dcrat | 4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609

General

Target

4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe
Size

1.9MB
MD5

4cc23344d26c44260cb52028cff992b7
SHA1

7f2b7a02ae3f65c6757f134a79c302a92e31311c
SHA256

4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609
SHA512

71e7ced9568ede15e9a9fe6edbd7ed77559f9046e8fc77ce83bb3fd464c61794ba719451774b2c02f30abc80a51f3563a1491a74d7f390d8152cd0b3b2928c45
SSDEEP

49152:UbA30IKxSrOw6FNapB0LFyYsyqX96ZU8jMWg3:UberOGpaMYducjM3

Score

10^/10

dcrat discovery evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4312	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	3984	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	3984	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Blockreview.exetaskhostw.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Blockreview.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\BrowserreviewSavesruntimeperf\Blockreview.exe	dcrat
behavioral2/memory/2640-17-0x0000000000AD0000-0x0000000000C70000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exeWScript.exeBlockreview.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Blockreview.exe

Executes dropped EXE 2 IoCs

Processes:

Blockreview.exetaskhostw.exe

pid process

2640 Blockreview.exe
2652 taskhostw.exe

pid	process
2640	Blockreview.exe
2652	taskhostw.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Blockreview.exetaskhostw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Blockreview.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe

Drops file in Program Files directory 7 IoCs

Processes:

Blockreview.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Mail\66fc9ff0ee96c2	Blockreview.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe	Blockreview.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\27d1bcfc3c54e0	Blockreview.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\spoolsv.exe	Blockreview.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\spoolsv.exe	Blockreview.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\f3b6ecef712a24	Blockreview.exe
File created	C:\Program Files (x86)\Windows Mail\sihost.exe	Blockreview.exe

Drops file in Windows directory 2 IoCs

Processes:

Blockreview.exe

description	ioc	process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\Blockreview.exe	Blockreview.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\79e77c4328bdc8	Blockreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WScript.execmd.exereg.exe4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exeWScript.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 2 IoCs

Processes:

4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exeBlockreview.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	Blockreview.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3512 reg.exe

pid	process
3512	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2656	schtasks.exe
2208	schtasks.exe
1976	schtasks.exe
3704	schtasks.exe
508	schtasks.exe
4312	schtasks.exe
2968	schtasks.exe
2232	schtasks.exe
1756	schtasks.exe
4796	schtasks.exe
4120	schtasks.exe
3876	schtasks.exe
2372	schtasks.exe
216	schtasks.exe
2284	schtasks.exe
3564	schtasks.exe
3060	schtasks.exe
384	schtasks.exe
4488	schtasks.exe
1068	schtasks.exe
4416	schtasks.exe
4604	schtasks.exe
1444	schtasks.exe
4392	schtasks.exe
4452	schtasks.exe
3872	schtasks.exe
756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Blockreview.exetaskhostw.exe

pid process

2640 Blockreview.exe
2640 Blockreview.exe
2640 Blockreview.exe
2640 Blockreview.exe
2652 taskhostw.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Blockreview.exetaskhostw.exe

description pid process

Token: SeDebugPrivilege 2640 Blockreview.exe
Token: SeDebugPrivilege 2652 taskhostw.exe

pid	process
2640	Blockreview.exe
2640	Blockreview.exe
2640	Blockreview.exe
2640	Blockreview.exe
2652	taskhostw.exe

description	pid	process
Token: SeDebugPrivilege	2640	Blockreview.exe
Token: SeDebugPrivilege	2652	taskhostw.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exeWScript.execmd.exeBlockreview.execmd.exe

description	pid	process	target process
PID 3620 wrote to memory of 3960	3620	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe	WScript.exe
PID 3620 wrote to memory of 3960	3620	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe	WScript.exe
PID 3620 wrote to memory of 3960	3620	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe	WScript.exe
PID 3620 wrote to memory of 2976	3620	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe	WScript.exe
PID 3620 wrote to memory of 2976	3620	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe	WScript.exe
PID 3620 wrote to memory of 2976	3620	4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe	WScript.exe
PID 3960 wrote to memory of 2792	3960	WScript.exe	cmd.exe
PID 3960 wrote to memory of 2792	3960	WScript.exe	cmd.exe
PID 3960 wrote to memory of 2792	3960	WScript.exe	cmd.exe
PID 2792 wrote to memory of 2640	2792	cmd.exe	Blockreview.exe
PID 2792 wrote to memory of 2640	2792	cmd.exe	Blockreview.exe
PID 2640 wrote to memory of 3932	2640	Blockreview.exe	cmd.exe
PID 2640 wrote to memory of 3932	2640	Blockreview.exe	cmd.exe
PID 2792 wrote to memory of 3512	2792	cmd.exe	reg.exe
PID 2792 wrote to memory of 3512	2792	cmd.exe	reg.exe
PID 2792 wrote to memory of 3512	2792	cmd.exe	reg.exe
PID 3932 wrote to memory of 2004	3932	cmd.exe	w32tm.exe
PID 3932 wrote to memory of 2004	3932	cmd.exe	w32tm.exe
PID 3932 wrote to memory of 2652	3932	cmd.exe	taskhostw.exe
PID 3932 wrote to memory of 2652	3932	cmd.exe	taskhostw.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

taskhostw.exeBlockreview.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhostw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Blockreview.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhostw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe
"C:\Users\Admin\AppData\Local\Temp\4c6650813906ced18f7564f906ea5a033a206cb2c71f244e0d28a04e3f2d7609.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\BrowserreviewSavesruntimeperf\Blockreview.exe
      "C:\BrowserreviewSavesruntimeperf\Blockreview.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2640
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\naD86XsDOa.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3932
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2004
      - C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2652
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3512
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BrowserreviewSavesruntimeperf\file.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\BrowserreviewSavesruntimeperf\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\BrowserreviewSavesruntimeperf\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\BrowserreviewSavesruntimeperf\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockreviewB" /sc MINUTE /mo 12 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\Blockreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Blockreview" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\Blockreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BlockreviewB" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\Blockreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BrowserreviewSavesruntimeperf\4COnkcqgLamz7kP5YHD7l4vjV.bat

Filesize
162B

MD5
30ca6fe561a5efd9a1f56bbb4cfd2ec0

SHA1
8c6d786d854487eb43f2ba5c48f739ad565b398e

SHA256
d749a9500abf1e22af57ef9bc10b7e30f599067dffb7152e03c67eb70a1f6e2b

SHA512
85ff52e77cd3e6c2e329d4b921905865484c62dcb8d53ba97d8e04972e78934648b2fe51890ff949436a2afbabbe74c4e65e1d28a51cdcb2620429c7f481018a

Download Submit
C:\BrowserreviewSavesruntimeperf\Blockreview.exe

Filesize
1.6MB

MD5
3298254972dfd7e76172f9d3a7675b27

SHA1
569946a908e6a9cfa0a3faa28996d886b749e4eb

SHA256
719c6747522525b61a364a3d62e5777c9f8715dc8654bfd082e7928e4db39188

SHA512
8200af5528dcc1f4b6eddb13540f03ba9d142fc6ef779c94ca1d59fbcb2ed3021638c7b6cc7f865c75c8dd3fe8ef652291b91c9044f3c6b9e57f9fad1c99271d

Download Submit
C:\BrowserreviewSavesruntimeperf\cyoW9TDLPAWUwl12Pv6zflv.vbe

Filesize
231B

MD5
01218abf206810b6e271415d154b23f4

SHA1
4ca645974bcd3f9baaf6dbf9073e82717494e7fe

SHA256
5631e2c439fe88993fc8a5ace15a447afc23c6f9412fa5e48fc78e96aa14699b

SHA512
caebaa06e1236fe479b49860a57e065ff70ce876b86fe254bac8912c1f1b2be5022a21c59b45148cfa2b8388c0f4f22655ebd36fb13df1221443de3bacce48d8

Download Submit
C:\BrowserreviewSavesruntimeperf\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\naD86XsDOa.bat

Filesize
200B

MD5
54e0e28298889a01fe372cb5a7537587

SHA1
b71ba5b08639d1b5c412da0ba981d96bff53f6cf

SHA256
d12b336e6f09c8eae65cd72ca7e37b19c0ae0c61ed021bb2e1dedaa17406c6bc

SHA512
0551126e7639356ea37919c017bd66cdea4a655ff5d777680ad17150eb865fb045c531bd170cb7644f217ffd439d367c27c6b46b8c8dff68fe18a5b32e23361c

Download Submit
memory/2640-23-0x000000001B760000-0x000000001B76A000-memory.dmp

Filesize
40KB

Download
memory/2640-25-0x000000001B7F0000-0x000000001B802000-memory.dmp

Filesize
72KB

Download
memory/2640-20-0x000000001BF60000-0x000000001BFB0000-memory.dmp

Filesize
320KB

Download
memory/2640-21-0x0000000001450000-0x0000000001458000-memory.dmp

Filesize
32KB

Download
memory/2640-22-0x000000001B7C0000-0x000000001B7D6000-memory.dmp

Filesize
88KB

Download
memory/2640-18-0x0000000001440000-0x000000000144E000-memory.dmp

Filesize
56KB

Download
memory/2640-24-0x000000001B7E0000-0x000000001B7EC000-memory.dmp

Filesize
48KB

Download
memory/2640-19-0x000000001B740000-0x000000001B75C000-memory.dmp

Filesize
112KB

Download
memory/2640-26-0x000000001C690000-0x000000001CBB8000-memory.dmp

Filesize
5.2MB

Download
memory/2640-27-0x000000001BF30000-0x000000001BF3C000-memory.dmp

Filesize
48KB

Download
memory/2640-28-0x000000001BF40000-0x000000001BF48000-memory.dmp

Filesize
32KB

Download
memory/2640-29-0x000000001BF50000-0x000000001BF5E000-memory.dmp

Filesize
56KB

Download
memory/2640-30-0x000000001C160000-0x000000001C16E000-memory.dmp

Filesize
56KB

Download
memory/2640-31-0x000000001C180000-0x000000001C18C000-memory.dmp

Filesize
48KB

Download
memory/2640-17-0x0000000000AD0000-0x0000000000C70000-memory.dmp

Filesize
1.6MB

Download
memory/2652-59-0x000000001C600000-0x000000001C612000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads