dcrat | e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908

Analysis

max time kernel
141s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe
Size

2.0MB
MD5

38924c8184bf5944da2ac3e5cd987da2
SHA1

1af0d4b729dd9c3a42c197a4ec961cab5722adda
SHA256

e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908
SHA512

225e25eb08a1abe529a4fc5eb435eb800145a782e3dbdd6ba1c28925f84d758c18111ed181649bd222d50fd4a44f1ede7e43c630a58ae9a92fd2074d3d306a61
SSDEEP

24576:FcBmS1nneRYZwoKBU7ArlQUCeYIxerW33/XfV6jx9aP5VR/z0WcBS4bppmHVSqyW:9S4/ST6xijxsBEmHVSqFHOHqnCgXu8

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Users\\Default\\My Documents\\dec3FED.tmp.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Users\\Default\\My Documents\\dec3FED.tmp.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Users\\Default\\My Documents\\dec3FED.tmp.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\smss.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\Users\\Default\\My Documents\\dec3FED.tmp.exe\", \"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\audiodg.exe\""	dec3FED.tmp

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	3044	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	3044	schtasks.exe	31

DCRat payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x00080000000120f6-4.dat	family_dcrat_v2
behavioral1/memory/2080-7-0x0000000000C60000-0x0000000000E16000-memory.dmp	family_dcrat_v2
behavioral1/memory/2532-107-0x0000000000390000-0x0000000000546000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1280	powershell.exe
1320	powershell.exe
2988	powershell.exe
1764	powershell.exe
1248	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2080	dec3FED.tmp
2532	smss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\dec3FED.tmp = "\"C:\\Users\\Default\\My Documents\\dec3FED.tmp.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dec3FED.tmp = "\"C:\\Users\\Default\\My Documents\\dec3FED.tmp.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\smss.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsm.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\security\\ApplicationId\\PolicyManagement\\WmiPrvSE.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\smss.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\audiodg.exe\""	dec3FED.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\audiodg.exe\""	dec3FED.tmp

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC234CD8968F5F4487A977C8673DB3027.TMP	csc.exe
File created	\??\c:\Windows\System32\byyuy-.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe	dec3FED.tmp
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\42af1c969fbb7b	dec3FED.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe	dec3FED.tmp
File created	C:\Windows\security\ApplicationId\PolicyManagement\24dbde2999530e	dec3FED.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1396	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1396	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1956	schtasks.exe
1860	schtasks.exe
2076	schtasks.exe
2888	schtasks.exe
112	schtasks.exe
756	schtasks.exe
2656	schtasks.exe
2896	schtasks.exe
2940	schtasks.exe
2408	schtasks.exe
1256	schtasks.exe
1852	schtasks.exe
2832	schtasks.exe
712	schtasks.exe
2244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp
2080	dec3FED.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	smss.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	dec3FED.tmp
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2532	smss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2532	smss.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2080	2316	e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe	30
PID 2316 wrote to memory of 2080	2316	e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe	30
PID 2316 wrote to memory of 2080	2316	e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe	30
PID 2080 wrote to memory of 2180	2080	dec3FED.tmp	35
PID 2080 wrote to memory of 2180	2080	dec3FED.tmp	35
PID 2080 wrote to memory of 2180	2080	dec3FED.tmp	35
PID 2180 wrote to memory of 2448	2180	csc.exe	37
PID 2180 wrote to memory of 2448	2180	csc.exe	37
PID 2180 wrote to memory of 2448	2180	csc.exe	37
PID 2080 wrote to memory of 1320	2080	dec3FED.tmp	50
PID 2080 wrote to memory of 1320	2080	dec3FED.tmp	50
PID 2080 wrote to memory of 1320	2080	dec3FED.tmp	50
PID 2080 wrote to memory of 1280	2080	dec3FED.tmp	51
PID 2080 wrote to memory of 1280	2080	dec3FED.tmp	51
PID 2080 wrote to memory of 1280	2080	dec3FED.tmp	51
PID 2080 wrote to memory of 1248	2080	dec3FED.tmp	52
PID 2080 wrote to memory of 1248	2080	dec3FED.tmp	52
PID 2080 wrote to memory of 1248	2080	dec3FED.tmp	52
PID 2080 wrote to memory of 1764	2080	dec3FED.tmp	53
PID 2080 wrote to memory of 1764	2080	dec3FED.tmp	53
PID 2080 wrote to memory of 1764	2080	dec3FED.tmp	53
PID 2080 wrote to memory of 2988	2080	dec3FED.tmp	54
PID 2080 wrote to memory of 2988	2080	dec3FED.tmp	54
PID 2080 wrote to memory of 2988	2080	dec3FED.tmp	54
PID 2080 wrote to memory of 2488	2080	dec3FED.tmp	60
PID 2080 wrote to memory of 2488	2080	dec3FED.tmp	60
PID 2080 wrote to memory of 2488	2080	dec3FED.tmp	60
PID 2488 wrote to memory of 328	2488	cmd.exe	62
PID 2488 wrote to memory of 328	2488	cmd.exe	62
PID 2488 wrote to memory of 328	2488	cmd.exe	62
PID 2488 wrote to memory of 1396	2488	cmd.exe	63
PID 2488 wrote to memory of 1396	2488	cmd.exe	63
PID 2488 wrote to memory of 1396	2488	cmd.exe	63
PID 2488 wrote to memory of 2532	2488	cmd.exe	64
PID 2488 wrote to memory of 2532	2488	cmd.exe	64
PID 2488 wrote to memory of 2532	2488	cmd.exe	64

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe
"C:\Users\Admin\AppData\Local\Temp\e767887e30b91919d5dc1dd2bf79ed277c2778363732e7c84f42f1f1808e5908.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\dec3FED.tmp
  C:\Users\Admin\AppData\Local\Temp\dec3FED.tmp
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mdqy21gf\mdqy21gf.cmdline"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES536D.tmp" "c:\Windows\System32\CSC234CD8968F5F4487A977C8673DB3027.TMP"
      4⤵
      PID:2448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\dec3FED.tmp.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y5CQu6zSeI.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:328
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1396
  - - C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe
      "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dec3FED.tmpd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\My Documents\dec3FED.tmp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dec3FED.tmp" /sc ONLOGON /tr "'C:\Users\Default\My Documents\dec3FED.tmp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dec3FED.tmpd" /sc MINUTE /mo 5 /tr "'C:\Users\Default\My Documents\dec3FED.tmp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Windows\security\ApplicationId\PolicyManagement\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES536D.tmp

Filesize
1KB

MD5
28b9ebe3583b52454086067c1bc391ac

SHA1
fbc3feae3b2b919e179c989a53cb3d2f9cb06f0c

SHA256
c5feff326fcdf821538561106cd6188c49c7834e36cfca358d8d809aae3f40a5

SHA512
f1738e5fee59d3633b9025ecda9ad0a24270a67049e200e8ce3ceaed8452ec8099896e4b477595fbb1c2e4abef93036ec763a8c1cd4c80aba039c6e76f40064a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y5CQu6zSeI.bat

Filesize
199B

MD5
dbbbbdc3077a83e730ae5edf4be98c15

SHA1
a30255519733c0a8c532f90d55313268ead1358b

SHA256
06dcc5865741e05a5318924c2ff1f36c4ec5f221909a2d535f86bb453cca9404

SHA512
391237304e7688e6d4de70b730c1065279ca77755fd415d8348fa89b7a53db692755fd0dcb8be25896779be913a4527f3a86bc6aad485df7bb8445c67961a4a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\dec3FED.tmp

Filesize
1.7MB

MD5
37d00592110ca3cc53b7f6ca6ab1c82a

SHA1
86e13c84c33969081fe59d123e3cf81e9b3e5674

SHA256
5acd08cc77f1cebd2cb95f88b37edf94b9e72b9b1c965af7ea2766e9ddc5afb9

SHA512
618eeaec0ac5390184a3b6195634cb16d3def1d2ac8ab3664b3128a4e4776dda7777e6c2aedf138a6f8e9b7f6f84fc58c38f89d9178b220443567e0c55e0bbcd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f02f4a1e8f00258ad1f18706d2a99fc3

SHA1
8f6a16208ef7c88c2bc394773178f6b725e01685

SHA256
52aad9e4f2749f05799857d118cd54059f103292e84ea6e82b171211596b7bb8

SHA512
7215ae98192111fec71f35790799720bf92f9a30b455cc03963b05fcc299b554be9a374a8b3c7d5c8ccfc6704dfd1a5cf73fe54d4c6c8073fe83bb876bc29e3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mdqy21gf\mdqy21gf.0.cs

Filesize
402B

MD5
300fd08c21a27a4e99740fe088a5078d

SHA1
9e339950025ba3b3aa4a633added58e567c0859a

SHA256
d1b5e6993f116f600706d663e005dc4f3f76a9eabc493c0f2a520ca8d1e2b549

SHA512
adf9058ac313b121d68b1b42e8885ff53fa3724101c549b72773716fbfe4ad0c0529ea2f095df18c24d40705f6e6baf7d77d3ad0684efeae5f7595306618ad89

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mdqy21gf\mdqy21gf.cmdline

Filesize
235B

MD5
4ecfd4954867713fa6677145be72fee3

SHA1
ed7f609076265108307b3e1f9a68a27b2708724c

SHA256
9ddb25b15c8fb2d7e611c94bb1cb67782bea6df2d77de94699b9110baf2b4d57

SHA512
5e932bd048a5b179da72cefd0d9c58e4bc8b16541e8423e5cad4a5c7dea2fb36189445e91e490e475fab804303ce5c8a3d67941093aa50ac5980c2865c56191c

Download Submit
\??\c:\Windows\System32\CSC234CD8968F5F4487A977C8673DB3027.TMP

Filesize
1KB

MD5
078586b266e519b5c113064d7a0bf45c

SHA1
a9395c0ef35add5c75591ebb94c85c1f33f408bf

SHA256
ccf292ff9f142b204ad4f4481a044ba8f9ab274305dcb604bf0b8ae91819ab1e

SHA512
5b8eb6aad62657309088c4668d633c2aa6324d4824ec32c3c5e133df0a5493a4342c980e077ba565f3aab29c58f95c8db7195415a1e554384405c1457730f959

Download Submit
memory/1764-81-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/1764-82-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/2080-35-0x0000000000650000-0x0000000000660000-memory.dmp

Filesize
64KB

Download
memory/2080-46-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-22-0x0000000000470000-0x000000000047C000-memory.dmp

Filesize
48KB

Download
memory/2080-24-0x0000000000630000-0x0000000000642000-memory.dmp

Filesize
72KB

Download
memory/2080-26-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/2080-28-0x0000000000B20000-0x0000000000B32000-memory.dmp

Filesize
72KB

Download
memory/2080-30-0x0000000000490000-0x000000000049E000-memory.dmp

Filesize
56KB

Download
memory/2080-31-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-33-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/2080-18-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-37-0x0000000002220000-0x000000000227A000-memory.dmp

Filesize
360KB

Download
memory/2080-39-0x00000000006E0000-0x00000000006F0000-memory.dmp

Filesize
64KB

Download
memory/2080-41-0x0000000000B40000-0x0000000000B4E000-memory.dmp

Filesize
56KB

Download
memory/2080-43-0x0000000000C00000-0x0000000000C18000-memory.dmp

Filesize
96KB

Download
memory/2080-45-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download
memory/2080-20-0x0000000000420000-0x000000000042E000-memory.dmp

Filesize
56KB

Download
memory/2080-48-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-49-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-47-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-17-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-16-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/2080-14-0x0000000000450000-0x0000000000468000-memory.dmp

Filesize
96KB

Download
memory/2080-12-0x0000000000430000-0x000000000044C000-memory.dmp

Filesize
112KB

Download
memory/2080-10-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/2080-8-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-80-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-7-0x0000000000C60000-0x0000000000E16000-memory.dmp

Filesize
1.7MB

Download
memory/2080-6-0x000007FEF5303000-0x000007FEF5304000-memory.dmp

Filesize
4KB

Download
memory/2316-104-0x0000000000400000-0x000000000060C000-memory.dmp

Filesize
2.0MB

Download
memory/2532-107-0x0000000000390000-0x0000000000546000-memory.dmp

Filesize
1.7MB

Download