680	taskeng.exe	106
PID 1680 wrote to memory of 1972	1680	taskeng.exe	106
PID 1680 wrote to memory of 1972	1680	taskeng.exe	106
PID 1680 wrote to memory of 1912	1680	taskeng.exe	107
PID 1680 wrote to memory of 1912	1680	taskeng.exe	107
PID 1680 wrote to memory of 1912	1680	taskeng.exe	107
PID 1680 wrote to memory of 1968	1680	taskeng.exe	108
PID 1680 wrote to memory of 1968	1680	taskeng.exe	108
PID 1680 wrote to memory of 1968	1680	taskeng.exe	108
PID 1680 wrote to memory of 2492	1680	taskeng.exe	109
PID 1680 wrote to memory of 2492	1680	taskeng.exe	109
PID 1680 wrote to memory of 2492	1680	taskeng.exe	109
PID 1680 wrote to memory of 916	1680	taskeng.exe	111
PID 1680 wrote to memory of 916	1680	taskeng.exe	111
PID 1680 wrote to memory of 916	1680	taskeng.exe	111
PID 1680 wrote to memory of 1536	1680	taskeng.exe	110
PID 1680 wrote to memory of 1536	1680	taskeng.exe	110
PID 1680 wrote to memory of 1536	1680	taskeng.exe	110
PID 1680 wrote to memory of 1140	1680	taskeng.exe	112
PID 1680 wrote to memory of 1140	1680	taskeng.exe	112
PID 1680 wrote to memory of 1140	1680	taskeng.exe	112
PID 1680 wrote to memory of 2100	1680	taskeng.exe	113
PID 1680 wrote to memory of 2100	1680	taskeng.exe	113
PID 1680 wrote to memory of 2100	1680	taskeng.exe	113
PID 1680 wrote to memory of 1560	1680	taskeng.exe	114
PID 1680 wrote to memory of 1560	1680	taskeng.exe	114
PID 1680 wrote to memory of 1560	1680	taskeng.exe	114

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Comfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Comfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Comfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\gradlew.exe
"C:\Users\Admin\AppData\Local\Temp\gradlew.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\reviewsessionDhcp\0xRPN8KD8QUblsv.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\reviewsessionDhcp\p9Za2QKx82X3RV5n3OcR.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\reviewsessionDhcp\Comfont.exe
      "C:\reviewsessionDhcp\Comfont.exe"
      4⤵
      DcRat
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2664
    - - C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe
        
        "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1684
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbd4a09a-1180-4009-940e-4655c65dcc9c.vbs"
        6⤵
        
        PID:2120
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f95e8eca-3071-4a14-a6fa-cb11b6cdc762.vbs"
        6⤵
        
        PID:556
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComfontC" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Comfont.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Comfont" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Comfont.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComfontC" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Comfont.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\reviewsessionDhcp\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\reviewsessionDhcp\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\reviewsessionDhcp\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\reviewsessionDhcp\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\reviewsessionDhcp\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\reviewsessionDhcp\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\SoftwareDistribution\Download\lsm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\SoftwareDistribution\Download\lsm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComfontC" /sc MINUTE /mo 13 /tr "'C:\Windows\security\audit\Comfont.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Comfont" /sc ONLOGON /tr "'C:\Windows\security\audit\Comfont.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComfontC" /sc MINUTE /mo 5 /tr "'C:\Windows\security\audit\Comfont.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Windows\SchCache\OSPPSVC.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\SchCache\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Windows\SchCache\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\reviewsessionDhcp\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\reviewsessionDhcp\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\reviewsessionDhcp\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\en-US\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Default\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3028

C:\Windows\system32\taskeng.exe
taskeng.exe {ACFA5AAB-D9AA-4C50-AD4F-C132EADAC246} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Default\dllhost.exe
  C:\Users\Default\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1860
- C:\reviewsessionDhcp\smss.exe
  C:\reviewsessionDhcp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\security\audit\Comfont.exe
  C:\Windows\security\audit\Comfont.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\reviewsessionDhcp\cmd.exe
  C:\reviewsessionDhcp\cmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Program Files (x86)\Windows Defender\en-US\csrss.exe
  "C:\Program Files (x86)\Windows Defender\en-US\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1912
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\SoftwareDistribution\Download\lsm.exe
  C:\Windows\SoftwareDistribution\Download\lsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Users\Default\dllhost.exe
  C:\Users\Default\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\reviewsessionDhcp\smss.exe
  C:\reviewsessionDhcp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:916
- C:\Windows\security\audit\Comfont.exe
  C:\Windows\security\audit\Comfont.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe
  "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\SchCache\OSPPSVC.exe
  C:\Windows\SchCache\OSPPSVC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- C:\reviewsessionDhcp\winlogon.exe
  C:\reviewsessionDhcp\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:184
- C:\reviewsessionDhcp\cmd.exe
  C:\reviewsessionDhcp\cmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Program Files (x86)\Windows Defender\en-US\csrss.exe
  "C:\Program Files (x86)\Windows Defender\en-US\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Users\Default\dllhost.exe
  C:\Users\Default\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2520
- C:\reviewsessionDhcp\smss.exe
  C:\reviewsessionDhcp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\security\audit\Comfont.exe
  C:\Windows\security\audit\Comfont.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\SoftwareDistribution\Download\lsm.exe
  C:\Windows\SoftwareDistribution\Download\lsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\reviewsessionDhcp\cmd.exe
  C:\reviewsessionDhcp\cmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Users\Default\dllhost.exe
  C:\Users\Default\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\reviewsessionDhcp\smss.exe
  C:\reviewsessionDhcp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe
  "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\security\audit\Comfont.exe
  C:\Windows\security\audit\Comfont.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Program Files (x86)\Windows Defender\en-US\csrss.exe
  "C:\Program Files (x86)\Windows Defender\en-US\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\SchCache\OSPPSVC.exe
  C:\Windows\SchCache\OSPPSVC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\reviewsessionDhcp\winlogon.exe
  C:\reviewsessionDhcp\winlogon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\reviewsessionDhcp\cmd.exe
  C:\reviewsessionDhcp\cmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Users\Default\dllhost.exe
  C:\Users\Default\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\reviewsessionDhcp\smss.exe
  C:\reviewsessionDhcp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\security\audit\Comfont.exe
  C:\Windows\security\audit\Comfont.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\SoftwareDistribution\Download\lsm.exe
  C:\Windows\SoftwareDistribution\Download\lsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Program Files (x86)\Windows Defender\en-US\csrss.exe
  "C:\Program Files (x86)\Windows Defender\en-US\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\explorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\reviewsessionDhcp\smss.exe
  C:\reviewsessionDhcp\smss.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:272
- C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe
  "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\taskhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Users\Default\dllhost.exe
  C:\Users\Default\dllhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe
  C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\audiodg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\security\audit\Comfont.exe
  C:\Windows\security\audit\Comfont.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\reviewsessionDhcp\cmd.exe
  C:\reviewsessionDhcp\cmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bbd4a09a-1180-4009-940e-4655c65dcc9c.vbs

Path C:\Users\Admin\AppData\Local\Temp\bbd4a09a-1180-4009-940e-4655c65dcc9c.vbs
Size 760B
SHA256 50ef70b3889ccf514e40388ca7463c80e10616124119d06e0abd635374baf3c1
MD5 4e9e8889c02410e53d76b23ee7e0be76
SHA1 91973fe1a54193b989d3e87410c7538c00233a55
SHA512 44833a2270d6ea4b136c49cb5270c3f5fe7de46c0001ac828a0f457dc5402f7f44b3d0e9fae1b6bf7694620dee122939119d50184cb91786bf8fdc70bc41b714
MD5 SHA1 SHA512

Submit Download

f95e8eca-3071-4a14-a6fa-cb11b6cdc762.vbs

Path C:\Users\Admin\AppData\Local\Temp\f95e8eca-3071-4a14-a6fa-cb11b6cdc762.vbs
Size 536B
SHA256 97425e04232658c6873de7e80342d10ee5fbc9d5838be48f43f4d5e3bb4b9134
MD5 58d45b42970b30ca05764dbffae41c36
SHA1 a0981845475757a1973176adfe51375715297147
SHA512 f3e22085166f379afa50673951785af6fdd7f84d7d402c94f2f20b71052024245eb674658bcd29c6819110be7520214a1f5a84b3920d3e5ced1c35b27367e418
MD5 SHA1 SHA512

Submit Download

0xRPN8KD8QUblsv.vbe

Path C:\reviewsessionDhcp\0xRPN8KD8QUblsv.vbe
Size 214B
SHA256 2e30042ec881966603e615db4fa83118b39b452bfe45ad48bad18353f1c81dd8
MD5 6a24152fcded23d8f5dd4078549c31a3
SHA1 2a973c865f3bd6cb1f7fe31b6d369f69d6cd6de9
SHA512 740636b968d0a3f6ffd5eb4c9c1a6d20e7ae41da2e50c00512a28e494e236d9bbc743de945f412858c861d56b2c14ec61843400771b3885944a6581adcfdb4fe
MD5 SHA1 SHA512

Submit Download

p9Za2QKx82X3RV5n3OcR.bat

Path C:\reviewsessionDhcp\p9Za2QKx82X3RV5n3OcR.bat
Size 146B
SHA256 1a2e8412a55161f7a9270e621ebebad0172a2ff026cdf5b2f305fa6eaa7b7eda
MD5 af5ce85a32783d13bd98affd9f3a37f9
SHA1 88aa07b0271db6d3caea5cc1b31995491906642d
SHA512 be5616edde5da2a73cd0e226128421c58a5f46b694c2d69dbeeec98c7bac3c1c5094f7852324a1437b4f43c69a89a6ffadd224088651911d4aa1b26281922b86
MD5 SHA1 SHA512

Submit Download

Comfont.exe

Path \reviewsessionDhcp\Comfont.exe
Size 2.8MB
SHA256 0a53faccce89f3a69791697da862b11568debd478981b14fe526ca12822202bc
MD5 3a33ee7349a6fb39bef079bf65505123
SHA1 42a9553896cdbfcc6ca639a9ae076a5632cdbc31
SHA512 b10c9ae2ab03def390440bb441514cd56a3f85fa4b58c4e2e9257579cb1d02e12ecc9d15c9ef791b4f27f8b3a9bec1b57f88d5bca2854b45ab93f9c03a42e1bb
SSDEEP 49152:W+Fvq5MfG54bL8Mq8cSrn8V/n9rXdyGKWyuY7y6ZSy8+4iTsERuJHDKXy2H:1FSgj8YFrn8RBXsGKZPEy8+4iQEk70
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/184-152-0x0000000000260000-0x000000000052C000-memory.dmp

Download

memory/896-182-0x0000000000390000-0x000000000065C000-memory.dmp

Download

memory/1176-125-0x0000000000B40000-0x0000000000E0C000-memory.dmp

Download

memory/1248-194-0x0000000000050000-0x000000000031C000-memory.dmp

Download

memory/1524-187-0x0000000000B00000-0x0000000000DCC000-memory.dmp

Download

memory/1536-147-0x0000000000F10000-0x00000000011DC000-memory.dmp

Download

memory/1560-146-0x00000000009B0000-0x0000000000C7C000-memory.dmp

Download

memory/1580-191-0x0000000000E50000-0x000000000111C000-memory.dmp

Download

memory/1584-120-0x00000000010E0000-0x00000000013AC000-memory.dmp

Download

memory/1628-163-0x00000000001D0000-0x000000000049C000-memory.dmp

Download

memory/1684-78-0x0000000000A90000-0x0000000000AE6000-memory.dmp

Download

memory/1684-77-0x0000000000DA0000-0x000000000106C000-memory.dmp

Download

memory/1860-119-0x0000000000030000-0x00000000002FC000-memory.dmp

Download

memory/1912-131-0x0000000001150000-0x000000000141C000-memory.dmp

Download

memory/1924-192-0x0000000000310000-0x00000000005DC000-memory.dmp

Download

memory/1968-137-0x0000000000280000-0x000000000054C000-memory.dmp

Download

memory/1972-130-0x0000000001080000-0x000000000134C000-memory.dmp

Download

memory/1980-122-0x0000000001210000-0x00000000014DC000-memory.dmp

Download

memory/1980-154-0x0000000000F70000-0x000000000123C000-memory.dmp

Download

memory/2064-168-0x00000000008F0000-0x0000000000BBC000-memory.dmp

Download

memory/2100-144-0x00000000010D0000-0x000000000139C000-memory.dmp

Download

memory/2144-195-0x00000000000C0000-0x000000000038C000-memory.dmp

Download

memory/2152-167-0x0000000000220000-0x00000000004EC000-memory.dmp

Download

memory/2260-196-0x0000000000FA0000-0x000000000126C000-memory.dmp

Download

memory/2336-184-0x00000000002C0000-0x000000000058C000-memory.dmp

Download

memory/2368-175-0x00000000003B0000-0x000000000067C000-memory.dmp

Download

memory/2492-136-0x00000000000A0000-0x000000000036C000-memory.dmp

Download

memory/2520-161-0x0000000001270000-0x000000000153C000-memory.dmp

Download

memory/2664-26-0x00000000025A0000-0x00000000025A8000-memory.dmp

Download

memory/2664-19-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Download

memory/2664-32-0x000000001AB50000-0x000000001AB5C000-memory.dmp

Download

memory/2664-25-0x0000000002590000-0x000000000259C000-memory.dmp

Download

memory/2664-24-0x0000000000D90000-0x0000000000D9C000-memory.dmp

Download

memory/2664-23-0x0000000000D80000-0x0000000000D8C000-memory.dmp

Download

memory/2664-22-0x0000000000CC0000-0x0000000000CD2000-memory.dmp

Download

memory/2664-31-0x000000001AB40000-0x000000001AB4A000-memory.dmp

Download

memory/2664-28-0x0000000002640000-0x000000000264E000-memory.dmp

Download

memory/2664-21-0x000000001AAD0000-0x000000001AB26000-memory.dmp

Download

memory/2664-20-0x0000000000CB0000-0x0000000000CBA000-memory.dmp

Download

memory/2664-27-0x0000000002630000-0x000000000263A000-memory.dmp

Download

memory/2664-13-0x00000000008E0000-0x0000000000BAC000-memory.dmp

Download

memory/2664-29-0x000000001AB20000-0x000000001AB28000-memory.dmp

Download

memory/2664-14-0x0000000000450000-0x000000000045E000-memory.dmp

Download

memory/2664-18-0x00000000006A0000-0x00000000006A8000-memory.dmp

Download

memory/2664-30-0x000000001AB30000-0x000000001AB38000-memory.dmp

Download

memory/2664-17-0x00000000008C0000-0x00000000008D6000-memory.dmp

Download

memory/2664-16-0x0000000000460000-0x0000000000468000-memory.dmp

Download

memory/2664-15-0x0000000000680000-0x000000000069C000-memory.dmp

Download

memory/2788-181-0x0000000000CE0000-0x0000000000FAC000-memory.dmp

Download

memory/3032-156-0x0000000001170000-0x000000000143C000-memory.dmp

Download

memory/3044-174-0x0000000000160000-0x000000000042C000-memory.dmp

Download