dcrat | b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515

Analysis

max time kernel
134s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Size

827KB
MD5

7dd8afbb49ae5a087a23e98931557da2
SHA1

925549dc8d4b1f21905d6430796b88c795648ed2
SHA256

b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515
SHA512

4e64d47e0c0b452546054a00491c60137ec9f4373554bda5a8e4099e803a9829e98bf130d2bec9cae9bc21eff41fc24487f50993e3316f2230c82eb08c5f9edb
SSDEEP

12288:H9nfsdPp5UPYBf4HFrsulbCAx2Qg8UcYps8CNfhfG7Ik2Q:H9fjPYBCFrPlb59Us8CDfQIk2Q

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 17 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\", \"C:\\Users\\Default\\Downloads\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\", \"C:\\Users\\Default\\Downloads\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\", \"C:\\Users\\Default\\Music\\dwm.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\", \"C:\\Users\\Default\\Downloads\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\", \"C:\\Users\\Default\\Music\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\Idle.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\", \"C:\\Users\\Default\\Downloads\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\", \"C:\\Users\\Default\\Music\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Program Files\\Mozilla Firefox\\csrss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\", \"C:\\Users\\Default\\Downloads\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\", \"C:\\Users\\Default\\Music\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\", \"C:\\Users\\Default\\Downloads\\smss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\smss.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\", \"C:\\Users\\All Users\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Music\\SearchApp.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Users\\All Users\\Desktop\\unsecapp.exe\", \"C:\\Windows\\Resources\\Themes\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\", \"C:\\Users\\Default\\Downloads\\smss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\", \"C:\\Users\\Default\\Music\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	948	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1264	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3960	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3120	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	4896	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4896	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3244-1-0x0000000000D30000-0x0000000000E06000-memory.dmp	dcrat
behavioral2/files/0x0008000000023bc4-11.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe

Executes dropped EXE 1 IoCs

pid	Process
3060	dwm.exe

Adds Run key to start application 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Default\\Music\\SearchApp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Downloads\\smss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default\\Music\\dwm.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\Idle.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Mozilla Firefox\\csrss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Mozilla Firefox\\SearchApp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Default\\Music\\dwm.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Mozilla Firefox\\csrss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\All Users\\TextInputHost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Default\\Music\\SearchApp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\StartMenuExperienceHost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Defender\\dllhost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\Idle.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\All Users\\TextInputHost.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Resources\\Themes\\sppsvc.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Resources\\Themes\\sppsvc.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\smss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\All Users\\Desktop\\unsecapp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\All Users\\Desktop\\unsecapp.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Defender\\es-ES\\wininit.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\Downloads\\smss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Default\\smss.exe\""	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	pastebin.com
24	pastebin.com

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\csrss.exe	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files\Mozilla Firefox\886983d96e3d3e	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files\Windows Defender\es-ES\wininit.exe	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files\Windows Defender\es-ES\56085415360792	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\6ccacd8608530f	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files (x86)\Windows Defender\5940a34987c991	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\55b276f4edf653	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files\Mozilla Firefox\SearchApp.exe	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files\Mozilla Firefox\38384e6a620884	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Program Files (x86)\Windows Defender\dllhost.exe	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Resources\Themes\sppsvc.exe	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
File created	C:\Windows\Resources\Themes\0a1fd5f707cd16	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
948	schtasks.exe
2020	schtasks.exe
1316	schtasks.exe
3296	schtasks.exe
1680	schtasks.exe
4776	schtasks.exe
3628	schtasks.exe
1208	schtasks.exe
5016	schtasks.exe
2936	schtasks.exe
1952	schtasks.exe
3960	schtasks.exe
2272	schtasks.exe
912	schtasks.exe
4512	schtasks.exe
4372	schtasks.exe
3096	schtasks.exe
1676	schtasks.exe
2684	schtasks.exe
396	schtasks.exe
2084	schtasks.exe
1264	schtasks.exe
112	schtasks.exe
1784	schtasks.exe
4800	schtasks.exe
3496	schtasks.exe
4680	schtasks.exe
2392	schtasks.exe
728	schtasks.exe
4772	schtasks.exe
3388	schtasks.exe
3368	schtasks.exe
3888	schtasks.exe
3536	schtasks.exe
2636	schtasks.exe
4212	schtasks.exe
2040	schtasks.exe
1760	schtasks.exe
1688	schtasks.exe
1356	schtasks.exe
2888	schtasks.exe
1144	schtasks.exe
2008	schtasks.exe
1052	schtasks.exe
2480	schtasks.exe
996	schtasks.exe
1844	schtasks.exe
1432	schtasks.exe
4196	schtasks.exe
3120	schtasks.exe
1912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
3060	dwm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
Token: SeDebugPrivilege	3060	dwm.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 3748	3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe	136
PID 3244 wrote to memory of 3748	3244	b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe	136
PID 3748 wrote to memory of 2356	3748	cmd.exe	138
PID 3748 wrote to memory of 2356	3748	cmd.exe	138
PID 3748 wrote to memory of 3060	3748	cmd.exe	146
PID 3748 wrote to memory of 3060	3748	cmd.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe
"C:\Users\Admin\AppData\Local\Temp\b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2V5rhj0QFd.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2356
- - C:\Users\Default\Music\dwm.exe
    "C:\Users\Default\Music\dwm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\es-ES\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Music\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\Music\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Music\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Desktop\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Themes\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Resources\Themes\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Resources\Themes\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Music\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe

Filesize
827KB

MD5
7dd8afbb49ae5a087a23e98931557da2

SHA1
925549dc8d4b1f21905d6430796b88c795648ed2

SHA256
b1d43056050ebf9e4698475c07022fb3c6e39d721abaf32d459d5bf50ed1b515

SHA512
4e64d47e0c0b452546054a00491c60137ec9f4373554bda5a8e4099e803a9829e98bf130d2bec9cae9bc21eff41fc24487f50993e3316f2230c82eb08c5f9edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\2V5rhj0QFd.bat

Filesize
195B

MD5
cf655444fa3082332a6dcf87306c861e

SHA1
4cd8f6b9582fd77e66c665948d084e07473e0f3e

SHA256
69a0b0337d635a7707161f26a6d1d3f2871e14634ec4dbedd3537d345fc4afed

SHA512
e4ada4d3dd77a928a299f9dc6cfee06b4bf37b950ab1c690cb3541b5d5471889ead5eabff273e1c5bf93ea12b15b834337c82f3d1bbb408be3d46951868940a4

Download Submit
memory/3244-0-0x00007FFB52293000-0x00007FFB52295000-memory.dmp

Filesize
8KB

Download
memory/3244-1-0x0000000000D30000-0x0000000000E06000-memory.dmp

Filesize
856KB

Download
memory/3244-2-0x00007FFB52290000-0x00007FFB52D51000-memory.dmp

Filesize
10.8MB

Download
memory/3244-42-0x00007FFB52290000-0x00007FFB52D51000-memory.dmp

Filesize
10.8MB

Download