dcrat | 158c9599f5310708e34c67ba1f72241b28e0b5633dec9e786fd6031a95da6d3d

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Bh2PmThP.exe
Size

1.7MB
MD5

475d2e67ce84a513bd0a1757becc2018
SHA1

8322b7bc21b0114b453812035ef643cf532bdf6c
SHA256

158c9599f5310708e34c67ba1f72241b28e0b5633dec9e786fd6031a95da6d3d
SHA512

0d2277d90853216485a261380727171aa8d2c530ba0d1ce6372f6971d16c37a3ac22196f1fe5c9a9dedd930aee302edfab3e5e89450a6d038bcc98e0af70aedd
SSDEEP

24576:1v/SzhQO98aL85esKGpBAYMygXEO9rjZfyfs9o+cayR4k4m2WVux/Egw/u:1v/ScA8oGAv5/c14rvuZx

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 47 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1380	schtasks.exe
		1648	schtasks.exe
		1004	schtasks.exe
		1876	schtasks.exe
		2444	schtasks.exe
		2204	schtasks.exe
		1200	schtasks.exe
		2916	schtasks.exe
		1092	schtasks.exe
		3396	schtasks.exe
		2588	schtasks.exe
		3608	schtasks.exe
		4972	schtasks.exe
		4852	schtasks.exe
		3924	schtasks.exe
		1160	schtasks.exe
		2732	schtasks.exe
		3488	schtasks.exe
		436	schtasks.exe
		828	schtasks.exe
		2284	schtasks.exe
		3296	schtasks.exe
		3352	schtasks.exe
		1928	schtasks.exe
		4836	schtasks.exe
		3584	schtasks.exe
		2400	schtasks.exe
		2636	schtasks.exe
		3312	schtasks.exe
		4460	schtasks.exe
		3656	schtasks.exe
		4772	schtasks.exe
		968	schtasks.exe
		1752	schtasks.exe
		396	schtasks.exe
		3684	schtasks.exe
		2096	schtasks.exe
		2980	schtasks.exe
		4408	schtasks.exe
		4956	schtasks.exe
		3628	schtasks.exe
		1020	schtasks.exe
File created	C:\Program Files\Crashpad\attachments\csrss.exe		Bh2PmThP.exe
File created	C:\Program Files\Crashpad\attachments\886983d96e3d3e		Bh2PmThP.exe
		3904	schtasks.exe
		244	schtasks.exe
		1424	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\", \"C:\\Windows\\ModemLogs\\wininit.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\", \"C:\\Windows\\ModemLogs\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\SppExtComObj.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\", \"C:\\Windows\\ModemLogs\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\SppExtComObj.exe\", \"C:\\Windows\\Microsoft.NET\\explorer.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Defender\\es-ES\\csrss.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\", \"C:\\Windows\\ModemLogs\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\", \"C:\\Windows\\ModemLogs\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\SppExtComObj.exe\", \"C:\\Windows\\Microsoft.NET\\explorer.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\", \"C:\\Windows\\ModemLogs\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\", \"C:\\Windows\\ModemLogs\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Users\\Admin\\Templates\\dllhost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\SppExtComObj.exe\", \"C:\\Windows\\Microsoft.NET\\explorer.exe\", \"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\RuntimeBroker.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\", \"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\", \"C:\\Windows\\AppReadiness\\sihost.exe\", \"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\""	Bh2PmThP.exe

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	244	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3684	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	3916	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	3916	schtasks.exe	82

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/212-1-0x0000000000CD0000-0x0000000000E88000-memory.dmp	dcrat
behavioral2/files/0x00090000000233fa-31.dat	dcrat

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	Bh2PmThP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	Bh2PmThP.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 16 IoCs

pid	Process
3460	Bh2PmThP.exe
228	csrss.exe
4908	csrss.exe
1416	csrss.exe
4116	csrss.exe
1812	csrss.exe
3104	csrss.exe
1640	csrss.exe
5064	csrss.exe
3972	csrss.exe
1272	csrss.exe
1600	csrss.exe
4740	csrss.exe
5044	csrss.exe
436	csrss.exe
4420	csrss.exe

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Templates\\dllhost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\SppExtComObj.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\AppReadiness\\sihost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\ModemLogs\\wininit.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\RuntimeBroker.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\Registry.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\RuntimeBroker.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\ModemLogs\\wininit.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Microsoft.NET\\explorer.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Crashpad\\attachments\\csrss.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\csrss.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\sihost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Microsoft.NET\\explorer.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Defender\\es-ES\\csrss.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\AppReadiness\\sihost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\SppExtComObj.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller = "\"C:\\Windows\\Setup\\State\\TrustedInstaller.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Windows\\System32\\bg-BG\\SearchApp.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Templates\\dllhost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	Bh2PmThP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	Bh2PmThP.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\bg-BG\SearchApp.exe	Bh2PmThP.exe
File created	C:\Windows\System32\bg-BG\38384e6a620884	Bh2PmThP.exe
File opened for modification	C:\Windows\System32\bg-BG\SearchApp.exe	Bh2PmThP.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Registry.exe	Bh2PmThP.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe	Bh2PmThP.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\66fc9ff0ee96c2	Bh2PmThP.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe	Bh2PmThP.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe	Bh2PmThP.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe	Bh2PmThP.exe
File opened for modification	C:\Program Files\Crashpad\attachments\csrss.exe	Bh2PmThP.exe
File created	C:\Program Files\Crashpad\attachments\886983d96e3d3e	Bh2PmThP.exe
File opened for modification	C:\Program Files\Crashpad\attachments\RCX69C8.tmp	Bh2PmThP.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe	Bh2PmThP.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\e1ef82546f0b02	Bh2PmThP.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\9e8d7a4ca61bd9	Bh2PmThP.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\fontdrvhost.exe	Bh2PmThP.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Registry.exe	Bh2PmThP.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe	Bh2PmThP.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe	Bh2PmThP.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe	Bh2PmThP.exe
File created	C:\Program Files\Crashpad\attachments\csrss.exe	Bh2PmThP.exe
File opened for modification	C:\Program Files\Crashpad\attachments\RCX69C9.tmp	Bh2PmThP.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ee2ad38f3d4382	Bh2PmThP.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\886983d96e3d3e	Bh2PmThP.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\TrustedInstaller.exe	Bh2PmThP.exe
File created	C:\Windows\Microsoft.NET\7a0fd90576e088	Bh2PmThP.exe
File created	C:\Windows\Setup\State\04c1e7795967e4	Bh2PmThP.exe
File created	C:\Windows\AppReadiness\66fc9ff0ee96c2	Bh2PmThP.exe
File created	C:\Windows\WaaS\tasks\Registry.exe	Bh2PmThP.exe
File created	C:\Windows\Microsoft.NET\explorer.exe	Bh2PmThP.exe
File opened for modification	C:\Windows\ModemLogs\wininit.exe	Bh2PmThP.exe
File opened for modification	C:\Windows\Microsoft.NET\explorer.exe	Bh2PmThP.exe
File created	C:\Windows\AppReadiness\sihost.exe	Bh2PmThP.exe
File created	C:\Windows\SystemResources\spoolsv.exe	Bh2PmThP.exe
File created	C:\Windows\ModemLogs\wininit.exe	Bh2PmThP.exe
File opened for modification	C:\Windows\Setup\State\TrustedInstaller.exe	Bh2PmThP.exe
File opened for modification	C:\Windows\AppReadiness\sihost.exe	Bh2PmThP.exe
File created	C:\Windows\ModemLogs\56085415360792	Bh2PmThP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	Bh2PmThP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Bh2PmThP.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	csrss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4772	schtasks.exe
436	schtasks.exe
4852	schtasks.exe
828	schtasks.exe
1424	schtasks.exe
3396	schtasks.exe
3488	schtasks.exe
2400	schtasks.exe
1004	schtasks.exe
396	schtasks.exe
1200	schtasks.exe
4408	schtasks.exe
4956	schtasks.exe
3352	schtasks.exe
3584	schtasks.exe
3904	schtasks.exe
2916	schtasks.exe
1020	schtasks.exe
3296	schtasks.exe
2732	schtasks.exe
2980	schtasks.exe
3684	schtasks.exe
3312	schtasks.exe
2284	schtasks.exe
968	schtasks.exe
1752	schtasks.exe
244	schtasks.exe
2444	schtasks.exe
2204	schtasks.exe
3628	schtasks.exe
2588	schtasks.exe
3656	schtasks.exe
1380	schtasks.exe
4972	schtasks.exe
3924	schtasks.exe
1160	schtasks.exe
4460	schtasks.exe
1876	schtasks.exe
4836	schtasks.exe
1928	schtasks.exe
1648	schtasks.exe
2636	schtasks.exe
3608	schtasks.exe
1092	schtasks.exe
2096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
212	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe
3460	Bh2PmThP.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	Bh2PmThP.exe
Token: SeDebugPrivilege	3460	Bh2PmThP.exe
Token: SeDebugPrivilege	228	csrss.exe
Token: SeDebugPrivilege	4908	csrss.exe
Token: SeDebugPrivilege	1416	csrss.exe
Token: SeDebugPrivilege	4116	csrss.exe
Token: SeDebugPrivilege	1812	csrss.exe
Token: SeDebugPrivilege	3104	csrss.exe
Token: SeDebugPrivilege	1640	csrss.exe
Token: SeDebugPrivilege	5064	csrss.exe
Token: SeDebugPrivilege	3972	csrss.exe
Token: SeDebugPrivilege	1272	csrss.exe
Token: SeDebugPrivilege	1600	csrss.exe
Token: SeDebugPrivilege	4740	csrss.exe
Token: SeDebugPrivilege	5044	csrss.exe
Token: SeDebugPrivilege	436	csrss.exe
Token: SeDebugPrivilege	4420	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3796	212	Bh2PmThP.exe	89
PID 212 wrote to memory of 3796	212	Bh2PmThP.exe	89
PID 3796 wrote to memory of 3080	3796	cmd.exe	91
PID 3796 wrote to memory of 3080	3796	cmd.exe	91
PID 3796 wrote to memory of 3460	3796	cmd.exe	96
PID 3796 wrote to memory of 3460	3796	cmd.exe	96
PID 3460 wrote to memory of 228	3460	Bh2PmThP.exe	138
PID 3460 wrote to memory of 228	3460	Bh2PmThP.exe	138
PID 228 wrote to memory of 432	228	csrss.exe	139
PID 228 wrote to memory of 432	228	csrss.exe	139
PID 228 wrote to memory of 2344	228	csrss.exe	140
PID 228 wrote to memory of 2344	228	csrss.exe	140
PID 432 wrote to memory of 4908	432	WScript.exe	142
PID 432 wrote to memory of 4908	432	WScript.exe	142
PID 4908 wrote to memory of 1000	4908	csrss.exe	143
PID 4908 wrote to memory of 1000	4908	csrss.exe	143
PID 4908 wrote to memory of 3608	4908	csrss.exe	144
PID 4908 wrote to memory of 3608	4908	csrss.exe	144
PID 1000 wrote to memory of 1416	1000	WScript.exe	146
PID 1000 wrote to memory of 1416	1000	WScript.exe	146
PID 1416 wrote to memory of 3660	1416	csrss.exe	147
PID 1416 wrote to memory of 3660	1416	csrss.exe	147
PID 1416 wrote to memory of 2832	1416	csrss.exe	148
PID 1416 wrote to memory of 2832	1416	csrss.exe	148
PID 3660 wrote to memory of 4116	3660	WScript.exe	149
PID 3660 wrote to memory of 4116	3660	WScript.exe	149
PID 4116 wrote to memory of 3504	4116	csrss.exe	150
PID 4116 wrote to memory of 3504	4116	csrss.exe	150
PID 4116 wrote to memory of 2652	4116	csrss.exe	151
PID 4116 wrote to memory of 2652	4116	csrss.exe	151
PID 3504 wrote to memory of 1812	3504	WScript.exe	152
PID 3504 wrote to memory of 1812	3504	WScript.exe	152
PID 1812 wrote to memory of 1748	1812	csrss.exe	153
PID 1812 wrote to memory of 1748	1812	csrss.exe	153
PID 1812 wrote to memory of 1152	1812	csrss.exe	154
PID 1812 wrote to memory of 1152	1812	csrss.exe	154
PID 1748 wrote to memory of 3104	1748	WScript.exe	155
PID 1748 wrote to memory of 3104	1748	WScript.exe	155
PID 3104 wrote to memory of 3096	3104	csrss.exe	156
PID 3104 wrote to memory of 3096	3104	csrss.exe	156
PID 3104 wrote to memory of 2968	3104	csrss.exe	157
PID 3104 wrote to memory of 2968	3104	csrss.exe	157
PID 3096 wrote to memory of 1640	3096	WScript.exe	158
PID 3096 wrote to memory of 1640	3096	WScript.exe	158
PID 1640 wrote to memory of 764	1640	csrss.exe	159
PID 1640 wrote to memory of 764	1640	csrss.exe	159
PID 1640 wrote to memory of 4500	1640	csrss.exe	160
PID 1640 wrote to memory of 4500	1640	csrss.exe	160
PID 764 wrote to memory of 5064	764	WScript.exe	161
PID 764 wrote to memory of 5064	764	WScript.exe	161
PID 5064 wrote to memory of 3584	5064	csrss.exe	162
PID 5064 wrote to memory of 3584	5064	csrss.exe	162
PID 5064 wrote to memory of 3488	5064	csrss.exe	163
PID 5064 wrote to memory of 3488	5064	csrss.exe	163
PID 3584 wrote to memory of 3972	3584	WScript.exe	164
PID 3584 wrote to memory of 3972	3584	WScript.exe	164
PID 3972 wrote to memory of 2196	3972	csrss.exe	165
PID 3972 wrote to memory of 2196	3972	csrss.exe	165
PID 3972 wrote to memory of 2488	3972	csrss.exe	166
PID 3972 wrote to memory of 2488	3972	csrss.exe	166
PID 2196 wrote to memory of 1272	2196	WScript.exe	167
PID 2196 wrote to memory of 1272	2196	WScript.exe	167
PID 1272 wrote to memory of 3092	1272	csrss.exe	168
PID 1272 wrote to memory of 3092	1272	csrss.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Bh2PmThP.exe
"C:\Users\Admin\AppData\Local\Temp\Bh2PmThP.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BkFKqKatcS.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3080
- - C:\Users\Admin\AppData\Local\Temp\Bh2PmThP.exe
    "C:\Users\Admin\AppData\Local\Temp\Bh2PmThP.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
      "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a7aaa10-b253-4e31-8b70-853d7bdc5633.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:432
      - C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ad3d66b-c099-4e2d-b4e2-ee612c66afbb.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1000
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5dc00c6-f1da-41a0-a5d6-ef933ae4aef8.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3660
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dacf077-affd-4a46-9580-ead9269f1e1c.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43efc9ab-98b4-442a-8d3b-c2134204bbb0.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23458244-656c-4272-9f1e-08ce1b41f82c.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3096
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61fc0aa3-090e-4873-bb44-42eece380d85.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42f8c43a-bbef-4138-8e5e-88cf63b39799.vbs"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82f3dacf-f2e2-47bd-94ef-eabff5ae4469.vbs"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39478d67-464a-489b-b75e-e450bc342ac1.vbs"
        23⤵
        
        PID:3092
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\407b7470-40ef-46a6-aac4-f214de5bad1e.vbs"
        25⤵
        
        PID:2308
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f594a0e7-c32d-48d3-9206-e25b9bf7b88d.vbs"
        27⤵
        
        PID:3792
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8cff71e7-5d87-41d1-827d-67267d1f3fba.vbs"
        29⤵
        
        PID:1928
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\630c9cb5-d932-4eaf-8422-1dd4bb5b06c6.vbs"
        31⤵
        
        PID:2948
        
        C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c24e744-509f-425b-bc0e-1352136c0172.vbs"
        31⤵
        
        PID:2104
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28aaad71-75df-4fa3-b73e-af567e01a465.vbs"
        29⤵
        
        PID:2124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30941e77-e7cc-4422-bb2a-775b78b2d1d7.vbs"
        27⤵
        
        PID:3364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37d02b61-9d8f-4c39-9a79-ee08a97fa1c6.vbs"
        25⤵
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\925caf10-bd62-47d4-aef8-d4b332f0f583.vbs"
        23⤵
        
        PID:2944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3db1a5bb-0d6b-4639-a159-dea95d0116ee.vbs"
        21⤵
        
        PID:2488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd1dbc3e-1acf-48ed-b882-5ad8b739ad7d.vbs"
        19⤵
        
        PID:3488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cebffce6-7d7e-4663-8c98-59bd2197024c.vbs"
        17⤵
        
        PID:4500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec552408-cb1a-44fd-8b26-1205b793f55f.vbs"
        15⤵
        
        PID:2968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee19a5bf-66ca-4d6d-9eff-cb919f400b9d.vbs"
        13⤵
        
        PID:1152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77b62e15-53e6-4f00-8a87-fa8f7f66b9ba.vbs"
        11⤵
        
        PID:2652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\074ad829-987c-4beb-8ed2-d30cf7a80f20.vbs"
        9⤵
        
        PID:2832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d5a5938-1ccb-416a-b90b-8e08bbd4caed.vbs"
        7⤵
        
        PID:3608
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0bfc38f-58da-47aa-b67b-d84224d49b6d.vbs"
        5⤵
        
        PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Crashpad\attachments\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Crashpad\attachments\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Windows\Setup\State\TrustedInstaller.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Windows\Setup\State\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 5 /tr "'C:\Windows\Setup\State\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Windows\AppReadiness\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\AppReadiness\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Windows\AppReadiness\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\System32\bg-BG\SearchApp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\System32\bg-BG\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Windows\System32\bg-BG\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\ModemLogs\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ModemLogs\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\ModemLogs\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Templates\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Microsoft.NET\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Crashpad\attachments\csrss.exe

Filesize
1.7MB

MD5
475d2e67ce84a513bd0a1757becc2018

SHA1
8322b7bc21b0114b453812035ef643cf532bdf6c

SHA256
158c9599f5310708e34c67ba1f72241b28e0b5633dec9e786fd6031a95da6d3d

SHA512
0d2277d90853216485a261380727171aa8d2c530ba0d1ce6372f6971d16c37a3ac22196f1fe5c9a9dedd930aee302edfab3e5e89450a6d038bcc98e0af70aedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Bh2PmThP.exe.log

Filesize
1KB

MD5
c6ecc3bc2cdd7883e4f2039a5a5cf884

SHA1
20c9dd2a200e4b0390d490a7a76fa184bfc78151

SHA256
b3d90663a46ee5333f8f99df4d43c0c76bf3902e3ba3ab36c0903027176d340d

SHA512
892a8f8e50ff350e790e1543032c64b3e1c050198b1810f89b6ce8a23de947a3e8299e880f0e79da7e4b5373a6b95e7dd7814cd5d7406a1553ef104ff2ff091e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\csrss.exe.log

Filesize
1KB

MD5
9b0256da3bf9a5303141361b3da59823

SHA1
d73f34951777136c444eb2c98394f62912ebcdac

SHA256
96cbc3f4e49d7ae13cd46e36ebb4819b6db1eabe5db910902638c1a24947208e

SHA512
9f014fef4b1bb71dbdd1d0bad11bd20437a9801eaa830ab386f901f6b5be374a26f68161d7638ea03483028e9a56bf97023cc24b45356a9c76cb755a53d9c164

Download Submit
C:\Users\Admin\AppData\Local\Temp\23458244-656c-4272-9f1e-08ce1b41f82c.vbs

Filesize
731B

MD5
8c513a26e341f0a6b3bb483f56304386

SHA1
c2b3204e931f6579c6279fc8bfb18044f4865a94

SHA256
cc05fc487d69f9512e01133b961dd0b084c40c364510a67cb8fbd762c1a974b2

SHA512
b76d5e7ab34205d5b4e91e8a431119a1d66f49d3c752767f6a32fcf3729b9ab186d5c5bb3f36af6fd5680e7ba231ee6d77bec23c6944c42d38bd5719608c34a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\39478d67-464a-489b-b75e-e450bc342ac1.vbs

Filesize
731B

MD5
5f89afa32a55ea9c970b0071567b80be

SHA1
cea5d15176deb3819f9e3b6f6e22d4ac45d15995

SHA256
2133c3fe4d957e588470a854c20475946ba7ba24a97cb91efcbe644b28e341ef

SHA512
9a5233cae89e03e0413063ca3f91f3630b9113392c35adbe6a7703bc82f4418afe796c7597561f193a1944874583bc6d20d24bdc69230e3c9b12e5d3f18a3f89

Download Submit
C:\Users\Admin\AppData\Local\Temp\407b7470-40ef-46a6-aac4-f214de5bad1e.vbs

Filesize
731B

MD5
87a4e0a5f71e0ba79d16b4eb9b72122b

SHA1
5405673d8298e8c5f4ed90307742c5c9fc9cf274

SHA256
01d08366a51263df45e10609bbe339cf4e3f6819096ec198865af543e73392a6

SHA512
2b05280e38580ed9578245584d564220e22fc4ffb8fbb416ffa25056e05128742f95f674531fcdc2126b6c24186f668ffdd579519963b11f5b9d3a2fb26c2531

Download Submit
C:\Users\Admin\AppData\Local\Temp\42f8c43a-bbef-4138-8e5e-88cf63b39799.vbs

Filesize
731B

MD5
3c3d552eeb5a14fa062a8a94206e018f

SHA1
98a13b89dd70720b1a36a89281a5e7738534a79e

SHA256
9ea300900fd3c9e258454f880e45b95416114971d031d64c10192769bac1bfa6

SHA512
26811552ad27cd56c524d52a3ace3951becc8b4069f9e35f463b0e2b1e93ef58085ee72ff95179fe6b9aa3303ef6a9cad16233b2600f847fe21abc055f09a2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\43efc9ab-98b4-442a-8d3b-c2134204bbb0.vbs

Filesize
731B

MD5
b24d1aeda9ce00603a2033f218af6917

SHA1
5c5834ff13d46d0bf68e8fff63bdc58b3bb710db

SHA256
9c851060ca0ea7cc682e6c0de16afde9573528baaea375f8d30cdc8a0f90b703

SHA512
2b26ed8f5d64b67fb7fb21b2fd6b0513e02dc06be2b46d5e01ebfaff05c0709d4a3dcb60f052f1bf487f66b9125083b7d6e7ec2105035b999fd0cc43b7497a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\61fc0aa3-090e-4873-bb44-42eece380d85.vbs

Filesize
731B

MD5
1fda84e597f972aa128ef55648b6cef9

SHA1
0cd8c974aa4631c77d58e7fa8ec2497c240daadb

SHA256
e0a3e2377bc2b96df316168ff80e79b9693bfd5cde2d104bb18bb6e6f18635a0

SHA512
12dc4eab07076281a5a752b488c065e0015e7ca9eda2003903ee844cac7b603ef7780109cd73beb6428d237a323e2f5cc65f226030ef17009ccc6b382749e9b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\630c9cb5-d932-4eaf-8422-1dd4bb5b06c6.vbs

Filesize
730B

MD5
e3c03c4e6b5ee283c899ba04b6de2a9a

SHA1
7dc732c32e6f3fc33f3ae39e15f050e60a69b090

SHA256
a7b38d59e4b276eef915ea623db690c036bda0579fb5fc6bffa8ec966896a72d

SHA512
a59e879e943449d69f46ed57a9b2ae24133fb166fba1e8a8321f1f24acfde61b093edb7ce92f53284be786afc738990760a018baed7fe0de2cea0399bece0c3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6a7aaa10-b253-4e31-8b70-853d7bdc5633.vbs

Filesize
730B

MD5
f92a994fc54a9b8aa8f4487beedeb2cc

SHA1
5f6fec251b18d7a3dc9aa9abb6218adb7978eb58

SHA256
f7cb3438fd5e018fb8d6b677d8e81b2995b65ad14b8285f5806dc96821468f22

SHA512
a02b4638d4997a526abf1edf2f62db61e500630f852a3a13cb9ff716b87dab0b9f218e6af8ec63142bec9b0efaacd5381107cad7730c8e41b1a846edeaac292e

Download Submit
C:\Users\Admin\AppData\Local\Temp\6dacf077-affd-4a46-9580-ead9269f1e1c.vbs

Filesize
731B

MD5
c55e34a8a7ab08e285952ff6c3c88f69

SHA1
b3880d071021595e648c929bac1e739376fe2be2

SHA256
86f8981dc1343e27a332832fea8ead77d7ca70a8b6c01a7c04b2d2747a018be3

SHA512
c0017bcaa032927e3a57bf23b863cc9721c8e11ae1b3830e6d213e6f956c5980e640b56cbcceda13e8181e9f32b7b99b70ba91c88a43078cbe235631420a501f

Download Submit
C:\Users\Admin\AppData\Local\Temp\82f3dacf-f2e2-47bd-94ef-eabff5ae4469.vbs

Filesize
731B

MD5
49ed075280582442c6a6801879304398

SHA1
f0255ae1a0f8582d3524a85b1d505fdc1aae9ccb

SHA256
19332a4db3eb5c4a61cd972b336c53279ff33daded20c2d5496f9fcb9e2a68ee

SHA512
b52ae3993aa0fb4904ad5752e0c028dac41eae769f9b6d4ced437957a7c7aabb36da7c161d8c13d8b0c3cdaf48ae560694508cd4e39d1e7903da75b56e4df869

Download Submit
C:\Users\Admin\AppData\Local\Temp\8cff71e7-5d87-41d1-827d-67267d1f3fba.vbs

Filesize
731B

MD5
5307071441ebf85cb9c8a12d8cd073a4

SHA1
d92a5c42e30104409c2c27520954071f82dad696

SHA256
d05a44ea1b51e61903884ab004e6c70c6c28fe10deab5d7ca708cabf7ed603e0

SHA512
8ad9f98a636e3559bbb3ff6ed55b0fc1fd397a10fbc3e6d5c2553fbdcacb270589cba6f11a8cad5173ae06e8bcd35f5d488737b9071a5a1b6e9eb1dd1dfb67d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ad3d66b-c099-4e2d-b4e2-ee612c66afbb.vbs

Filesize
731B

MD5
25ccf2b8a51b20d1c90a8e73c9bd088d

SHA1
f3551b36e786eb0ffe74b1157998b50a367916bb

SHA256
21a59621e9659bfbf9752362fdf244d25ff7b2de613648ee6c76fd53e182d9bb

SHA512
8946f982d6e64909797092b293e435ae3c5e2cec75f877ffb85636b33f948a5b1f1e91bffcd31baf13a876250c9b97147c0617c008b60c670854f8a5aeb54dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\BkFKqKatcS.bat

Filesize
211B

MD5
ad27b47f279cce756e9c26b23139ed92

SHA1
e60fd8598577f906cb95efbef04335c36d4a4e33

SHA256
614240eca39da6ac104664e0e38afcefa94ef64aa8044425d6724f9b649e5c85

SHA512
0b10113f8469c181f3ab5207d712c761c2f73a323f71e290338c552f691f2056d43cee61e5ba829c684643824746fb8f206ac4289b0c1e508a37545256290ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\a5dc00c6-f1da-41a0-a5d6-ef933ae4aef8.vbs

Filesize
731B

MD5
76eb93fa7cfdf91ceb0f99525858338e

SHA1
55932aa7501eabed35c3dfbce8f32394d28ccd4d

SHA256
4e77231305948bb9dbae45a0e31e56bdfbab25e3a6ac732eb917eb4af7b5e943

SHA512
8d362782750fa36e99ca7e7c1f1daefb6d58f0df4c776bf4ef6f107c90fdc0c4b7719af9959b8db50cfc6d34be3365ec6bd55f54a42af7ba7a01b87b9acc3454

Download Submit
C:\Users\Admin\AppData\Local\Temp\d0bfc38f-58da-47aa-b67b-d84224d49b6d.vbs

Filesize
507B

MD5
ab1c191638b986936d5ca5b6ff7c31d6

SHA1
9b683d89393f87ba0fca45d4a20b7e4904c910b9

SHA256
7b228ea9b15a2abdcde3f762755359319d26741c537ce15db7b94f3623b7c3c2

SHA512
95be385e8bbfca4e3016c300eb933b78b0ec5abc9f70ea22a3cbb324aa66d9ab4d3c75c3ded590983a9dd225952427a4876f63afcc33065b3122f227da0b385a

Download Submit
C:\Users\Admin\AppData\Local\Temp\f594a0e7-c32d-48d3-9206-e25b9bf7b88d.vbs

Filesize
731B

MD5
dfba248579e65b8588aca0d4e5293c8d

SHA1
0761f7f91b0acca2e67e278768755ba2f9d40189

SHA256
7c454dc0da42505987346aeb3199a3cc81f8c814ec42b910c51482e3a728275d

SHA512
ac6b3f7bbb447f0954148b4514859a99a600bc808b1f3752efa24a297aadd258141bde06865d257f30f0435d19ce40925c82dbc5e5da35f8be4fed35ac0f7709

Download Submit
memory/212-10-0x0000000003060000-0x000000000306C000-memory.dmp

Filesize
48KB

Download
memory/212-11-0x0000000003070000-0x0000000003078000-memory.dmp

Filesize
32KB

Download
memory/212-21-0x00007FFD7E400000-0x00007FFD7EEC1000-memory.dmp

Filesize
10.8MB

Download
memory/212-60-0x00007FFD7E400000-0x00007FFD7EEC1000-memory.dmp

Filesize
10.8MB

Download
memory/212-15-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Filesize
48KB

Download
memory/212-17-0x000000001BAF0000-0x000000001BAFA000-memory.dmp

Filesize
40KB

Download
memory/212-18-0x00007FFD7E400000-0x00007FFD7EEC1000-memory.dmp

Filesize
10.8MB

Download
memory/212-16-0x000000001BAE0000-0x000000001BAE8000-memory.dmp

Filesize
32KB

Download
memory/212-12-0x0000000003080000-0x000000000308A000-memory.dmp

Filesize
40KB

Download
memory/212-13-0x000000001BA70000-0x000000001BA7E000-memory.dmp

Filesize
56KB

Download
memory/212-14-0x000000001BA80000-0x000000001BA8E000-memory.dmp

Filesize
56KB

Download
memory/212-22-0x00007FFD7E400000-0x00007FFD7EEC1000-memory.dmp

Filesize
10.8MB

Download
memory/212-0-0x00007FFD7E403000-0x00007FFD7E405000-memory.dmp

Filesize
8KB

Download
memory/212-9-0x0000000003000000-0x000000000300C000-memory.dmp

Filesize
48KB

Download
memory/212-8-0x0000000002FF0000-0x0000000002FFC000-memory.dmp

Filesize
48KB

Download
memory/212-7-0x0000000002FD0000-0x0000000002FE6000-memory.dmp

Filesize
88KB

Download
memory/212-6-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/212-4-0x0000000002FA0000-0x0000000002FBC000-memory.dmp

Filesize
112KB

Download
memory/212-5-0x0000000003010000-0x0000000003060000-memory.dmp

Filesize
320KB

Download
memory/212-3-0x0000000002F80000-0x0000000002F8E000-memory.dmp

Filesize
56KB

Download
memory/212-2-0x00007FFD7E400000-0x00007FFD7EEC1000-memory.dmp

Filesize
10.8MB

Download
memory/212-1-0x0000000000CD0000-0x0000000000E88000-memory.dmp

Filesize
1.7MB

Download