Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
30/10/2024, 22:31
General
- Target 1554ae8f1316eadf351b3e6f5e7fc9e6.exe
- Size 3.2MB
- Sample241030-2fcfdatnej
- SHA256 5bdd5d335f1dce7bff7ad597aa12c5c36d2831b58d4a1a37650fab7b070c6e23
Malware Config
Signatures
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 42 IoCs
- DCRat payload 5 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 15 IoCs
- Checks whether UAC is enabled 1 TTPs 28 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 15 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 42 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1554ae8f1316eadf351b3e6f5e7fc9e6.exe"C:\Users\Admin\AppData\Local\Temp\1554ae8f1316eadf351b3e6f5e7fc9e6.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\BridgeRefruntime\RO6jJbtsE.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\BridgeRefruntime\AZmwZW66ycOuW7BVkn8W.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\BridgeRefruntime\ProviderreviewDriver.exe"C:\BridgeRefruntime\ProviderreviewDriver.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\BridgeRefruntime\ProviderreviewDriver.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\BridgeRefruntime\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pg6iMfcDeU.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b126be3d-cbee-4532-930d-b35749c77d72.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c1b984e-a860-4f4d-bb29-0c2647875aa1.vbs"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8a97ad1-53e9-4b25-83a4-16f960ab4407.vbs"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea4fe2a8-c4e4-4c9f-b6cd-dfc4fe3586c0.vbs"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\daa85f5f-f42c-4122-a24b-24c3b1588474.vbs"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ecd24fe7-77b3-4105-85f7-6a03d3cae0ff.vbs"17⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e6134d8-b346-4c82-b63a-abbb5888dee8.vbs"19⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7a8409c-3b2b-47b6-9f65-b2febcbffb1a.vbs"21⤵
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f74315eb-7996-4b54-8e28-430d0de86ba7.vbs"23⤵
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c619604-0dcc-49a0-972d-66961983f052.vbs"25⤵
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c27d0453-e11e-45dc-95f1-973fc2aee910.vbs"27⤵
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e72e7f7-214c-45a4-8a73-9a24ec01d46a.vbs"29⤵
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"30⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\462af080-526b-4f15-9d25-ca28e5e8fb7d.vbs"31⤵
-
C:\Users\Default User\winlogon.exe"C:\Users\Default User\winlogon.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cda876b6-15b9-4088-a9ae-232cd12b7944.vbs"31⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d39125f9-86eb-4b88-a0e4-0e8c4ccb8de2.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3288466f-7fd6-4f75-84c2-c728475181f5.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2a9dacb-4d8c-494f-b357-efed22fe6a89.vbs"25⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bb61a67-ff31-451d-b0ca-9d97002f6978.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b120795e-257a-42bd-9bf3-880b268f35a5.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f670e36-7832-4a53-93f7-17fa41086394.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9353f745-2c48-4fde-8f56-9f86f81bf751.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14742e96-eac7-4378-bcfa-e6cf0fc62598.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abf64a61-32ac-40d5-9792-c7acd802c547.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ead92bbe-8365-45b6-879c-89a6fbfeaad0.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82429b8d-9095-418d-82ab-c2552fa84ec9.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52f28b04-e935-428f-93f5-a09391776d67.vbs"7⤵
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\BridgeRefruntime\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\BridgeRefruntime\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\BridgeRefruntime\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
AZmwZW66ycOuW7BVkn8W.bat
ProviderreviewDriver.exe
RCXC720.tmp
RO6jJbtsE.vbe
powershell.exe.log
winlogon.exe.log
StartupProfileData-NonInteractive
1c619604-0dcc-49a0-972d-66961983f052.vbs
3e72e7f7-214c-45a4-8a73-9a24ec01d46a.vbs
462af080-526b-4f15-9d25-ca28e5e8fb7d.vbs
4e6134d8-b346-4c82-b63a-abbb5888dee8.vbs
52f28b04-e935-428f-93f5-a09391776d67.vbs
9c1b984e-a860-4f4d-bb29-0c2647875aa1.vbs
__PSScriptPolicyTest_yhvcq1jo.mg0.ps1
a7a8409c-3b2b-47b6-9f65-b2febcbffb1a.vbs
b126be3d-cbee-4532-930d-b35749c77d72.vbs
c27d0453-e11e-45dc-95f1-973fc2aee910.vbs
c8a97ad1-53e9-4b25-83a4-16f960ab4407.vbs
daa85f5f-f42c-4122-a24b-24c3b1588474.vbs
ea4fe2a8-c4e4-4c9f-b6cd-dfc4fe3586c0.vbs
ecd24fe7-77b3-4105-85f7-6a03d3cae0ff.vbs
f74315eb-7996-4b54-8e28-430d0de86ba7.vbs
pg6iMfcDeU.bat
winlogon.exe
memory/1528-199-0x000000001C090000-0x000000001C0E6000-memory.dmp
memory/2096-266-0x000000001B3D0000-0x000000001B426000-memory.dmp
memory/3448-23-0x000000001C2C0000-0x000000001C316000-memory.dmp
memory/3448-19-0x00000000030B0000-0x00000000030C6000-memory.dmp
memory/3448-36-0x000000001C560000-0x000000001C568000-memory.dmp
memory/3448-38-0x000000001C590000-0x000000001C59C000-memory.dmp
memory/3448-34-0x000000001C540000-0x000000001C548000-memory.dmp
memory/3448-35-0x000000001C550000-0x000000001C55C000-memory.dmp
memory/3448-33-0x000000001C530000-0x000000001C53E000-memory.dmp
memory/3448-12-0x00007FFEBC163000-0x00007FFEBC165000-memory.dmp
memory/3448-32-0x000000001C420000-0x000000001C42A000-memory.dmp
memory/3448-31-0x000000001C570000-0x000000001C578000-memory.dmp
memory/3448-30-0x000000001C310000-0x000000001C31C000-memory.dmp
memory/3448-13-0x0000000000C70000-0x0000000000F62000-memory.dmp
memory/3448-29-0x000000001BCA0000-0x000000001BCAC000-memory.dmp
memory/3448-28-0x000000001BC90000-0x000000001BC98000-memory.dmp
memory/3448-27-0x000000001BC80000-0x000000001BC8C000-memory.dmp
memory/3448-14-0x0000000003060000-0x000000000306E000-memory.dmp
memory/3448-26-0x000000001BC60000-0x000000001BC68000-memory.dmp
memory/3448-25-0x0000000003220000-0x000000000322C000-memory.dmp
memory/3448-24-0x0000000003210000-0x000000000321C000-memory.dmp
memory/3448-22-0x00000000030F0000-0x00000000030FA000-memory.dmp
memory/3448-21-0x00000000030E0000-0x00000000030F0000-memory.dmp
memory/3448-20-0x00000000030D0000-0x00000000030D8000-memory.dmp
memory/3448-37-0x000000001C580000-0x000000001C58A000-memory.dmp
memory/3448-18-0x00000000030A0000-0x00000000030B0000-memory.dmp
memory/3448-17-0x000000001BC10000-0x000000001BC60000-memory.dmp
memory/3448-15-0x0000000003070000-0x0000000003078000-memory.dmp
memory/3448-16-0x0000000003080000-0x000000000309C000-memory.dmp
memory/3700-154-0x000000001BC30000-0x000000001BC86000-memory.dmp
memory/4884-141-0x0000000000250000-0x0000000000542000-memory.dmp
memory/4968-90-0x0000027D79D90000-0x0000027D79DB2000-memory.dmp