dcrat | 4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-11-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cc23344d26c44260cb52028cff992b7.exe
Size

1.9MB
MD5

4cc23344d26c44260cb52028cff992b7
SHA1

7f2b7a02ae3f65c6757f134a79c302a92e31311c
SHA256

4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609
SHA512

71e7ced9568ede15e9a9fe6edbd7ed77559f9046e8fc77ce83bb3fd464c61794ba719451774b2c02f30abc80a51f3563a1491a74d7f390d8152cd0b3b2928c45
SSDEEP

49152:UbA30IKxSrOw6FNapB0LFyYsyqX96ZU8jMWg3:UberOGpaMYducjM3

Score

10^/10

dcrat discovery evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2616	schtasks.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2616	schtasks.exe	36

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

csrss.exeBlockreview.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Blockreview.exe

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/files/0x0007000000016de4-17.dat	dcrat
behavioral1/memory/2824-18-0x0000000001150000-0x00000000012F0000-memory.dmp	dcrat
behavioral1/memory/676-52-0x00000000008A0000-0x0000000000A40000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

Processes:

Blockreview.execsrss.exe

pid	Process
2824	Blockreview.exe
676	csrss.exe

Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid	Process
2680	cmd.exe
2680	cmd.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Blockreview.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Blockreview.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blockreview.exe

Drops file in Program Files directory 2 IoCs

Processes:

Blockreview.exe

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lsass.exe	Blockreview.exe
File created	C:\Program Files\Java\jdk1.7.0_80\6203df4a6bafc7	Blockreview.exe

Drops file in Windows directory 4 IoCs

Processes:

Blockreview.exe

description	ioc	Process
File created	C:\Windows\IME\de-DE\explorer.exe	Blockreview.exe
File created	C:\Windows\IME\de-DE\7a0fd90576e088	Blockreview.exe
File created	C:\Windows\Installer\dllhost.exe	Blockreview.exe
File created	C:\Windows\Installer\5940a34987c991	Blockreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4cc23344d26c44260cb52028cff992b7.exeWScript.exeWScript.execmd.exereg.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cc23344d26c44260cb52028cff992b7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
1628	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
2780	schtasks.exe
2468	schtasks.exe
2904	schtasks.exe
3020	schtasks.exe
2668	schtasks.exe
2920	schtasks.exe
2084	schtasks.exe
2584	schtasks.exe
840	schtasks.exe
3052	schtasks.exe
780	schtasks.exe
1696	schtasks.exe
316	schtasks.exe
856	schtasks.exe
1804	schtasks.exe
2268	schtasks.exe
2636	schtasks.exe
292	schtasks.exe
1680	schtasks.exe
2088	schtasks.exe
1436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Blockreview.execsrss.exe

pid	Process
2824	Blockreview.exe
676	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Blockreview.execsrss.exe

description	pid	Process
Token: SeDebugPrivilege	2824	Blockreview.exe
Token: SeDebugPrivilege	676	csrss.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

4cc23344d26c44260cb52028cff992b7.exeWScript.execmd.exeBlockreview.execmd.exe

description	pid	Process	procid_target
PID 2360 wrote to memory of 2320	2360	4cc23344d26c44260cb52028cff992b7.exe	31
PID 2360 wrote to memory of 2320	2360	4cc23344d26c44260cb52028cff992b7.exe	31
PID 2360 wrote to memory of 2320	2360	4cc23344d26c44260cb52028cff992b7.exe	31
PID 2360 wrote to memory of 2320	2360	4cc23344d26c44260cb52028cff992b7.exe	31
PID 2360 wrote to memory of 1608	2360	4cc23344d26c44260cb52028cff992b7.exe	32
PID 2360 wrote to memory of 1608	2360	4cc23344d26c44260cb52028cff992b7.exe	32
PID 2360 wrote to memory of 1608	2360	4cc23344d26c44260cb52028cff992b7.exe	32
PID 2360 wrote to memory of 1608	2360	4cc23344d26c44260cb52028cff992b7.exe	32
PID 2320 wrote to memory of 2680	2320	WScript.exe	33
PID 2320 wrote to memory of 2680	2320	WScript.exe	33
PID 2320 wrote to memory of 2680	2320	WScript.exe	33
PID 2320 wrote to memory of 2680	2320	WScript.exe	33
PID 2680 wrote to memory of 2824	2680	cmd.exe	35
PID 2680 wrote to memory of 2824	2680	cmd.exe	35
PID 2680 wrote to memory of 2824	2680	cmd.exe	35
PID 2680 wrote to memory of 2824	2680	cmd.exe	35
PID 2824 wrote to memory of 440	2824	Blockreview.exe	58
PID 2824 wrote to memory of 440	2824	Blockreview.exe	58
PID 2824 wrote to memory of 440	2824	Blockreview.exe	58
PID 2680 wrote to memory of 1628	2680	cmd.exe	59
PID 2680 wrote to memory of 1628	2680	cmd.exe	59
PID 2680 wrote to memory of 1628	2680	cmd.exe	59
PID 2680 wrote to memory of 1628	2680	cmd.exe	59
PID 440 wrote to memory of 2184	440	cmd.exe	61
PID 440 wrote to memory of 2184	440	cmd.exe	61
PID 440 wrote to memory of 2184	440	cmd.exe	61
PID 440 wrote to memory of 676	440	cmd.exe	62
PID 440 wrote to memory of 676	440	cmd.exe	62
PID 440 wrote to memory of 676	440	cmd.exe	62

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

Blockreview.execsrss.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4cc23344d26c44260cb52028cff992b7.exe
"C:\Users\Admin\AppData\Local\Temp\4cc23344d26c44260cb52028cff992b7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\BrowserreviewSavesruntimeperf\Blockreview.exe
      "C:\BrowserreviewSavesruntimeperf\Blockreview.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2824
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AmNezkFRjx.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:440
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2184
      - C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe
        
        "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:676
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1628
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk1.7.0_80\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk1.7.0_80\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Installer\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Installer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Installer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\de-DE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\IME\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat

Filesize
162B

MD5
30ca6fe561a5efd9a1f56bbb4cfd2ec0

SHA1
8c6d786d854487eb43f2ba5c48f739ad565b398e

SHA256
d749a9500abf1e22af57ef9bc10b7e30f599067dffb7152e03c67eb70a1f6e2b

SHA512
85ff52e77cd3e6c2e329d4b921905865484c62dcb8d53ba97d8e04972e78934648b2fe51890ff949436a2afbabbe74c4e65e1d28a51cdcb2620429c7f481018a

Download Submit
C:\BrowserreviewSavesruntimeperf\Blockreview.exe

Filesize
1.6MB

MD5
3298254972dfd7e76172f9d3a7675b27

SHA1
569946a908e6a9cfa0a3faa28996d886b749e4eb

SHA256
719c6747522525b61a364a3d62e5777c9f8715dc8654bfd082e7928e4db39188

SHA512
8200af5528dcc1f4b6eddb13540f03ba9d142fc6ef779c94ca1d59fbcb2ed3021638c7b6cc7f865c75c8dd3fe8ef652291b91c9044f3c6b9e57f9fad1c99271d

Download Submit
C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe

Filesize
231B

MD5
01218abf206810b6e271415d154b23f4

SHA1
4ca645974bcd3f9baaf6dbf9073e82717494e7fe

SHA256
5631e2c439fe88993fc8a5ace15a447afc23c6f9412fa5e48fc78e96aa14699b

SHA512
caebaa06e1236fe479b49860a57e065ff70ce876b86fe254bac8912c1f1b2be5022a21c59b45148cfa2b8388c0f4f22655ebd36fb13df1221443de3bacce48d8

Download Submit
C:\BrowserreviewSavesruntimeperf\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AmNezkFRjx.bat

Filesize
237B

MD5
20844dad02958d8ee2aac7cdf696f5ff

SHA1
fa3c1cba46e7f4b3f3711d0ba0fafc88af4080b6

SHA256
ff13f46a12f37be8d4abfed657a3e5f9be2e235d8634488b78560cfb8d88c00e

SHA512
1d8cdc11b4f1bf6d5729cd08892ab09d00ad367aecc805f26ef3eef11e58b8f7a613760555b9c6ef19ee0f899feb4d822b76f4b45a4280ef9d4b8548d888de7a

Download Submit
memory/676-53-0x0000000000810000-0x0000000000822000-memory.dmp

Filesize
72KB

Download
memory/676-52-0x00000000008A0000-0x0000000000A40000-memory.dmp

Filesize
1.6MB

Download
memory/2824-24-0x0000000000C10000-0x0000000000C1C000-memory.dmp

Filesize
48KB

Download
memory/2824-22-0x0000000000630000-0x0000000000646000-memory.dmp

Filesize
88KB

Download
memory/2824-23-0x0000000000C00000-0x0000000000C0A000-memory.dmp

Filesize
40KB

Download
memory/2824-21-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/2824-25-0x0000000000C20000-0x0000000000C32000-memory.dmp

Filesize
72KB

Download
memory/2824-26-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Filesize
48KB

Download
memory/2824-28-0x0000000000C70000-0x0000000000C7E000-memory.dmp

Filesize
56KB

Download
memory/2824-27-0x0000000000C60000-0x0000000000C68000-memory.dmp

Filesize
32KB

Download
memory/2824-29-0x0000000000C80000-0x0000000000C8E000-memory.dmp

Filesize
56KB

Download
memory/2824-30-0x0000000000D20000-0x0000000000D2C000-memory.dmp

Filesize
48KB

Download
memory/2824-20-0x0000000000560000-0x000000000057C000-memory.dmp

Filesize
112KB

Download
memory/2824-19-0x00000000003D0000-0x00000000003DE000-memory.dmp

Filesize
56KB

Download
memory/2824-18-0x0000000001150000-0x00000000012F0000-memory.dmp

Filesize
1.6MB

Download