Malware Analysis Report

2024-11-30 02:04

Sample ID 240728-fx5btstbpd
Target ADA563883BF3A762A5610A0DECE18B0D.exe
SHA256 94f11d5cb25d38c9a50a91dbdc481de91fbc7dd6f647d7638d84138ed0d24a21
Tags
rat dcrat discovery infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

94f11d5cb25d38c9a50a91dbdc481de91fbc7dd6f647d7638d84138ed0d24a21

Threat Level: Known bad

The file ADA563883BF3A762A5610A0DECE18B0D.exe was found to be: Known bad.

Malicious Activity Summary

rat dcrat discovery infostealer

DCRat payload

DcRat

Process spawned unexpected child process

Dcrat family

DCRat payload

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

Modifies registry class

Scheduled Task/Job: Scheduled Task

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-28 05:16

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-28 05:16

Reported

2024-07-28 05:18

Platform

win7-20240708-en

Max time kernel

134s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Media Player\ja-JP\dwm.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Windows Media Player\ja-JP\6cb0b6c459d5d3 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows NT\Accessories\ja-JP\spoolsv.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows NT\Accessories\ja-JP\f3b6ecef712a24 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\42af1c969fbb7b C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\088424020bedd6 C:\containerComponentRuntimebroker\portsession.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\containerComponentRuntimebroker\portsession.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe C:\Windows\SysWOW64\WScript.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe C:\Windows\SysWOW64\WScript.exe
PID 2100 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\containerComponentRuntimebroker\portsession.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\containerComponentRuntimebroker\portsession.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\containerComponentRuntimebroker\portsession.exe
PID 2720 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\containerComponentRuntimebroker\portsession.exe
PID 2724 wrote to memory of 1144 N/A C:\containerComponentRuntimebroker\portsession.exe C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe
PID 2724 wrote to memory of 1144 N/A C:\containerComponentRuntimebroker\portsession.exe C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe
PID 2724 wrote to memory of 1144 N/A C:\containerComponentRuntimebroker\portsession.exe C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe

"C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\containerComponentRuntimebroker\r8APJwrQXr0EQZqAy0JL48o.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\containerComponentRuntimebroker\gGR4zvRTVDsPIi.bat" "

C:\containerComponentRuntimebroker\portsession.exe

"C:\containerComponentRuntimebroker\portsession.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\2b7a8ca2-3d6d-11ef-81ce-f2a3cf4ad94f\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\ja-JP\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\containerComponentRuntimebroker\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\containerComponentRuntimebroker\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\containerComponentRuntimebroker\taskhost.exe'" /rl HIGHEST /f

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe

"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\conhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 code-yandex.ru udp
RU 31.31.198.57:80 code-yandex.ru tcp
RU 31.31.198.57:80 code-yandex.ru tcp
RU 31.31.198.57:80 code-yandex.ru tcp

Files

C:\containerComponentRuntimebroker\r8APJwrQXr0EQZqAy0JL48o.vbe

MD5 e73f7a7a72031e686159042921e2eb2f
SHA1 731227edc4d1dd1575c7da0f9977ddbfa94e1c08
SHA256 c362ac103bd47550919d53dcead273faddae0406b90232f074251ffdfb820e64
SHA512 1697f9dff788baef062519b8e68fc2fa85f1427312d03fb8542e0d198b2084eba9337b8e4973c66d02bc024630580ae5b42a318be15b9f87ca3535b41b542247

C:\containerComponentRuntimebroker\gGR4zvRTVDsPIi.bat

MD5 520f4cc0e3eb2de1f01feff66ff03989
SHA1 0c22ce6a03389884bfbaa5ba5eabc3fc149d3dd3
SHA256 cc432b74cb689e8800e41ba4871e240af153dcf923d0253f7a8bf8d9c47ac478
SHA512 d5b5ac63af7bcbafc29096bcc4bc35ac0de03c8b4372bc6569e27ac9e3bc41b04a8ea00b20a3a4909b0a5b28aebd7af84403106c9c4422718abd9b8a602d925b

\containerComponentRuntimebroker\portsession.exe

MD5 00c7dd518e680fd3e678083edce340e9
SHA1 75b91e2d91de3b557db97915e7ee976920fa639f
SHA256 a916c57d8b9d7a46aa78738928d6a503f379a890603a0442ac2a30d6a7843f02
SHA512 d1df5032a91a17774f91fe14ba7d4e4b06df126eafb53c3a18bde3ffda7b5b69f8e6aefa49b8ef5718c3e8cc273d55cc69b6655d819c1ffd66702348d6188b0a

memory/2724-13-0x0000000000380000-0x0000000000456000-memory.dmp

memory/1144-32-0x0000000000B40000-0x0000000000C16000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-28 05:16

Reported

2024-07-28 05:18

Platform

win10v2004-20240709-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\containerComponentRuntimebroker\portsession.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\dllhost.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Google\5940a34987c991 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Internet Explorer\es-ES\smss.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\cmd.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\6203df4a6bafc7 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Windows NT\csrss.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\lsass.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Windows NT\886983d96e3d3e C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows Photo Viewer\ja-JP\WaaSMedicAgent.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Internet Explorer\es-ES\69ddcba757bf72 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows NT\Accessories\en-US\Registry.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows NT\Accessories\en-US\ee2ad38f3d4382 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Windows Defender\fr-FR\5b884080fd4f94 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows Photo Viewer\uk-UA\sihost.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows Photo Viewer\uk-UA\66fc9ff0ee96c2 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\ebf1f9fa8afd6d C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\38384e6a620884 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Program Files\Windows Photo Viewer\ja-JP\c82b8037eab33d C:\containerComponentRuntimebroker\portsession.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\sysmon.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Windows\Speech\Engines\TTS\en-US\RuntimeBroker.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Windows\Speech\Engines\TTS\en-US\9e8d7a4ca61bd9 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Windows\assembly\upfc.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Windows\assembly\ea1d8f6d871115 C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Windows\it-IT\RuntimeBroker.exe C:\containerComponentRuntimebroker\portsession.exe N/A
File created C:\Windows\it-IT\9e8d7a4ca61bd9 C:\containerComponentRuntimebroker\portsession.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WScript.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\containerComponentRuntimebroker\portsession.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\containerComponentRuntimebroker\portsession.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Internet Explorer\es-ES\smss.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe

"C:\Users\Admin\AppData\Local\Temp\ADA563883BF3A762A5610A0DECE18B0D.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\containerComponentRuntimebroker\r8APJwrQXr0EQZqAy0JL48o.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\containerComponentRuntimebroker\gGR4zvRTVDsPIi.bat" "

C:\containerComponentRuntimebroker\portsession.exe

"C:\containerComponentRuntimebroker\portsession.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\containerComponentRuntimebroker\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\containerComponentRuntimebroker\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\containerComponentRuntimebroker\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\assembly\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\assembly\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Windows\assembly\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\sihost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\uk-UA\sihost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Gadgets\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Gadgets\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\WaaSMedicAgent.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\WaaSMedicAgent.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\WaaSMedicAgent.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\conhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Downloads\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\conhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Start Menu\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Start Menu\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\es-ES\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\es-ES\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-US\Registry.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\en-US\Registry.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\Speech\Engines\TTS\en-US\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Speech\Engines\TTS\en-US\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\Speech\Engines\TTS\en-US\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Program Files\Internet Explorer\es-ES\smss.exe

"C:\Program Files\Internet Explorer\es-ES\smss.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 code-yandex.ru udp
RU 31.31.198.57:80 code-yandex.ru tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
RU 31.31.198.57:80 code-yandex.ru tcp
US 8.8.8.8:53 57.198.31.31.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
RU 31.31.198.57:80 code-yandex.ru tcp
US 8.8.8.8:53 201.201.50.20.in-addr.arpa udp

Files

C:\containerComponentRuntimebroker\r8APJwrQXr0EQZqAy0JL48o.vbe

MD5 e73f7a7a72031e686159042921e2eb2f
SHA1 731227edc4d1dd1575c7da0f9977ddbfa94e1c08
SHA256 c362ac103bd47550919d53dcead273faddae0406b90232f074251ffdfb820e64
SHA512 1697f9dff788baef062519b8e68fc2fa85f1427312d03fb8542e0d198b2084eba9337b8e4973c66d02bc024630580ae5b42a318be15b9f87ca3535b41b542247

C:\containerComponentRuntimebroker\gGR4zvRTVDsPIi.bat

MD5 520f4cc0e3eb2de1f01feff66ff03989
SHA1 0c22ce6a03389884bfbaa5ba5eabc3fc149d3dd3
SHA256 cc432b74cb689e8800e41ba4871e240af153dcf923d0253f7a8bf8d9c47ac478
SHA512 d5b5ac63af7bcbafc29096bcc4bc35ac0de03c8b4372bc6569e27ac9e3bc41b04a8ea00b20a3a4909b0a5b28aebd7af84403106c9c4422718abd9b8a602d925b

C:\containerComponentRuntimebroker\portsession.exe

MD5 00c7dd518e680fd3e678083edce340e9
SHA1 75b91e2d91de3b557db97915e7ee976920fa639f
SHA256 a916c57d8b9d7a46aa78738928d6a503f379a890603a0442ac2a30d6a7843f02
SHA512 d1df5032a91a17774f91fe14ba7d4e4b06df126eafb53c3a18bde3ffda7b5b69f8e6aefa49b8ef5718c3e8cc273d55cc69b6655d819c1ffd66702348d6188b0a

memory/1636-12-0x00007FFFA26B3000-0x00007FFFA26B5000-memory.dmp

memory/1636-13-0x00000000003F0000-0x00000000004C6000-memory.dmp