Analysis
-
max time kernel
93s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 02:46
Behavioral task
behavioral1
Sample
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe
Resource
win10v2004-20241007-en
General
-
Target
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe
-
Size
1.1MB
-
MD5
119ede06afc1b721278e8955fe8338f4
-
SHA1
3917c6cfd13689a83e8410c157f54c0e05550bcf
-
SHA256
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0
-
SHA512
72193ded81941ecef91da566d47e22667e98d927a18cbe06be3e4cbea6c1504664a7569fd9531ddbf1b4b019a953e53deb8da34938d1b879b4d74902eff3be78
-
SSDEEP
24576:AMYPCI+q+U4cIG409ozWucypk1Nd4AX+iB/YjuM6kyh+:ABPZ0Kr1FXHB/guM6k+
Malware Config
Signatures
-
DcRat 48 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
pid Process 4240 schtasks.exe 1272 schtasks.exe 4144 schtasks.exe 1180 schtasks.exe 4660 schtasks.exe 4480 schtasks.exe 2536 schtasks.exe 1048 schtasks.exe 4984 schtasks.exe 2428 schtasks.exe 4316 schtasks.exe 4764 schtasks.exe 4088 schtasks.exe 1784 schtasks.exe 1108 schtasks.exe 2252 schtasks.exe 2016 schtasks.exe 4064 schtasks.exe 2024 schtasks.exe 3928 schtasks.exe 4344 schtasks.exe 4504 schtasks.exe 4060 schtasks.exe 2840 schtasks.exe 404 schtasks.exe 2336 schtasks.exe 368 schtasks.exe 532 schtasks.exe 2660 schtasks.exe 4548 schtasks.exe 1384 schtasks.exe 2528 schtasks.exe 1128 schtasks.exe 4224 schtasks.exe 5012 schtasks.exe 4380 schtasks.exe 4636 schtasks.exe 4804 schtasks.exe 5028 schtasks.exe 2012 schtasks.exe 2620 schtasks.exe 4440 schtasks.exe 2272 schtasks.exe 1688 schtasks.exe 4048 schtasks.exe 4200 schtasks.exe 740 schtasks.exe 3136 schtasks.exe -
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\Idle.exe\", \"C:\\Users\\All Users\\Documents\\csrss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\Idle.exe\", \"C:\\Users\\All Users\\Documents\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\Idle.exe\", \"C:\\Users\\All Users\\Documents\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\taskhostw.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\Idle.exe\", \"C:\\Users\\All Users\\Documents\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\taskhostw.exe\", \"C:\\Windows\\PrintDialog\\Assets\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\Idle.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\Registration\\Idle.exe\", \"C:\\Users\\All Users\\Documents\\csrss.exe\", \"C:\\Program Files\\7-Zip\\Registry.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Users\\Default User\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Users\\Public\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\", \"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2528 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4636 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2660 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1108 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4984 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1180 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1384 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4504 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4316 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1688 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1128 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4064 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4804 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2012 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2272 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4480 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1272 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1048 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2016 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2024 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2620 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4548 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2840 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4144 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4764 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2336 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3928 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4224 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4088 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 368 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4200 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4344 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 740 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4240 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4440 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1784 3392 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3136 3392 schtasks.exe 85 -
resource yara_rule behavioral2/memory/3840-1-0x0000000000C20000-0x0000000000D4E000-memory.dmp dcrat behavioral2/files/0x0007000000023ca2-17.dat dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Executes dropped EXE 1 IoCs
pid Process 3604 dwm.exe -
Adds Run key to start application 2 TTPs 32 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SearchApp.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Documents\\csrss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0 = "\"C:\\Windows\\PrintDialog\\Assets\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default User\\Registry.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Registration\\Idle.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\taskhostw.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Registration\\Idle.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Documents\\csrss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\7-Zip\\Registry.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\dotnet\\shared\\fontdrvhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0 = "\"C:\\Windows\\PrintDialog\\Assets\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\7-Zip\\Registry.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\taskhostw.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\Default User\\Registry.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\dwm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\38384e6a620884 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\taskhostw.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\dwm.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\6cb0b6c459d5d3 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\dotnet\shared\fontdrvhost.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\dotnet\shared\5b884080fd4f94 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\7-Zip\Registry.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\7-Zip\ee2ad38f3d4382 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ea9f0e6c9e2dcd ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\PrintDialog\Assets\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Windows\PrintDialog\Assets\b6768d31d2a420 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Windows\Registration\Idle.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Windows\Registration\6ccacd8608530f ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1784 schtasks.exe 5028 schtasks.exe 1128 schtasks.exe 2272 schtasks.exe 2620 schtasks.exe 2840 schtasks.exe 4224 schtasks.exe 4636 schtasks.exe 2252 schtasks.exe 4804 schtasks.exe 2012 schtasks.exe 2660 schtasks.exe 4504 schtasks.exe 2428 schtasks.exe 2024 schtasks.exe 4548 schtasks.exe 4380 schtasks.exe 4240 schtasks.exe 1384 schtasks.exe 1688 schtasks.exe 4064 schtasks.exe 4764 schtasks.exe 4088 schtasks.exe 4200 schtasks.exe 740 schtasks.exe 2528 schtasks.exe 1108 schtasks.exe 4316 schtasks.exe 404 schtasks.exe 1048 schtasks.exe 2536 schtasks.exe 3136 schtasks.exe 2016 schtasks.exe 4660 schtasks.exe 3928 schtasks.exe 368 schtasks.exe 4344 schtasks.exe 4440 schtasks.exe 4984 schtasks.exe 1180 schtasks.exe 4480 schtasks.exe 1272 schtasks.exe 532 schtasks.exe 4060 schtasks.exe 4048 schtasks.exe 4144 schtasks.exe 2336 schtasks.exe 5012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 3604 dwm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Token: SeDebugPrivilege 3604 dwm.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3840 wrote to memory of 3604 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 135 PID 3840 wrote to memory of 3604 3840 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 135 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe"C:\Users\Admin\AppData\Local\Temp\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Program Files (x86)\Mozilla Maintenance Service\dwm.exe"C:\Program Files (x86)\Mozilla Maintenance Service\dwm.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\dwm.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\dwm.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\shared\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\shared\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Registry.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\dllhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\Idle.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Registration\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\Registration\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Documents\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Documents\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Registry.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\taskhostw.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0a" /sc MINUTE /mo 7 /tr "'C:\Windows\PrintDialog\Assets\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0a" /sc MINUTE /mo 5 /tr "'C:\Windows\PrintDialog\Assets\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5119ede06afc1b721278e8955fe8338f4
SHA13917c6cfd13689a83e8410c157f54c0e05550bcf
SHA256ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0
SHA51272193ded81941ecef91da566d47e22667e98d927a18cbe06be3e4cbea6c1504664a7569fd9531ddbf1b4b019a953e53deb8da34938d1b879b4d74902eff3be78