Resubmissions
16-11-2024 10:34
241116-ml8y7sylen 1016-11-2024 10:32
241116-mlb98svdnd 1015-11-2024 09:16
241115-k8ww2s1mhz 1030-10-2024 05:17
241030-fy5nzsxejq 1021-07-2024 18:09
240721-wrvs7syckf 1021-07-2024 14:26
240721-rsar7svhpj 10Analysis
-
max time kernel
18s -
max time network
20s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-11-2024 10:34
Behavioral task
behavioral1
Sample
DCRatBuild.exe
Resource
win11-20241007-en
General
-
Target
DCRatBuild.exe
-
Size
1.1MB
-
MD5
7ef93a29c05d412dd2dc432e1aac54a9
-
SHA1
776cc5c36f370a7e1fa840a21c13f2278723409e
-
SHA256
d9cbcae95ae824014b6d2fd6d3269b00b09ab84ed44b45b21c0b1842e7cdc132
-
SHA512
26e00619e47a130fb768b91074915c8a69f8690ac12465f21c1bd7e69f94ae6db9a238ff3c510a719cf1a318a07c80a543212c200b2b2152934a1ad154d13ab6
-
SSDEEP
12288:URZ+IoG/n9IQxW3OBseUUT+tcYbv+RK+UfXST5/rKMyFckcb8M41AT0z/GAFPz3m:u2G/nvxW3WieC7STuMMATKPTVgxr4q
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\", \"C:\\PortproviderRuntime\\SppExtComObj.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\", \"C:\\PortproviderRuntime\\SppExtComObj.exe\", \"C:\\Windows\\InboxApps\\SearchHost.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\", \"C:\\PortproviderRuntime\\SppExtComObj.exe\", \"C:\\Windows\\InboxApps\\SearchHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\StartMenuExperienceHost.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\", \"C:\\PortproviderRuntime\\SppExtComObj.exe\", \"C:\\Windows\\InboxApps\\SearchHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Media Player\\it-IT\\Registry.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\", \"C:\\PortproviderRuntime\\SppExtComObj.exe\", \"C:\\Windows\\InboxApps\\SearchHost.exe\", \"C:\\Users\\Public\\Documents\\My Music\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Media Player\\it-IT\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\Bridgewebsvc.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\"" Bridgewebsvc.exe -
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1964 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1144 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3220 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2596 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2308 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1160 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3792 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 748 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 352 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3796 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3352 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1408 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3872 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3868 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4420 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3580 2780 schtasks.exe 85 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4576 2780 schtasks.exe 85 -
resource yara_rule behavioral1/files/0x001b00000002aac9-10.dat dcrat behavioral1/memory/4544-13-0x00000000009F0000-0x0000000000AC6000-memory.dmp dcrat -
Executes dropped EXE 2 IoCs
pid Process 4544 Bridgewebsvc.exe 4820 Bridgewebsvc.exe -
Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bridgewebsvc = "\"C:\\Recovery\\WindowsRE\\Bridgewebsvc.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\Windows\\InboxApps\\SearchHost.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\Documents\\My Music\\StartMenuExperienceHost.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\Windows\\InboxApps\\SearchHost.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\Documents\\My Music\\StartMenuExperienceHost.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bridgewebsvc = "\"C:\\Recovery\\WindowsRE\\Bridgewebsvc.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\uk-UA\\lsass.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\PortproviderRuntime\\SppExtComObj.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\Windows Media Player\\it-IT\\Registry.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\Windows Media Player\\it-IT\\Registry.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Windows Media Player\\sysmon.exe\"" Bridgewebsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\PortproviderRuntime\\SppExtComObj.exe\"" Bridgewebsvc.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\dwm.exe Bridgewebsvc.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Windows NT\Accessories\uk-UA\6203df4a6bafc7 Bridgewebsvc.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_neutral_split.scale-200_8wekyb3d8bbwe\fontdrvhost.exe Bridgewebsvc.exe File created C:\Program Files (x86)\Windows Media Player\sysmon.exe Bridgewebsvc.exe File created C:\Program Files (x86)\Windows Media Player\121e5b5079f7c0 Bridgewebsvc.exe File created C:\Program Files\Windows Media Player\it-IT\Registry.exe Bridgewebsvc.exe File created C:\Program Files\Windows Media Player\it-IT\ee2ad38f3d4382 Bridgewebsvc.exe File created C:\Program Files (x86)\Windows NT\Accessories\uk-UA\lsass.exe Bridgewebsvc.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\uk-UA\lsass.exe Bridgewebsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\InboxApps\SearchHost.exe Bridgewebsvc.exe File created C:\Windows\InboxApps\cfa885d449487c Bridgewebsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCRatBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings DCRatBuild.exe Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings Bridgewebsvc.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1160 schtasks.exe 3792 schtasks.exe 748 schtasks.exe 3352 schtasks.exe 3580 schtasks.exe 1964 schtasks.exe 352 schtasks.exe 1408 schtasks.exe 3872 schtasks.exe 3868 schtasks.exe 1656 schtasks.exe 4420 schtasks.exe 4576 schtasks.exe 2596 schtasks.exe 3220 schtasks.exe 4792 schtasks.exe 4656 schtasks.exe 2308 schtasks.exe 2300 schtasks.exe 3796 schtasks.exe 1144 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4544 Bridgewebsvc.exe 4820 Bridgewebsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4544 Bridgewebsvc.exe Token: SeDebugPrivilege 4820 Bridgewebsvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3176 wrote to memory of 2884 3176 DCRatBuild.exe 79 PID 3176 wrote to memory of 2884 3176 DCRatBuild.exe 79 PID 3176 wrote to memory of 2884 3176 DCRatBuild.exe 79 PID 2884 wrote to memory of 3968 2884 WScript.exe 82 PID 2884 wrote to memory of 3968 2884 WScript.exe 82 PID 2884 wrote to memory of 3968 2884 WScript.exe 82 PID 3968 wrote to memory of 4544 3968 cmd.exe 84 PID 3968 wrote to memory of 4544 3968 cmd.exe 84 PID 4544 wrote to memory of 3864 4544 Bridgewebsvc.exe 107 PID 4544 wrote to memory of 3864 4544 Bridgewebsvc.exe 107 PID 3864 wrote to memory of 3800 3864 cmd.exe 109 PID 3864 wrote to memory of 3800 3864 cmd.exe 109 PID 3864 wrote to memory of 4820 3864 cmd.exe 110 PID 3864 wrote to memory of 4820 3864 cmd.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\PortproviderRuntime\2jiE6dDNxF2hUpVE5Z.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\PortproviderRuntime\OI2YygSphQCiiCNA7ofzvo.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\PortproviderRuntime\Bridgewebsvc.exe"C:\PortproviderRuntime\Bridgewebsvc.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\u0OYmC1m6F.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3800
-
-
C:\Recovery\WindowsRE\Bridgewebsvc.exe"C:\Recovery\WindowsRE\Bridgewebsvc.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\uk-UA\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\uk-UA\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\uk-UA\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\PortproviderRuntime\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\PortproviderRuntime\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\PortproviderRuntime\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\InboxApps\SearchHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Windows\InboxApps\SearchHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 6 /tr "'C:\Windows\InboxApps\SearchHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Music\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Music\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\it-IT\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\it-IT\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\it-IT\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "BridgewebsvcB" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Bridgewebsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Bridgewebsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Bridgewebsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "BridgewebsvcB" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Bridgewebsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218B
MD5413767cf51f36f7f50d9430d73ea0bb1
SHA14469733bce94a114c836ea3591dccb3e689782c7
SHA2562e118668b3c63457b924aafd6b402e105477030d6157e3d66ba8ba7acad58dcf
SHA5123c12a46412227f57f8aa815b0b7820ca54eb3fa7a033ea7baa7efad7526755db7998d843a6790880efa87b841e9c6085b793930ae865c2694c8385e5937ee900
-
Filesize
828KB
MD5fddea23e803e9e5de212e4c0475c8f93
SHA1c4426bf36ce54917155da2bfbec1508c5a799664
SHA256f014b4dd1600fb5ecd92de55165573415c2d7ee184a4f70f2f975ee7909150f6
SHA51205459fc75998ee306e8de7e544aaf744e5c6e1930dcb7e02b94a566a7ad6e874a9fe50a78a1da50b4e7110282e49353f8ced586117d772b600b84d09ee070591
-
Filesize
41B
MD5863d81db66a0a5864890665ea50c23c5
SHA1f5a584f4ee5e390b667eaa5e5d9332251388fa7e
SHA256d4fa2e3203a21efd9f46fd9ea5fcedbabe13bd9a2bc93d0169070507380bbf9b
SHA512ecb8ff338e0febcfe8965516a58dcdcd63420592467ce1c281f7ccacf7a2ca02bd7a73d52208e98edec3e73ea69477f3ccaa4ddf4b0608e5598a92e110e5d3b0
-
Filesize
1KB
MD5400b532c938aca538f01c5616cf318cd
SHA1598a59a9434e51a6416f91a4c83bd02505ecb846
SHA25628e57db6d7535775b5e65c90ab208c7fe392e373056db5d35e76854270ecd05d
SHA512b15583323c457d389b873eb31b8e59fef450c0c0e684b0f797231e8d0abace9227b15d4e45b45f4c79ad044a28cc3d79f9f7c2a81bd38e43b0c09f07aaa95b73
-
Filesize
203B
MD599216c3532912c573ded08f332484310
SHA13466d742078147c83c287c24e451d43f0352ec72
SHA256111971c6ab2000a4ed52d386146aa6f6ce6c26a5d70e32d12a05af714bd07fcc
SHA512f4249dbd52aa3b0340ab94dcc7c021f2b2a01abeb9eb5e6e9c91dc24f21172c14567fdf195d24f5264e81dcc993d2377fd0e1c938ad7b732bfcb73b829daa21f