dcrat | 4b1967b04039c9b7a23651043b38c895cca2eb560de30a960368f82549079605

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5780DBAE6AC61A88C8D89F216F324146.exe
Size

855KB
MD5

5780dbae6ac61a88c8d89f216f324146
SHA1

cebcebedc7aaea3a4dd1fbec933cd169bf92e9dc
SHA256

4b1967b04039c9b7a23651043b38c895cca2eb560de30a960368f82549079605
SHA512

8a595384247649e31ef0c69a63243199d224334d75b66fd486a8e6ba0ac3c2b5521e1ead4b64fb9c968c21a4836581dde10e78f36217b62862c40bed2d105920
SSDEEP

12288:I/TnPz84JfpflKH6qHJJMA+7pW3Ari4VVyZC0+1cp9rcDNpTWDTQGCZ6:I/TnzfS6qpJMA+73iE0nTr66

Score

10^/10

dcrat infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\en-US\\OfficeClickToRun.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\5780DBAE6AC61A88C8D89F216F324146.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\SppExtComObj.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\SppExtComObj.exe\", \"C:\\Windows\\en-US\\OfficeClickToRun.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1748	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	1748	schtasks.exe	84

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/244-1-0x0000000000410000-0x00000000004EC000-memory.dmp	family_dcrat_v2
behavioral2/files/0x0008000000023c57-29.dat	family_dcrat_v2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	5780DBAE6AC61A88C8D89F216F324146.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\WindowsPowerShell\\spoolsv.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Reference Assemblies\\SppExtComObj.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Reference Assemblies\\SppExtComObj.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\en-US\\OfficeClickToRun.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5780DBAE6AC61A88C8D89F216F324146 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5780DBAE6AC61A88C8D89F216F324146.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5780DBAE6AC61A88C8D89F216F324146 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\5780DBAE6AC61A88C8D89F216F324146.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Windows\\en-US\\OfficeClickToRun.exe\""	5780DBAE6AC61A88C8D89F216F324146.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io
52	ipinfo.io
53	ipinfo.io
8	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC85E7E8032D65430CBEF64B84EAC7196A.TMP	csc.exe
File created	\??\c:\Windows\System32\kpkopw.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\e1ef82546f0b02	5780DBAE6AC61A88C8D89F216F324146.exe
File created	C:\Program Files\WindowsPowerShell\spoolsv.exe	5780DBAE6AC61A88C8D89F216F324146.exe
File created	C:\Program Files\WindowsPowerShell\f3b6ecef712a24	5780DBAE6AC61A88C8D89F216F324146.exe
File created	C:\Program Files (x86)\Reference Assemblies\SppExtComObj.exe	5780DBAE6AC61A88C8D89F216F324146.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\en-US\OfficeClickToRun.exe	5780DBAE6AC61A88C8D89F216F324146.exe
File opened for modification	C:\Windows\en-US\OfficeClickToRun.exe	5780DBAE6AC61A88C8D89F216F324146.exe
File created	C:\Windows\en-US\e6c9b481da804f	5780DBAE6AC61A88C8D89F216F324146.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	5780DBAE6AC61A88C8D89F216F324146.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4364	schtasks.exe
2316	schtasks.exe
3112	schtasks.exe
776	schtasks.exe
1584	schtasks.exe
3260	schtasks.exe
1832	schtasks.exe
428	schtasks.exe
3800	schtasks.exe
2440	schtasks.exe
2728	schtasks.exe
1480	schtasks.exe
2352	schtasks.exe
764	schtasks.exe
3584	schtasks.exe
2008	schtasks.exe
4556	schtasks.exe
5040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe
244	5780DBAE6AC61A88C8D89F216F324146.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3964	5780DBAE6AC61A88C8D89F216F324146.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	5780DBAE6AC61A88C8D89F216F324146.exe
Token: SeDebugPrivilege	3964	5780DBAE6AC61A88C8D89F216F324146.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 4868	244	5780DBAE6AC61A88C8D89F216F324146.exe	89
PID 244 wrote to memory of 4868	244	5780DBAE6AC61A88C8D89F216F324146.exe	89
PID 4868 wrote to memory of 1104	4868	csc.exe	91
PID 4868 wrote to memory of 1104	4868	csc.exe	91
PID 244 wrote to memory of 3588	244	5780DBAE6AC61A88C8D89F216F324146.exe	109
PID 244 wrote to memory of 3588	244	5780DBAE6AC61A88C8D89F216F324146.exe	109
PID 3588 wrote to memory of 768	3588	cmd.exe	111
PID 3588 wrote to memory of 768	3588	cmd.exe	111
PID 3588 wrote to memory of 4832	3588	cmd.exe	112
PID 3588 wrote to memory of 4832	3588	cmd.exe	112
PID 3588 wrote to memory of 3964	3588	cmd.exe	118
PID 3588 wrote to memory of 3964	3588	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5780DBAE6AC61A88C8D89F216F324146.exe
"C:\Users\Admin\AppData\Local\Temp\5780DBAE6AC61A88C8D89F216F324146.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cawqurye\cawqurye.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES922E.tmp" "c:\Windows\System32\CSC85E7E8032D65430CBEF64B84EAC7196A.TMP"
    3⤵
    PID:1104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EFLTiNcX40.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:768
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\5780DBAE6AC61A88C8D89F216F324146.exe
    "C:\Users\Admin\AppData\Local\Temp\5780DBAE6AC61A88C8D89F216F324146.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5780DBAE6AC61A88C8D89F216F3241465" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\5780DBAE6AC61A88C8D89F216F324146.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5780DBAE6AC61A88C8D89F216F324146" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\5780DBAE6AC61A88C8D89F216F324146.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5780DBAE6AC61A88C8D89F216F3241465" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\5780DBAE6AC61A88C8D89F216F324146.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WindowsPowerShell\spoolsv.exe

Filesize
855KB

MD5
5780dbae6ac61a88c8d89f216f324146

SHA1
cebcebedc7aaea3a4dd1fbec933cd169bf92e9dc

SHA256
4b1967b04039c9b7a23651043b38c895cca2eb560de30a960368f82549079605

SHA512
8a595384247649e31ef0c69a63243199d224334d75b66fd486a8e6ba0ac3c2b5521e1ead4b64fb9c968c21a4836581dde10e78f36217b62862c40bed2d105920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\5780DBAE6AC61A88C8D89F216F324146.exe.log

Filesize
1KB

MD5
34ff77a14aec2a0e3fff7660e7506da8

SHA1
168cdfbdc68f6a56d0fb35bb7605aab83a2c1837

SHA256
a14bc9f57c725c55f9e5281f6cfee0bd5fcd262df65b5fca9883137aa2fa0c66

SHA512
1c430fd847c40dba7820d93c5db0cab90a6666e06fd9dc5349173af4991432f6eec6c8e79ff25834d6e218cc02868f6f82d1feea61e2b9d5dfdbcb9c45bd760a

Download Submit
C:\Users\Admin\AppData\Local\Temp\EFLTiNcX40.bat

Filesize
246B

MD5
824bb351313161e2fdb319714240d2cb

SHA1
7b3f1e4886284ba8fbc82aa13818114231cafeb4

SHA256
505ae5ed3741b17a78f1d50b6736af024b8df8a2b3c6861dd6ec47cb34879d4f

SHA512
3be00b4a8cd86f8c8d56931de6ebb676d76d6c54b95c59d72c45072547119091948dbe9ae9ab10d451f83c67b981d728f06ad2b20dd75800bb662c2fc0b879d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES922E.tmp

Filesize
1KB

MD5
7b2bd110817bcabe60a64180190bfdf4

SHA1
b6e5709da3f4a83c6d2f34f3f3be27b5a103a232

SHA256
07ff47705d4ce8e214c1a391e98b713b804cef23bb9e68c892895dd8611a3591

SHA512
b48e44f09238d84356d7cf117f7eaf7fbefad4564a772f205722c029cc381a2a23c3a81c38c023e6f9113db21d19247555a9b499f6bbee4653138cb02c61baa0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cawqurye\cawqurye.0.cs

Filesize
378B

MD5
39d77153a6ab75ecd7614c31e8bd53d9

SHA1
2f0b0c89de5d195ad382d5a98bda3d7518e5d79a

SHA256
8f19c10db65ceb6981413ea704b154d6471feb67aa79e42eb42df8752ea3781a

SHA512
31e5caacace9f3ef0636e998ad71b6bacae1b227f77789eb2cedc8bdd4a886867a72aa691f204107e41ce1e862e18e251777ee832f4c5f677b307501a9cee881

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cawqurye\cawqurye.cmdline

Filesize
235B

MD5
6503e909bde934a43c54d1a2cfe66f57

SHA1
5ee300237bda10c2e40803de6ae723a7d03b60d3

SHA256
d30c0c775d12d617afd099ee9bbf7db9f49c73d30826570235736b0a5f3e5bd9

SHA512
62ca270e4fe0fd29a5dde04aab80e86d65871e3c10db37ea282ba698f8a93c9e3726e895ca27492b34058745c78a6fd353aa3181ba60273712aae320cba0760d

Download Submit
\??\c:\Windows\System32\CSC85E7E8032D65430CBEF64B84EAC7196A.TMP

Filesize
1KB

MD5
7bbfaf1199741b237d2493615c95c6d7

SHA1
86d466217c4dc1e0808f83ceda8f4b4df948b5dc

SHA256
e20e4619dbc932a216fd93f86fe0af2e915f4c2ba6177fc3581da59885094476

SHA512
2eda9bf71dc4a4583b7b8e9a6aab0f91d98cca68ee4309df1a4d26541917678da09a15d712397ae4b95fe95b65c8aa6eeab94d7620a5546b3df6c00306ef4a5c

Download Submit
memory/244-7-0x0000000002650000-0x00000000026A0000-memory.dmp

Filesize
320KB

Download
memory/244-33-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-14-0x0000000002570000-0x000000000257E000-memory.dmp

Filesize
56KB

Download
memory/244-16-0x0000000002610000-0x0000000002618000-memory.dmp

Filesize
32KB

Download
memory/244-18-0x0000000002620000-0x000000000262C000-memory.dmp

Filesize
48KB

Download
memory/244-19-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-10-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-31-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-32-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-12-0x0000000002560000-0x000000000256C000-memory.dmp

Filesize
48KB

Download
memory/244-0-0x00007FFC5AD03000-0x00007FFC5AD05000-memory.dmp

Filesize
8KB

Download
memory/244-9-0x00000000025A0000-0x00000000025B8000-memory.dmp

Filesize
96KB

Download
memory/244-6-0x0000000002580000-0x000000000259C000-memory.dmp

Filesize
112KB

Download
memory/244-4-0x0000000002550000-0x000000000255E000-memory.dmp

Filesize
56KB

Download
memory/244-46-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-47-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-53-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-2-0x00007FFC5AD00000-0x00007FFC5B7C1000-memory.dmp

Filesize
10.8MB

Download
memory/244-1-0x0000000000410000-0x00000000004EC000-memory.dmp

Filesize
880KB

Download