dcrat | ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/10/2024, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Size

827KB
MD5

024abbb7e999cf09b8aee01979296d38
SHA1

f883c399426d39fa169078cd92ea3bf360bd0e6b
SHA256

ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12
SHA512

fd6cadc5814b1cd9617600f645ed304445960eb810ffd7c3e919c22bf7f80e1411354ef9a0a5183ef35aaf8e18b6e2c08a0a02e26428b78f12723b4e22a5b389
SSDEEP

12288:Qr5J4kXbiCU0qbEPGGoWfbDNz4ZH1z3gROZ84k4zizkx:3kXbiDEPGGoWbDNDEZ8342zO

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 17 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Users\\Public\\SppExtComObj.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\csrss.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Users\\Public\\SppExtComObj.exe\", \"C:\\Windows\\it-IT\\dllhost.exe\", \"C:\\Windows\\AppReadiness\\backgroundTaskHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\", \"C:\\Recovery\\WindowsRE\\MusNotification.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Users\\Public\\SppExtComObj.exe\", \"C:\\Windows\\it-IT\\dllhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Google\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\", \"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\MusNotification.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\", \"C:\\Users\\Public\\Music\\sppsvc.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3456	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	400	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3332	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	4760	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	4760	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2104-1-0x0000000000A00000-0x0000000000AD6000-memory.dmp	dcrat
behavioral2/files/0x0008000000023bfb-11.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe

Executes dropped EXE 1 IoCs

pid	Process
4928	fontdrvhost.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Users\\Default User\\MusNotification.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\csrss.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Users\\Default User\\MusNotification.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Recovery\\WindowsRE\\MusNotification.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Google\\TextInputHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Music\\sppsvc.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\csrss.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Public\\SppExtComObj.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\it-IT\\dllhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\L2Schemas\\RuntimeBroker.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Google\\Idle.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Music\\sppsvc.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\AppReadiness\\backgroundTaskHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Desktop\\RuntimeBroker.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Windows Sidebar\\OfficeClickToRun.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Recovery\\WindowsRE\\MusNotification.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\it-IT\\dllhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\AppReadiness\\backgroundTaskHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\fontdrvhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\sihost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Public\\SppExtComObj.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Google\\TextInputHost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Google\\Idle.exe\""	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\22eafd247d37c3	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Google\TextInputHost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Google\Idle.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sihost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\66fc9ff0ee96c2	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\886983d96e3d3e	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Windows Sidebar\e6c9b481da804f	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Google\fontdrvhost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File opened for modification	C:\Program Files (x86)\Google\TextInputHost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Google\6ccacd8608530f	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\5b884080fd4f94	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Program Files (x86)\Google\5b884080fd4f94	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\5940a34987c991	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Windows\AppReadiness\backgroundTaskHost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Windows\AppReadiness\eddb19405b7ce1	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Windows\L2Schemas\RuntimeBroker.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Windows\L2Schemas\9e8d7a4ca61bd9	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Windows\Boot\Fonts\backgroundTaskHost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
File created	C:\Windows\it-IT\dllhost.exe	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4332	schtasks.exe
864	schtasks.exe
1988	schtasks.exe
3408	schtasks.exe
440	schtasks.exe
1144	schtasks.exe
4972	schtasks.exe
4920	schtasks.exe
1764	schtasks.exe
5016	schtasks.exe
3496	schtasks.exe
4928	schtasks.exe
1492	schtasks.exe
1304	schtasks.exe
3628	schtasks.exe
1472	schtasks.exe
3988	schtasks.exe
4724	schtasks.exe
3596	schtasks.exe
1212	schtasks.exe
1852	schtasks.exe
972	schtasks.exe
1128	schtasks.exe
3756	schtasks.exe
1676	schtasks.exe
2348	schtasks.exe
4392	schtasks.exe
5044	schtasks.exe
2844	schtasks.exe
2324	schtasks.exe
3456	schtasks.exe
2508	schtasks.exe
1124	schtasks.exe
868	schtasks.exe
1824	schtasks.exe
3332	schtasks.exe
1728	schtasks.exe
3744	schtasks.exe
3948	schtasks.exe
2524	schtasks.exe
4656	schtasks.exe
400	schtasks.exe
316	schtasks.exe
396	schtasks.exe
880	schtasks.exe
756	schtasks.exe
4624	schtasks.exe
1544	schtasks.exe
2876	schtasks.exe
1176	schtasks.exe
2788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
4928	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
Token: SeDebugPrivilege	4928	fontdrvhost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4216	2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe	136
PID 2104 wrote to memory of 4216	2104	ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe	136
PID 4216 wrote to memory of 4512	4216	cmd.exe	138
PID 4216 wrote to memory of 4512	4216	cmd.exe	138
PID 4216 wrote to memory of 4928	4216	cmd.exe	146
PID 4216 wrote to memory of 4928	4216	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe
"C:\Users\Admin\AppData\Local\Temp\ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qkvpRhhVD3.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4512
- - C:\Program Files (x86)\Google\fontdrvhost.exe
    "C:\Program Files (x86)\Google\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Desktop\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Users\Default User\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Music\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Music\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Users\Public\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\it-IT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\AppReadiness\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\AppReadiness\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\AppReadiness\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\qkvpRhhVD3.bat

Filesize
210B

MD5
a5437dd46572a47689a25b185f28e7f0

SHA1
5b0be55a978348aed617890b14498ef6f2ab3a0e

SHA256
208744d363cf60b36ca0c1e8e6eeb4cd7c2a5541dbf4d7a47b8c6244930ae703

SHA512
1d2cc4467f0c05e75fcb8857056636016576255043a641a73f2d51e31107ae26778ae9ea30c750dfbed2248ee8dc5e2dcd066eabcc8f42b1489d7666ec93354b

Download Submit
C:\Users\Default\MusNotification.exe

Filesize
827KB

MD5
024abbb7e999cf09b8aee01979296d38

SHA1
f883c399426d39fa169078cd92ea3bf360bd0e6b

SHA256
ab9a6a7f554c6eaf3b6285fb12351ee81132180581f39b5c19019870a7162b12

SHA512
fd6cadc5814b1cd9617600f645ed304445960eb810ffd7c3e919c22bf7f80e1411354ef9a0a5183ef35aaf8e18b6e2c08a0a02e26428b78f12723b4e22a5b389

Download Submit
memory/2104-0-0x00007FFCED2A3000-0x00007FFCED2A5000-memory.dmp

Filesize
8KB

Download
memory/2104-1-0x0000000000A00000-0x0000000000AD6000-memory.dmp

Filesize
856KB

Download
memory/2104-4-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download
memory/2104-42-0x00007FFCED2A0000-0x00007FFCEDD61000-memory.dmp

Filesize
10.8MB

Download