dcrat | e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38924c8184bf5944da2ac3e5cd987da2.exe
Size

2.0MB
MD5

38924c8184bf5944da2ac3e5cd987da2
SHA1

1af0d4b729dd9c3a42c197a4ec961cab5722adda
SHA256

e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908
SHA512

225e25eb08a1abe529a4fc5eb435eb800145a782e3dbdd6ba1c28925f84d758c18111ed181649bd222d50fd4a44f1ede7e43c630a58ae9a92fd2074d3d306a61
SSDEEP

24576:FcBmS1nneRYZwoKBU7ArlQUCeYIxerW33/XfV6jx9aP5VR/z0WcBS4bppmHVSqyW:9S4/ST6xijxsBEmHVSqFHOHqnCgXu8

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\dwm.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\8.0.2\\lsass.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\8.0.2\\lsass.exe\", \"C:\\Users\\Default\\Music\\lsass.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\8.0.2\\lsass.exe\", \"C:\\Users\\Default\\Music\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\8.0.2\\lsass.exe\", \"C:\\Users\\Default\\Music\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\", \"C:\\Users\\All Users\\decCD14.tmp.exe\""	decCD14.tmp

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	3680	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	3680	schtasks.exe	90

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x000c000000023b1b-2.dat	family_dcrat_v2
behavioral2/memory/228-4-0x0000000000540000-0x00000000006F6000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3192	powershell.exe
2428	powershell.exe
3288	powershell.exe
2836	powershell.exe
2088	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	decCD14.tmp

Executes dropped EXE 2 IoCs

pid	Process
228	decCD14.tmp
2824	lsass.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\8.0.2\\lsass.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\8.0.2\\lsass.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decCD14.tmp = "\"C:\\Users\\All Users\\decCD14.tmp.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\All Users\\dwm.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\All Users\\dwm.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Portable Devices\\csrss.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\decCD14.tmp = "\"C:\\Users\\All Users\\decCD14.tmp.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\Music\\lsass.exe\""	decCD14.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\Music\\lsass.exe\""	decCD14.tmp

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC26027D7A69A64BAABD5E10CBB4AC13F6.TMP	csc.exe
File created	\??\c:\Windows\System32\ljh0xx.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\lsass.exe	decCD14.tmp
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\6203df4a6bafc7	decCD14.tmp
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	decCD14.tmp
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	decCD14.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	decCD14.tmp

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1968	schtasks.exe
2736	schtasks.exe
2504	schtasks.exe
3800	schtasks.exe
4516	schtasks.exe
3280	schtasks.exe
3296	schtasks.exe
2192	schtasks.exe
3940	schtasks.exe
4968	schtasks.exe
2004	schtasks.exe
2824	schtasks.exe
4648	schtasks.exe
2032	schtasks.exe
4876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp
228	decCD14.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	lsass.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	decCD14.tmp
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2824	lsass.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	lsass.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 228	3468	38924c8184bf5944da2ac3e5cd987da2.exe	83
PID 3468 wrote to memory of 228	3468	38924c8184bf5944da2ac3e5cd987da2.exe	83
PID 228 wrote to memory of 2220	228	decCD14.tmp	94
PID 228 wrote to memory of 2220	228	decCD14.tmp	94
PID 2220 wrote to memory of 464	2220	csc.exe	96
PID 2220 wrote to memory of 464	2220	csc.exe	96
PID 228 wrote to memory of 2088	228	decCD14.tmp	109
PID 228 wrote to memory of 2088	228	decCD14.tmp	109
PID 228 wrote to memory of 3192	228	decCD14.tmp	110
PID 228 wrote to memory of 3192	228	decCD14.tmp	110
PID 228 wrote to memory of 2428	228	decCD14.tmp	111
PID 228 wrote to memory of 2428	228	decCD14.tmp	111
PID 228 wrote to memory of 3288	228	decCD14.tmp	112
PID 228 wrote to memory of 3288	228	decCD14.tmp	112
PID 228 wrote to memory of 2836	228	decCD14.tmp	113
PID 228 wrote to memory of 2836	228	decCD14.tmp	113
PID 228 wrote to memory of 392	228	decCD14.tmp	119
PID 228 wrote to memory of 392	228	decCD14.tmp	119
PID 392 wrote to memory of 2372	392	cmd.exe	121
PID 392 wrote to memory of 2372	392	cmd.exe	121
PID 392 wrote to memory of 348	392	cmd.exe	122
PID 392 wrote to memory of 348	392	cmd.exe	122
PID 392 wrote to memory of 2824	392	cmd.exe	126
PID 392 wrote to memory of 2824	392	cmd.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\38924c8184bf5944da2ac3e5cd987da2.exe
"C:\Users\Admin\AppData\Local\Temp\38924c8184bf5944da2ac3e5cd987da2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\decCD14.tmp
  C:\Users\Admin\AppData\Local\Temp\decCD14.tmp
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wrhljobn\wrhljobn.cmdline"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEAAE.tmp" "c:\Windows\System32\CSC26027D7A69A64BAABD5E10CBB4AC13F6.TMP"
      4⤵
      PID:464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\dwm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\lsass.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Music\lsass.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\decCD14.tmp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cFBKPpI11b.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2372
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:348
  - - C:\Users\Default\Music\lsass.exe
      "C:\Users\Default\Music\lsass.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Music\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\Music\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Music\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "decCD14.tmpd" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\decCD14.tmp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "decCD14.tmp" /sc ONLOGON /tr "'C:\Users\All Users\decCD14.tmp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "decCD14.tmpd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\decCD14.tmp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEAAE.tmp

Filesize
1KB

MD5
f7fa93696d57f37267ad3ea3b5274da8

SHA1
5149c9916e85adb83de48811452efea3ce0287bc

SHA256
4c09ef67047d021cb6c36ce1695af117aeab9092c5200d933ca3a457ac2e7105

SHA512
addbd801e915c3409cf7b9f88580f18ff3f24b46125f42adbabb35a844fe49422b4f5b0d9ab82df75f9ffc8cd8ff50a15d041a4a1d2228faec5c3ce469a15e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_outmzgxb.3j2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cFBKPpI11b.bat

Filesize
208B

MD5
3dfc96acefd79cf0c96f99b785a8d8ab

SHA1
4ae46c476b5fe5f964ebba8181deaf3de9003777

SHA256
ed2da0df65cc2220634874934a71c1027eafd59566cb9aaa8998a18b50dd1e73

SHA512
fe626d82fbce961e09f964a787317232a25fbc8c664e634d8219266e52a35970388cc91fa66fb447bb06ed8847495faaeeb53236413131d0fb831826cb129c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\decCD14.tmp

Filesize
1.7MB

MD5
37d00592110ca3cc53b7f6ca6ab1c82a

SHA1
86e13c84c33969081fe59d123e3cf81e9b3e5674

SHA256
5acd08cc77f1cebd2cb95f88b37edf94b9e72b9b1c965af7ea2766e9ddc5afb9

SHA512
618eeaec0ac5390184a3b6195634cb16d3def1d2ac8ab3664b3128a4e4776dda7777e6c2aedf138a6f8e9b7f6f84fc58c38f89d9178b220443567e0c55e0bbcd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wrhljobn\wrhljobn.0.cs

Filesize
358B

MD5
237d5a4aee30890794fde03aa1d8892f

SHA1
ccfaf19a4701f2b8f566fba3202ef7df9e8d0d8b

SHA256
5f7d61ee85a7f8087d1f893871250e7d0eecbea3f5cba57b42ee20ea12e46fa9

SHA512
2d3b1a754eb94e1fadc92ca799d37c746bd3db9824f6f7489b9bf39d484526db8ad9b8fdd92f98197f9a9122aa8fedcef2dc556fbb363b905983bec060392159

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wrhljobn\wrhljobn.cmdline

Filesize
235B

MD5
b24880ec99ff449b40e5b357e7a2062c

SHA1
4b5f52329ba3a0c934bf50d17d5f48c0db8fccbc

SHA256
9490f44b060a548e83e01e0f6f951f2a3d8b5a3e9634080c8596208e897ee8a8

SHA512
99892c06936f9b37ac4db5df0f5971f68b891410279c6497023d0acfadbef2080236337578507f5813e918ab586ee83669f5cadb3e571a2c6b88aa99b21b086b

Download Submit
\??\c:\Windows\System32\CSC26027D7A69A64BAABD5E10CBB4AC13F6.TMP

Filesize
1KB

MD5
2fd2b90e7053b01e6af25701a467eb1f

SHA1
68801a13cebba82c24f67a9d7c886fcefcf01a51

SHA256
12b900db56a20f01f0f1d65f46933971415d5b5675e59e8b02b3dae12aaa1527

SHA512
081d3a621e3664709867f3fdd82808364978f896fb007c0c8e6c8dfe25f2f2b8d37c9e0b2e4fb51c90bc6f691507b569e5d841ef3ca3bd38bd6adda2d30f32af

Download Submit
memory/228-20-0x0000000002690000-0x000000000269C000-memory.dmp

Filesize
48KB

Download
memory/228-48-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-25-0x000000001B1D0000-0x000000001B1DC000-memory.dmp

Filesize
48KB

Download
memory/228-24-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-27-0x000000001B3D0000-0x000000001B3E2000-memory.dmp

Filesize
72KB

Download
memory/228-28-0x000000001B920000-0x000000001BE48000-memory.dmp

Filesize
5.2MB

Download
memory/228-30-0x000000001B330000-0x000000001B33E000-memory.dmp

Filesize
56KB

Download
memory/228-32-0x000000001B390000-0x000000001B39C000-memory.dmp

Filesize
48KB

Download
memory/228-34-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Filesize
64KB

Download
memory/228-35-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-37-0x000000001B450000-0x000000001B4AA000-memory.dmp

Filesize
360KB

Download
memory/228-38-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-42-0x000000001B400000-0x000000001B40E000-memory.dmp

Filesize
56KB

Download
memory/228-44-0x000000001B430000-0x000000001B448000-memory.dmp

Filesize
96KB

Download
memory/228-47-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-46-0x000000001B410000-0x000000001B41C000-memory.dmp

Filesize
48KB

Download
memory/228-40-0x000000001B3F0000-0x000000001B400000-memory.dmp

Filesize
64KB

Download
memory/228-22-0x000000001B3B0000-0x000000001B3C2000-memory.dmp

Filesize
72KB

Download
memory/228-49-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-50-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-11-0x000000001B340000-0x000000001B390000-memory.dmp

Filesize
320KB

Download
memory/228-18-0x0000000002680000-0x000000000268E000-memory.dmp

Filesize
56KB

Download
memory/228-13-0x00000000026D0000-0x00000000026E8000-memory.dmp

Filesize
96KB

Download
memory/228-14-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-4-0x0000000000540000-0x00000000006F6000-memory.dmp

Filesize
1.7MB

Download
memory/228-16-0x0000000002670000-0x000000000267E000-memory.dmp

Filesize
56KB

Download
memory/228-97-0x000000001C250000-0x000000001C29E000-memory.dmp

Filesize
312KB

Download
memory/228-98-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/228-5-0x00007FFEBA843000-0x00007FFEBA845000-memory.dmp

Filesize
8KB

Download
memory/228-10-0x00000000026B0000-0x00000000026CC000-memory.dmp

Filesize
112KB

Download
memory/228-8-0x0000000002660000-0x000000000266E000-memory.dmp

Filesize
56KB

Download
memory/228-6-0x00007FFEBA840000-0x00007FFEBB301000-memory.dmp

Filesize
10.8MB

Download
memory/2824-159-0x000000001F500000-0x000000001F54E000-memory.dmp

Filesize
312KB

Download
memory/2824-199-0x000000001F650000-0x000000001F7A6000-memory.dmp

Filesize
1.3MB

Download
memory/2836-82-0x0000027D78BE0000-0x0000027D78C02000-memory.dmp

Filesize
136KB

Download
memory/3468-122-0x0000000000400000-0x000000000060C000-memory.dmp

Filesize
2.0MB

Download