dcrat | e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-11-2024 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe
Size

2.0MB
MD5

38924c8184bf5944da2ac3e5cd987da2
SHA1

1af0d4b729dd9c3a42c197a4ec961cab5722adda
SHA256

e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908
SHA512

225e25eb08a1abe529a4fc5eb435eb800145a782e3dbdd6ba1c28925f84d758c18111ed181649bd222d50fd4a44f1ede7e43c630a58ae9a92fd2074d3d306a61
SSDEEP

24576:FcBmS1nneRYZwoKBU7ArlQUCeYIxerW33/XfV6jx9aP5VR/z0WcBS4bppmHVSqyW:9S4/ST6xijxsBEmHVSqFHOHqnCgXu8

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SppExtComObj.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Uninstall Information\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\SppExtComObj.exe\", \"C:\\Windows\\System32\\ta-lk\\TextInputHost.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\upfc.exe\""	dec7F03.tmp

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	1356	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1356	schtasks.exe	87

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d000000023b89-2.dat	family_dcrat_v2
behavioral2/memory/516-5-0x0000000000B40000-0x0000000000CF6000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3644	powershell.exe
1868	powershell.exe
3976	powershell.exe
3408	powershell.exe
1724	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	dec7F03.tmp

Executes dropped EXE 2 IoCs

pid	Process
516	dec7F03.tmp
2420	upfc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\System32\\ta-lk\\TextInputHost.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Uninstall Information\\SearchApp.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Uninstall Information\\SearchApp.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Portable Devices\\SppExtComObj.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\System32\\ta-lk\\TextInputHost.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Windows Portable Devices\\SppExtComObj.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	dec7F03.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	dec7F03.tmp

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\ta-lk\TextInputHost.exe	dec7F03.tmp
File created	C:\Windows\System32\ta-lk\22eafd247d37c3	dec7F03.tmp
File created	\??\c:\Windows\System32\CSCC87C277DC65247EDA5FB28A414DF4631.TMP	csc.exe
File created	\??\c:\Windows\System32\s_kgxh.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\SearchApp.exe	dec7F03.tmp
File created	C:\Program Files\Uninstall Information\38384e6a620884	dec7F03.tmp
File created	C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe	dec7F03.tmp
File created	C:\Program Files (x86)\Windows Portable Devices\e1ef82546f0b02	dec7F03.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System\Speech\RuntimeBroker.exe	dec7F03.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3584	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	dec7F03.tmp

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3584	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2920	schtasks.exe
3560	schtasks.exe
372	schtasks.exe
2256	schtasks.exe
4952	schtasks.exe
1892	schtasks.exe
4608	schtasks.exe
2700	schtasks.exe
2276	schtasks.exe
628	schtasks.exe
1696	schtasks.exe
3108	schtasks.exe
4336	schtasks.exe
2240	schtasks.exe
2196	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp
516	dec7F03.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	upfc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	516	dec7F03.tmp
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	2420	upfc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2420	upfc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 516	5088	e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe	83
PID 5088 wrote to memory of 516	5088	e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe	83
PID 516 wrote to memory of 5060	516	dec7F03.tmp	91
PID 516 wrote to memory of 5060	516	dec7F03.tmp	91
PID 5060 wrote to memory of 2636	5060	csc.exe	93
PID 5060 wrote to memory of 2636	5060	csc.exe	93
PID 516 wrote to memory of 3644	516	dec7F03.tmp	106
PID 516 wrote to memory of 3644	516	dec7F03.tmp	106
PID 516 wrote to memory of 1868	516	dec7F03.tmp	107
PID 516 wrote to memory of 1868	516	dec7F03.tmp	107
PID 516 wrote to memory of 3976	516	dec7F03.tmp	108
PID 516 wrote to memory of 3976	516	dec7F03.tmp	108
PID 516 wrote to memory of 3408	516	dec7F03.tmp	109
PID 516 wrote to memory of 3408	516	dec7F03.tmp	109
PID 516 wrote to memory of 1724	516	dec7F03.tmp	110
PID 516 wrote to memory of 1724	516	dec7F03.tmp	110
PID 516 wrote to memory of 3152	516	dec7F03.tmp	115
PID 516 wrote to memory of 3152	516	dec7F03.tmp	115
PID 3152 wrote to memory of 2120	3152	cmd.exe	118
PID 3152 wrote to memory of 2120	3152	cmd.exe	118
PID 3152 wrote to memory of 3584	3152	cmd.exe	119
PID 3152 wrote to memory of 3584	3152	cmd.exe	119
PID 3152 wrote to memory of 2420	3152	cmd.exe	126
PID 3152 wrote to memory of 2420	3152	cmd.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe
"C:\Users\Admin\AppData\Local\Temp\e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\dec7F03.tmp
  C:\Users\Admin\AppData\Local\Temp\dec7F03.tmp
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bqrgljkw\bqrgljkw.cmdline"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F30.tmp" "c:\Windows\System32\CSCC87C277DC65247EDA5FB28A414DF4631.TMP"
      4⤵
      PID:2636
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\SearchApp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Idle.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\ta-lk\TextInputHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fsE37xrXdy.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2120
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3584
  - - C:\Recovery\WindowsRE\upfc.exe
      "C:\Recovery\WindowsRE\upfc.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\System32\ta-lk\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\System32\ta-lk\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Windows\System32\ta-lk\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1f8b23cd03fdfb5d4559ac10c445b89f

SHA1
cea378877687b1967095d5237e3c0111929f012d

SHA256
f1bb0869c1d26c4282aa06a4840a9ca86e9145c136af42bb85b6d2e77e684551

SHA512
3ffe559e174f4706d3e7681f0d88d53dfde5eef56ee5005ccf7b3036a5d6ba85e02fa4d0cb213d237afcb894d79fbe673b18f986f57db2904558f447e42fe550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8F30.tmp

Filesize
1KB

MD5
2e47dcaded87c9300509c11440bbbd14

SHA1
94cb259e12d0fb6b5752b82d6e2878ba2b1a8d90

SHA256
449506c381918b2ab7a4ce9dab3777a1580ea7ace5e72dc72ea6d55ad46ab926

SHA512
d4ae5e439a4f73dd742473f39d0dbaa642f42c481ca57f23e124309ffbcd43c0b1df9f051c64ad9343c49a63847082f2d19a4647072f013f460f2848ade7e9c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xwmgwpgj.d2a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dec7F03.tmp

Filesize
1.7MB

MD5
37d00592110ca3cc53b7f6ca6ab1c82a

SHA1
86e13c84c33969081fe59d123e3cf81e9b3e5674

SHA256
5acd08cc77f1cebd2cb95f88b37edf94b9e72b9b1c965af7ea2766e9ddc5afb9

SHA512
618eeaec0ac5390184a3b6195634cb16d3def1d2ac8ab3664b3128a4e4776dda7777e6c2aedf138a6f8e9b7f6f84fc58c38f89d9178b220443567e0c55e0bbcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fsE37xrXdy.bat

Filesize
158B

MD5
33fa14681c02ca49f61738b8b66af844

SHA1
b1b74b2fa56c61644c580e5df8fa1eef0b471f61

SHA256
33b56a2db2f77d5d95e16079efcc53c990bac78e5f5a40a380a3f620ba47265c

SHA512
2434d7f0cee4e25b43024feefba21fc44de87dbda5d8658081297f316c7ba69ba438da75bdbfa39fe5829128ee25657e9da46445b1a4e460d1f69aa4ada4508d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bqrgljkw\bqrgljkw.0.cs

Filesize
362B

MD5
099b3b8baea0ba846bd58d9bf86b6c44

SHA1
0a9280da6c17d9c23e880e6369d3d2354da143df

SHA256
7525297f41ba4d641273efc258c133fa7d3259de2a367b957757fc0056e6829c

SHA512
579af6f5809c13bfac22176525878295cefa1d2e57e472e447d4fdaade9da1d67e332949898611f34b2025eb9303218bd2b9b4b83773965e9840bd6ef68a4dc0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bqrgljkw\bqrgljkw.cmdline

Filesize
235B

MD5
4d8779a943c81c3a1efae6b570f4b0ad

SHA1
be8f046232c9052d7a6e48a0f63ed4d6441f0f2b

SHA256
8b0383a3f7525eace08a3409e6e14b7b4875bd2ef4ca485e48a88035654cc43f

SHA512
ac2f15b5b109b48665f9f0b256e726009581bcc8ba1ebe7c1b2e2f33706844f528f58ad26d8f373e5c5bed6ea89fbe53597fcf61914dc5e0bf29b0cc5407e38b

Download Submit
\??\c:\Windows\System32\CSCC87C277DC65247EDA5FB28A414DF4631.TMP

Filesize
1KB

MD5
634e281a00b7b9f516c3048badfa1530

SHA1
af6369715ce2fe9b99609e470d4f66698880a35a

SHA256
0d990336ae793f3f6903048004c8d707d7a7191927bd7df46b7fe887116506c8

SHA512
1cb35fa0759f5362c9c7eee5546710874121005a3924bcfec2cf33ac90a257a807ce7ec0db7bc84dcb327604d708009449c34f52560ed936b54eeba49be7d27b

Download Submit
memory/516-19-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-44-0x000000001B900000-0x000000001B90E000-memory.dmp

Filesize
56KB

Download
memory/516-23-0x000000001B880000-0x000000001B892000-memory.dmp

Filesize
72KB

Download
memory/516-26-0x000000001B860000-0x000000001B86C000-memory.dmp

Filesize
48KB

Download
memory/516-25-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-28-0x000000001B8C0000-0x000000001B8D2000-memory.dmp

Filesize
72KB

Download
memory/516-30-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-32-0x000000001B870000-0x000000001B87E000-memory.dmp

Filesize
56KB

Download
memory/516-29-0x000000001BE30000-0x000000001C358000-memory.dmp

Filesize
5.2MB

Download
memory/516-34-0x000000001B8A0000-0x000000001B8AC000-memory.dmp

Filesize
48KB

Download
memory/516-35-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-37-0x000000001B8B0000-0x000000001B8C0000-memory.dmp

Filesize
64KB

Download
memory/516-39-0x000000001B960000-0x000000001B9BA000-memory.dmp

Filesize
360KB

Download
memory/516-40-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-42-0x000000001B8E0000-0x000000001B8F0000-memory.dmp

Filesize
64KB

Download
memory/516-45-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-47-0x000000001B930000-0x000000001B948000-memory.dmp

Filesize
96KB

Download
memory/516-21-0x0000000002E90000-0x0000000002E9C000-memory.dmp

Filesize
48KB

Download
memory/516-50-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-49-0x000000001B910000-0x000000001B91C000-memory.dmp

Filesize
48KB

Download
memory/516-18-0x0000000002E80000-0x0000000002E8E000-memory.dmp

Filesize
56KB

Download
memory/516-16-0x00000000014C0000-0x00000000014CE000-memory.dmp

Filesize
56KB

Download
memory/516-14-0x0000000002ED0000-0x0000000002EE8000-memory.dmp

Filesize
96KB

Download
memory/516-12-0x000000001B810000-0x000000001B860000-memory.dmp

Filesize
320KB

Download
memory/516-11-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-4-0x00007FF82BE53000-0x00007FF82BE55000-memory.dmp

Filesize
8KB

Download
memory/516-88-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/516-5-0x0000000000B40000-0x0000000000CF6000-memory.dmp

Filesize
1.7MB

Download
memory/516-10-0x0000000002EB0000-0x0000000002ECC000-memory.dmp

Filesize
112KB

Download
memory/516-8-0x00000000014B0000-0x00000000014BE000-memory.dmp

Filesize
56KB

Download
memory/516-6-0x00007FF82BE50000-0x00007FF82C911000-memory.dmp

Filesize
10.8MB

Download
memory/2420-158-0x000000001C110000-0x000000001C225000-memory.dmp

Filesize
1.1MB

Download
memory/3408-86-0x0000020C29EF0000-0x0000020C29F12000-memory.dmp

Filesize
136KB

Download
memory/5088-125-0x0000000000400000-0x000000000060C000-memory.dmp

Filesize
2.0MB

Download