dcrat | e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954

Analysis

max time kernel
116s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe
Size

2.2MB
MD5

811005c699096acecde84aeea48d9890
SHA1

077c2a11dde5d10e7a8a8f391066430725c40a8d
SHA256

e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954
SHA512

68a4ac32adee2769fdd34e2c94905763cae902dac876b858d08adcd9a4db2534fd326eabbd0ef3c96ed5b5c5bc2f3a9a95081c258ec90fe75948d3f2f52f22ce
SSDEEP

49152:PBlOTclcGVNEBuUSDgrP+7m+Ej7rTXEjEmr:Z4TclcwED+7m+Afmr

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Music\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\WmiPrvSE.exe\", \"C:\\blockWin\\dwm.exe\", \"C:\\Windows\\CbsTemp\\Comagentrefhostmonitor.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Music\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\WmiPrvSE.exe\", \"C:\\blockWin\\dwm.exe\", \"C:\\Windows\\CbsTemp\\Comagentrefhostmonitor.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Music\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\WmiPrvSE.exe\", \"C:\\blockWin\\dwm.exe\", \"C:\\Windows\\CbsTemp\\Comagentrefhostmonitor.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\blockWin\\Comagentrefhostmonitor.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Music\\dwm.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Music\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\WmiPrvSE.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Music\\dwm.exe\", \"C:\\Users\\Admin\\Cookies\\WmiPrvSE.exe\", \"C:\\blockWin\\dwm.exe\""	Comagentrefhostmonitor.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3140	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	4144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	4144	schtasks.exe	93

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1940	powershell.exe
1188	powershell.exe
4236	powershell.exe
3972	powershell.exe
1368	powershell.exe
1404	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Comagentrefhostmonitor.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 14 IoCs

pid	Process
2800	Comagentrefhostmonitor.exe
912	dwm.exe
4312	dwm.exe
2156	dwm.exe
2932	dwm.exe
3816	dwm.exe
832	dwm.exe
3808	dwm.exe
4896	dwm.exe
2452	dwm.exe
2752	dwm.exe
244	dwm.exe
3144	dwm.exe
2372	dwm.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Music\\dwm.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Music\\dwm.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Admin\\Cookies\\WmiPrvSE.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comagentrefhostmonitor = "\"C:\\Windows\\CbsTemp\\Comagentrefhostmonitor.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comagentrefhostmonitor = "\"C:\\blockWin\\Comagentrefhostmonitor.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comagentrefhostmonitor = "\"C:\\blockWin\\Comagentrefhostmonitor.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Admin\\Cookies\\WmiPrvSE.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\blockWin\\dwm.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\blockWin\\dwm.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comagentrefhostmonitor = "\"C:\\Windows\\CbsTemp\\Comagentrefhostmonitor.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	Comagentrefhostmonitor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	Comagentrefhostmonitor.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ipinfo.io
13	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCEF1BD295AE11480BB56991342E61DBCA.TMP	csc.exe
File created	\??\c:\Windows\System32\ewkptm.exe	csc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\CbsTemp\Comagentrefhostmonitor.exe	Comagentrefhostmonitor.exe
File created	C:\Windows\CbsTemp\510806c03f1b9a	Comagentrefhostmonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4424	PING.EXE
3088	PING.EXE
4500	PING.EXE
2640	PING.EXE
1932	PING.EXE
1724	PING.EXE

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	Comagentrefhostmonitor.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	dwm.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
2640	PING.EXE
1932	PING.EXE
1724	PING.EXE
4424	PING.EXE
3088	PING.EXE
4500	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4180	schtasks.exe
2828	schtasks.exe
4484	schtasks.exe
3588	schtasks.exe
3004	schtasks.exe
4580	schtasks.exe
3384	schtasks.exe
4372	schtasks.exe
4620	schtasks.exe
4532	schtasks.exe
3444	schtasks.exe
4388	schtasks.exe
2364	schtasks.exe
2916	schtasks.exe
3672	schtasks.exe
3664	schtasks.exe
3140	schtasks.exe
4428	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe
2800	Comagentrefhostmonitor.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	Comagentrefhostmonitor.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	1188	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	4236	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	912	dwm.exe
Token: SeDebugPrivilege	4312	dwm.exe
Token: SeDebugPrivilege	2156	dwm.exe
Token: SeDebugPrivilege	2932	dwm.exe
Token: SeDebugPrivilege	3816	dwm.exe
Token: SeDebugPrivilege	832	dwm.exe
Token: SeDebugPrivilege	3808	dwm.exe
Token: SeDebugPrivilege	4896	dwm.exe
Token: SeDebugPrivilege	2452	dwm.exe
Token: SeDebugPrivilege	2752	dwm.exe
Token: SeDebugPrivilege	244	dwm.exe
Token: SeDebugPrivilege	3144	dwm.exe
Token: SeDebugPrivilege	2372	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 8	4920	e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe	84
PID 4920 wrote to memory of 8	4920	e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe	84
PID 4920 wrote to memory of 8	4920	e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe	84
PID 8 wrote to memory of 4384	8	WScript.exe	95
PID 8 wrote to memory of 4384	8	WScript.exe	95
PID 8 wrote to memory of 4384	8	WScript.exe	95
PID 4384 wrote to memory of 2800	4384	cmd.exe	97
PID 4384 wrote to memory of 2800	4384	cmd.exe	97
PID 2800 wrote to memory of 2020	2800	Comagentrefhostmonitor.exe	103
PID 2800 wrote to memory of 2020	2800	Comagentrefhostmonitor.exe	103
PID 2020 wrote to memory of 2824	2020	csc.exe	105
PID 2020 wrote to memory of 2824	2020	csc.exe	105
PID 2800 wrote to memory of 1404	2800	Comagentrefhostmonitor.exe	122
PID 2800 wrote to memory of 1404	2800	Comagentrefhostmonitor.exe	122
PID 2800 wrote to memory of 1368	2800	Comagentrefhostmonitor.exe	123
PID 2800 wrote to memory of 1368	2800	Comagentrefhostmonitor.exe	123
PID 2800 wrote to memory of 3972	2800	Comagentrefhostmonitor.exe	124
PID 2800 wrote to memory of 3972	2800	Comagentrefhostmonitor.exe	124
PID 2800 wrote to memory of 4236	2800	Comagentrefhostmonitor.exe	125
PID 2800 wrote to memory of 4236	2800	Comagentrefhostmonitor.exe	125
PID 2800 wrote to memory of 1188	2800	Comagentrefhostmonitor.exe	126
PID 2800 wrote to memory of 1188	2800	Comagentrefhostmonitor.exe	126
PID 2800 wrote to memory of 1940	2800	Comagentrefhostmonitor.exe	127
PID 2800 wrote to memory of 1940	2800	Comagentrefhostmonitor.exe	127
PID 2800 wrote to memory of 4344	2800	Comagentrefhostmonitor.exe	134
PID 2800 wrote to memory of 4344	2800	Comagentrefhostmonitor.exe	134
PID 4344 wrote to memory of 4312	4344	cmd.exe	136
PID 4344 wrote to memory of 4312	4344	cmd.exe	136
PID 4344 wrote to memory of 3088	4344	cmd.exe	140
PID 4344 wrote to memory of 3088	4344	cmd.exe	140
PID 4344 wrote to memory of 912	4344	cmd.exe	141
PID 4344 wrote to memory of 912	4344	cmd.exe	141
PID 912 wrote to memory of 1308	912	dwm.exe	143
PID 912 wrote to memory of 1308	912	dwm.exe	143
PID 1308 wrote to memory of 3404	1308	cmd.exe	145
PID 1308 wrote to memory of 3404	1308	cmd.exe	145
PID 1308 wrote to memory of 4500	1308	cmd.exe	146
PID 1308 wrote to memory of 4500	1308	cmd.exe	146
PID 1308 wrote to memory of 4312	1308	cmd.exe	150
PID 1308 wrote to memory of 4312	1308	cmd.exe	150
PID 4312 wrote to memory of 3004	4312	dwm.exe	152
PID 4312 wrote to memory of 3004	4312	dwm.exe	152
PID 3004 wrote to memory of 3052	3004	cmd.exe	154
PID 3004 wrote to memory of 3052	3004	cmd.exe	154
PID 3004 wrote to memory of 3016	3004	cmd.exe	155
PID 3004 wrote to memory of 3016	3004	cmd.exe	155
PID 3004 wrote to memory of 2156	3004	cmd.exe	158
PID 3004 wrote to memory of 2156	3004	cmd.exe	158
PID 2156 wrote to memory of 3972	2156	dwm.exe	160
PID 2156 wrote to memory of 3972	2156	dwm.exe	160
PID 3972 wrote to memory of 4704	3972	cmd.exe	162
PID 3972 wrote to memory of 4704	3972	cmd.exe	162
PID 3972 wrote to memory of 316	3972	cmd.exe	163
PID 3972 wrote to memory of 316	3972	cmd.exe	163
PID 3972 wrote to memory of 2932	3972	cmd.exe	165
PID 3972 wrote to memory of 2932	3972	cmd.exe	165
PID 2932 wrote to memory of 2036	2932	dwm.exe	167
PID 2932 wrote to memory of 2036	2932	dwm.exe	167
PID 2036 wrote to memory of 4372	2036	cmd.exe	169
PID 2036 wrote to memory of 4372	2036	cmd.exe	169
PID 2036 wrote to memory of 1124	2036	cmd.exe	170
PID 2036 wrote to memory of 1124	2036	cmd.exe	170
PID 2036 wrote to memory of 3816	2036	cmd.exe	172
PID 2036 wrote to memory of 3816	2036	cmd.exe	172

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe
"C:\Users\Admin\AppData\Local\Temp\e6799f5c6d46b85d714bbc3d2a36ebf9a2dbd9d83026ba6244c9c31ba741f954N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\blockWin\QczNALuWvOKdV5GMhjevKaFBtf1SKR43.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\blockWin\CUwZnCRbzO0L1SQ5kaGKXQS6kJiyEtx7efZNn9fMWQtXRSgTCWGRArJObrct.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\blockWin\Comagentrefhostmonitor.exe
      "C:\blockWin/Comagentrefhostmonitor.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k4fpjts2\k4fpjts2.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD33.tmp" "c:\Windows\System32\CSCEF1BD295AE11480BB56991342E61DBCA.TMP"
        6⤵
        
        PID:2824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Cookies\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockWin\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\Comagentrefhostmonitor.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockWin\Comagentrefhostmonitor.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FoHCCQ6KPa.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4344
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4312
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3088
      - C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DqZM2URRQk.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4500
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GJEc11R9oa.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3016
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\g9fdK0eS1C.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:316
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h2sGrcN1Zw.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4372
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1124
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mzBmoeLRKc.bat"
        15⤵
        
        PID:1412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1924
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\go28NrNAN1.bat"
        17⤵
        
        PID:3960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:760
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:3344
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HY3kVmQ00V.bat"
        19⤵
        
        PID:3968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2360
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2640
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BangdtZtLJ.bat"
        21⤵
        
        PID:4660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2692
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UE63U4pwcK.bat"
        23⤵
        
        PID:3412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2824
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4408
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xKIkDfuouO.bat"
        25⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1668
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1652
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PdP1UB7pUq.bat"
        27⤵
        
        PID:2864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1428
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1932
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CbjDYjSaFp.bat"
        29⤵
        
        PID:3100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2360
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1724
        
        C:\Users\Public\Music\dwm.exe
        
        "C:\Users\Public\Music\dwm.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sxRqhXCXyo.bat"
        31⤵
        
        PID:2636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Music\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Cookies\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Cookies\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\blockWin\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\blockWin\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\blockWin\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComagentrefhostmonitorC" /sc MINUTE /mo 14 /tr "'C:\Windows\CbsTemp\Comagentrefhostmonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Comagentrefhostmonitor" /sc ONLOGON /tr "'C:\Windows\CbsTemp\Comagentrefhostmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComagentrefhostmonitorC" /sc MINUTE /mo 7 /tr "'C:\Windows\CbsTemp\Comagentrefhostmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComagentrefhostmonitorC" /sc MINUTE /mo 7 /tr "'C:\blockWin\Comagentrefhostmonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Comagentrefhostmonitor" /sc ONLOGON /tr "'C:\blockWin\Comagentrefhostmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComagentrefhostmonitorC" /sc MINUTE /mo 14 /tr "'C:\blockWin\Comagentrefhostmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
7a7dd1e695790550e38cb160458687c9

SHA1
ca8425e79d183db9ba405e3a799c9b7592ed4618

SHA256
ced69c14422bf143608e1efb84c2131d5526cbc7203047ddd37337b9bf526fdb

SHA512
f3b621c8423a9cfe9409d16b80ac4225123a7cb9adddacbdd4f69c95375a9dc11aecc147d858eef50a44d7c3d517a2707e3fe6f1d8b7f0c6a35dd1e83daac3a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\BangdtZtLJ.bat

Filesize
205B

MD5
2ac3b0ee2b33033d94aa5b309af17c54

SHA1
5d8a3a940b7f0ef963bca6061f8e6ebe3cdf8d45

SHA256
3fc1686ea572744d5f3d2b99ba421d8ec2b9095824340e6f73e212af1b1ec6f8

SHA512
5f2c92e7b563e45a0f5778e23666fc93e8eaf82db1a5183f67f6336698d4ff23f70e6430b7a20e444ea218a7ac52abeddff81dcc28d3f2012189cb3b762e8780

Download Submit
C:\Users\Admin\AppData\Local\Temp\CbjDYjSaFp.bat

Filesize
157B

MD5
911271fdf8b94c23d26cb538761bff6c

SHA1
ed93ac4a4f68cc94c79bc5549174450b83add765

SHA256
cd053f69df09d2e2c2e3f6b892a8765168ab9c80669c93ca369c1f3ff5c8d8d0

SHA512
f47a0dd6c347b3a4fc3b42dfdfd0137f52be46ecc9984537e1bc39560565d834ea79896de781d2a6237fc265df2d797f22e3e4356ae29ede58a01a284b6b134a

Download Submit
C:\Users\Admin\AppData\Local\Temp\DqZM2URRQk.bat

Filesize
157B

MD5
ca85f2ae2ca8e338f905c8694d4a7f60

SHA1
33eb97ce989c333862059ca5117be2d0736efb57

SHA256
b275a80f6dfd7103721de2e36dab4822120e2486c12458cd85a375f0a9224dae

SHA512
e8289c5ace71ccaed637a354159b3fa40c44dde46b881c99ad6b72614d2eb41178c75e254f258e7f95c9f03f1350362e787b0845fbc1e7dc2ed2046a7c3c7f25

Download Submit
C:\Users\Admin\AppData\Local\Temp\FoHCCQ6KPa.bat

Filesize
157B

MD5
0ee599b95318b649e47832d7ae9388fa

SHA1
d1ec2c01b66ad766c63226e6a122a71618dae946

SHA256
5816495de13c00a58cc0a6de95d4f78d1cc5f59c83ab22b93aec779762fadc7b

SHA512
318aea9ebb41c72850c18f57a43fe363c08eb3b2937e88297b3e5d50a8f27a34648da6672908276aa2b9df88ab9671b33d8ba64bd89970c5a2e7171467d7f189

Download Submit
C:\Users\Admin\AppData\Local\Temp\GJEc11R9oa.bat

Filesize
205B

MD5
bf29005e82b9d15b55f141d0b195da8a

SHA1
cbbd1fcee5e8219e984c67b5a2feec6a8d5ad25f

SHA256
22d2f946db4b66f5f76202a3d40b65e0f4684e9b6099614a376cdb7d61df0a15

SHA512
e1c100578b861e3eff3511ef1ffbab1cd8d5673032ed54a145b33db0dd6eecf870b04db81928244a1f6bb7a54c1cb26f2b245e7f349d82ae774adad904e4fe03

Download Submit
C:\Users\Admin\AppData\Local\Temp\HY3kVmQ00V.bat

Filesize
157B

MD5
4dd7482a96e5147ec1958fb44b241ff4

SHA1
f8a26ced3fd9501cafc7fc8074578a30f05e4435

SHA256
195671781545f0b675ed3870cb6f9308b00381e59aa3682c9fca899921800d41

SHA512
4e13c61d5227f772831e6108e127206e669bff620142f341101abe672071080b6359c944fd7aa2bacb6a3a9ab5fde8cc363ddceb267034a8f6903d935bd7e1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\PdP1UB7pUq.bat

Filesize
157B

MD5
53025f5d57579b9a61bdd35c508bb8fc

SHA1
ea2f822b149947f6b75d48cd8be7a859bc21d570

SHA256
25ff7778a45d31ab321b0c19ab55e474207a20795180dfdc7735762a4d1b99e4

SHA512
60b16d0362b66eccf7dc8f94fbf1b7a5e9004bfe00531a030400cf756f2566792a25ab95474cabd19d993fb47a73eabfda61daec353d459dc15c2846905e2995

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCD33.tmp

Filesize
1KB

MD5
a5221ac7f9e547d4219f9bc125c192d3

SHA1
1e4f4a66545b0f6b78182995156086f61eb9df3b

SHA256
7316404e3d6dae61c7bd9cc4f6cdbe447be4e632c715a759e70e57ef4fa3d867

SHA512
a2e8f6c6da75e652fc9bcbae98d7cb0f81f5b41e9cdb4c14e9e3b2a628e9727595d51e322950cdb5f3c406d4190692b2ac3e7b3a96b447b8b83c9041511a4e0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UE63U4pwcK.bat

Filesize
205B

MD5
145d825549387244cc0cd4b0e3b4c18e

SHA1
986a33bcdbc06956e0576f77fcda65284da04f98

SHA256
4d858d5e02bfab1438d73b03c97a88eaa796623297b7963669e1ee67bbacae48

SHA512
40dd3c68d1aed532c88773d0ad54b3fc0c1876b8a5cd2b7f35c5c7f2f9004847fbeb013474284a2a3505c4cd17d3b580ae4301e22c55e3ae30624d9d30e31bb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zo0odsse.jta.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\g9fdK0eS1C.bat

Filesize
205B

MD5
e0f64b7d8954a8b70eb93393eebd08d7

SHA1
c05f78cdd5c9a7472e84abda4edab1531f7eeabd

SHA256
c9bb3ae199892ae52ca83532f20d1743874e94da84a70f393444eb0eae434bf9

SHA512
e5cb656a678648fd7a94a0f8bf29739fb7b84c8d8a801a5b6d8362351b03bf407cf1cc0b68ed5762554873754cdb7acda0c9630caee59c85b48c1d9d247b806b

Download Submit
C:\Users\Admin\AppData\Local\Temp\go28NrNAN1.bat

Filesize
205B

MD5
915152b732dffd9fb8768661403dd67e

SHA1
6627af715fd07bc6602990b6d389453650b87a5a

SHA256
acf39939a470f40cf3988c6f19705a51cbc90afebf3dd17aa1f0a6308130f09c

SHA512
e05e4391b259a6334226c174bee84ff78969d155e0f76d87d7c562b7256f4d2e28123acd27304b86ec677cc60c447745486b52a97863014fbd80ed21f1ca517d

Download Submit
C:\Users\Admin\AppData\Local\Temp\h2sGrcN1Zw.bat

Filesize
205B

MD5
ea6d094931369ef2e4107cac2defa4c5

SHA1
f2ffff2cd89650154c6d284fff04af1fc5c2ced5

SHA256
d2b291058cb2e82e79cb3ce66a9ddae3b5cd16961029e329a1602f7aad1b0590

SHA512
f9ecdb0558e9cf1296fd80af616a74ede33f3e1aaed94d3e3df1168bc2eca982dd768339a53700a6ae247461af26e16006c93280b344ca807ff275dd258d02ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\mzBmoeLRKc.bat

Filesize
205B

MD5
73f214fe24c1c9345284990de3e12683

SHA1
61c950c14f4b7c0f17455a346700be1f33ab7b14

SHA256
9cf5bf39147e25e5c7eec12cad4df6420496b811e8369b0e2eddd8ff065d5afc

SHA512
cd93888c6db6ce9a1fa060439bd5e4a6ce93c1a8fa685ab74cc0a3123f2d5666b3ed28fe563a40e1efc7f31bcc05ed1c40bf72d4dccbd7fa2079fee7e5a0806b

Download Submit
C:\Users\Admin\AppData\Local\Temp\sxRqhXCXyo.bat

Filesize
157B

MD5
22c75f71c69550fb150d440f2276f260

SHA1
91008385878794d2fa41e83febd15a6a29fa86ca

SHA256
ec1b6bda6607cb54f67a84433e3c8a9802db85433cad3d1db17cfd3b1502e059

SHA512
d56376817e47dcd87140369d277dbab9ea7d415f219bc670e5b6a91870119d97ec776a61977b663a3bc271a51e1edee5fc795ac95a9e3fcf4474a1c5bc4df659

Download Submit
C:\Users\Admin\AppData\Local\Temp\xKIkDfuouO.bat

Filesize
205B

MD5
e66fdc3d1d7ebc19845c0251e9b07cdd

SHA1
77049048e3e6c82ca3e25bb2e078c5427ef15312

SHA256
8a278cbfca219fa37dd08488dbef797c9068d887b80b5debe20506999b8b59ed

SHA512
e419310a2872604efd5ffb9c3fca5dd7488282d9d3fcdbc7184158567cdbc254068c88dee02c90d61e3e1c167cb20f8363ad82a206f4eca6a29aabf12c3a3227

Download Submit
C:\blockWin\CUwZnCRbzO0L1SQ5kaGKXQS6kJiyEtx7efZNn9fMWQtXRSgTCWGRArJObrct.bat

Filesize
83B

MD5
f078b29caca72c6428bfcaf55792c6cb

SHA1
fca4dd62839c1528e5a94e5919ce35e4fc40c1a7

SHA256
44f29540b36bfd51914e93e014e7a093c6b03e743d95828926f0e30c26fc4a91

SHA512
1d6a71a59e683e9af4d316b24aebd825f80b00cd1b35ae4c100e991b46ff9e246855fffee628ea52f652890e720544cc6401ef692ba688068955063eb5c714f5

Download Submit
C:\blockWin\Comagentrefhostmonitor.exe

Filesize
1.9MB

MD5
a19401a25e01b8d445cbf8ea44e3afc8

SHA1
0b07e166c910b8ad804ead6ff773567c9c294f6b

SHA256
e9a8f5dfb353acce92b0ff5ebaaa45e7089f51336b356d78dc6bdb1b70df25b1

SHA512
4aa2ba3196df2bf749136eaa43a202ef19bd479d8553730dba530ced71954a521a524cf8d3871141a3f203d29830927c5db39aa96e147673b60b85c5b595edff

Download Submit
C:\blockWin\QczNALuWvOKdV5GMhjevKaFBtf1SKR43.vbe

Filesize
246B

MD5
9314b628cc986c5564f4833d34bdc013

SHA1
8fea451199337e6c51e2d5b9e2863ced636bb26a

SHA256
03f87dddda939712917dc97d565a36c5d8e60daa960e4abb1b13844052bfd6f2

SHA512
efb1b56afd3e1b35286e74805176145d258dd04ae91b804dae14dde11d12e6bc57d78899f5f9c6c02a779bc6df7c9949ce5c30477949f7fd64c57d975aac73b4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\k4fpjts2\k4fpjts2.0.cs

Filesize
361B

MD5
bb0acf9fb8a72526c397740161b7b812

SHA1
dbccbe74beee2384899191be832ca772f9d4799e

SHA256
941571a48c8dea4864f10f29d43fdf9a4d6deb012d324336eea010d258506b17

SHA512
e7399060ca682d089aac4ed1a76c8dc08826c627b83c429992b34712710935490c71915300c247803b14daf77e4b72e342e1be0a7ff33c328195267eaf7b1aae

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\k4fpjts2\k4fpjts2.cmdline

Filesize
235B

MD5
dc46211a445e94162bcc70a4713beb12

SHA1
0dc5c2e7c7de0376d803090a2f38a59307c0ffd0

SHA256
4980362e1a3544f16b6730ff7ecaf9c5036d98c30029782f808d0ceb7753d067

SHA512
9e0cd2c9427e88ddcb51e6d545eca7742e86fb25f13256a948ada738b1d0050f3e7384fcef9cbb33e3d68ad1c3b5dd52e83ab55d4acd58d031d2302bcfa9a813

Download Submit
\??\c:\Windows\System32\CSCEF1BD295AE11480BB56991342E61DBCA.TMP

Filesize
1KB

MD5
be99f41194f5159cc131a1a4353a0e0a

SHA1
f24e3bf06e777b4de8d072166cff693e43f2295c

SHA256
564d9051e5639603c83562a9ff2c2e478cc7e13d54faf39f761297bac78603bf

SHA512
51d1a50772bb7d689193e6a9b2e363185cf5438103644b2b68cf13e08274c5d99407b99f8cdc856143d28669f5ee4ee316041a8e33df42f55bfd181aa3f3c0f5

Download Submit
memory/244-270-0x000000001CA50000-0x000000001CB1D000-memory.dmp

Filesize
820KB

Download
memory/832-205-0x000000001C180000-0x000000001C24D000-memory.dmp

Filesize
820KB

Download
memory/912-139-0x000000001B3F0000-0x000000001B4BD000-memory.dmp

Filesize
820KB

Download
memory/1368-59-0x0000021D5E290000-0x0000021D5E2B2000-memory.dmp

Filesize
136KB

Download
memory/2156-166-0x000000001CA60000-0x000000001CB2D000-memory.dmp

Filesize
820KB

Download
memory/2372-296-0x000000001C230000-0x000000001C2FD000-memory.dmp

Filesize
820KB

Download
memory/2452-244-0x000000001CE60000-0x000000001CF2D000-memory.dmp

Filesize
820KB

Download
memory/2752-257-0x000000001BC50000-0x000000001BD1D000-memory.dmp

Filesize
820KB

Download
memory/2800-22-0x0000000003000000-0x000000000300C000-memory.dmp

Filesize
48KB

Download
memory/2800-65-0x000000001C050000-0x000000001C11D000-memory.dmp

Filesize
820KB

Download
memory/2800-12-0x00007FFBAB623000-0x00007FFBAB625000-memory.dmp

Filesize
8KB

Download
memory/2800-26-0x0000000003040000-0x000000000304C000-memory.dmp

Filesize
48KB

Download
memory/2800-13-0x0000000000BE0000-0x0000000000DC6000-memory.dmp

Filesize
1.9MB

Download
memory/2800-20-0x000000001BA30000-0x000000001BA48000-memory.dmp

Filesize
96KB

Download
memory/2800-15-0x00000000016B0000-0x00000000016BE000-memory.dmp

Filesize
56KB

Download
memory/2800-18-0x000000001BF00000-0x000000001BF50000-memory.dmp

Filesize
320KB

Download
memory/2800-24-0x0000000003010000-0x0000000003018000-memory.dmp

Filesize
32KB

Download
memory/2800-17-0x0000000003020000-0x000000000303C000-memory.dmp

Filesize
112KB

Download
memory/2932-179-0x000000001C3A0000-0x000000001C46D000-memory.dmp

Filesize
820KB

Download
memory/3144-283-0x000000001C2E0000-0x000000001C3AD000-memory.dmp

Filesize
820KB

Download
memory/3808-218-0x000000001CBC0000-0x000000001CC8D000-memory.dmp

Filesize
820KB

Download
memory/3816-192-0x000000001CFA0000-0x000000001D06D000-memory.dmp

Filesize
820KB

Download
memory/4312-153-0x000000001C500000-0x000000001C5CD000-memory.dmp

Filesize
820KB

Download
memory/4896-231-0x000000001C5E0000-0x000000001C6AD000-memory.dmp

Filesize
820KB

Download