dcrat | 87740815e35062cc764dd770497f2e8b0497ace5201bfd0ffcc7138dfce51b88

Analysis

max time kernel
30s
max time network
32s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

portagentintoMonitor.exe
Size

1.8MB
MD5

eaafeeda68b54d3fee1027ad70851ceb
SHA1

602017682f89305d82d69dc80135df337d9cc330
SHA256

87740815e35062cc764dd770497f2e8b0497ace5201bfd0ffcc7138dfce51b88
SHA512

6622411603526cc05095d1c92b5629408387e6a789b1ce69f951435df7531a183544309f8abc35ebeee25ed25d117abefaeb705a6981c13d24161e5bc2f1e2e8
SSDEEP

24576:+jPlO0knEWTmrPP2mLnNJ3zlho6xQvbIpjRnufgEqBkXGhiNeTM8rgVxCbC1GRaP:+A1bY32m5QTSufgEPsiNHugVkC1Catt

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3668	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3436	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	3532	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	3532	schtasks.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
2092	powershell.exe
2824	powershell.exe
4148	powershell.exe
3404	powershell.exe
3088	powershell.exe
4696	powershell.exe
2788	powershell.exe
3304	powershell.exe
368	powershell.exe
2384	powershell.exe
2108	powershell.exe
2648	powershell.exe
1060	powershell.exe
1056	powershell.exe
3680	powershell.exe
2528	powershell.exe
2632	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

portagentintoMonitor.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	portagentintoMonitor.exe

Drops file in Program Files directory 6 IoCs

Processes:

portagentintoMonitor.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\121e5b5079f7c0	portagentintoMonitor.exe
File created	C:\Program Files (x86)\Windows Sidebar\csrss.exe	portagentintoMonitor.exe
File created	C:\Program Files (x86)\Windows Sidebar\886983d96e3d3e	portagentintoMonitor.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe	portagentintoMonitor.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\56085415360792	portagentintoMonitor.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\sysmon.exe	portagentintoMonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

5968 PING.EXE
Modifies registry class 1 IoCs

Processes:

portagentintoMonitor.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings portagentintoMonitor.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5968 PING.EXE

pid	process
5968	PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	portagentintoMonitor.exe

pid	process
5968	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
3668	schtasks.exe
2512	schtasks.exe
4232	schtasks.exe
2464	schtasks.exe
4088	schtasks.exe
1116	schtasks.exe
3788	schtasks.exe
4204	schtasks.exe
1812	schtasks.exe
1960	schtasks.exe
3436	schtasks.exe
3916	schtasks.exe
2544	schtasks.exe
4792	schtasks.exe
1676	schtasks.exe
4036	schtasks.exe
4612	schtasks.exe
4784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

portagentintoMonitor.exe

pid	process
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe
3132	portagentintoMonitor.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

portagentintoMonitor.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeportagentintoMonitor.exe

description	pid	process
Token: SeDebugPrivilege	3132	portagentintoMonitor.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	368	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	2092	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeDebugPrivilege	3404	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	5584	portagentintoMonitor.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

portagentintoMonitor.execmd.exe

description	pid	process	target process
PID 3132 wrote to memory of 2632	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2632	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2788	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2788	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2528	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2528	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2108	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2108	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2384	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2384	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2824	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2824	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2092	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2092	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 4696	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 4696	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3088	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3088	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3404	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3404	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 1060	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 1060	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 368	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 368	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3680	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3680	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 4148	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 4148	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2648	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 2648	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3304	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3304	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 1056	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 1056	3132	portagentintoMonitor.exe	powershell.exe
PID 3132 wrote to memory of 3556	3132	portagentintoMonitor.exe	cmd.exe
PID 3132 wrote to memory of 3556	3132	portagentintoMonitor.exe	cmd.exe
PID 3556 wrote to memory of 5692	3556	cmd.exe	chcp.com
PID 3556 wrote to memory of 5692	3556	cmd.exe	chcp.com
PID 3556 wrote to memory of 5968	3556	cmd.exe	PING.EXE
PID 3556 wrote to memory of 5968	3556	cmd.exe	PING.EXE
PID 3556 wrote to memory of 5584	3556	cmd.exe	portagentintoMonitor.exe
PID 3556 wrote to memory of 5584	3556	cmd.exe	portagentintoMonitor.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe
"C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Application Data\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VdeTkJhAdR.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5692
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe
    "C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Application Data\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Application Data\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portagentintoMonitorp" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portagentintoMonitor" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "portagentintoMonitorp" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\portagentintoMonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\portagentintoMonitor.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a5e1f1efff867a822c6a57ee928dd66

SHA1
b017854d8a1deb05f1447e9dd6002902fb66bf6b

SHA256
8222fe869b025493591ca2ffbabe089c2e682449e77b754fc864ba62d64ee957

SHA512
25fc0fd6a71595c44efe34d281c4bc4924ac82f76b9f697497d0019fa2c8e0cadf58f92ae4272f00b1ef1e97dfd93bd740a9e7f7d9dc93cb1cadbde5f93d1782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
28d4235aa2e6d782751f980ceb6e5021

SHA1
f5d82d56acd642b9fc4b963f684fd6b78f25a140

SHA256
8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638

SHA512
dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\VdeTkJhAdR.bat

Filesize
186B

MD5
9e47a0f1fc5e11e6d82b0556175d0906

SHA1
8ce53e4c74c20fd95bb8f3f6c5eb2f934df5d4fb

SHA256
cd13ad956926e6113dc58f7c188e794a985f06361a70932bcf548347b8a9af9f

SHA512
7ff1c91bde3dd2abad7805015dc6f6f268679a095df3bb68daf2872e427167485d417fc33af5d57abac2a2fa9cb34766b6d172011ff49d0de0fe949515dabc59

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_veyw5ct3.c1p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\smss.exe

Filesize
1.8MB

MD5
eaafeeda68b54d3fee1027ad70851ceb

SHA1
602017682f89305d82d69dc80135df337d9cc330

SHA256
87740815e35062cc764dd770497f2e8b0497ace5201bfd0ffcc7138dfce51b88

SHA512
6622411603526cc05095d1c92b5629408387e6a789b1ce69f951435df7531a183544309f8abc35ebeee25ed25d117abefaeb705a6981c13d24161e5bc2f1e2e8

Download Submit
memory/2632-65-0x000002E5F1970000-0x000002E5F1992000-memory.dmp

Filesize
136KB

Download
memory/3132-13-0x0000000002BB0000-0x0000000002BC8000-memory.dmp

Filesize
96KB

Download
memory/3132-1-0x0000000000770000-0x000000000094C000-memory.dmp

Filesize
1.9MB

Download
memory/3132-16-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-29-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-30-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-31-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-35-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-38-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-15-0x00000000012C0000-0x00000000012CC000-memory.dmp

Filesize
48KB

Download
memory/3132-18-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-11-0x000000001B510000-0x000000001B560000-memory.dmp

Filesize
320KB

Download
memory/3132-10-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-9-0x00000000012E0000-0x00000000012FC000-memory.dmp

Filesize
112KB

Download
memory/3132-7-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-6-0x0000000001220000-0x000000000122E000-memory.dmp

Filesize
56KB

Download
memory/3132-4-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-3-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-2-0x00007FF8DBE30000-0x00007FF8DC8F1000-memory.dmp

Filesize
10.8MB

Download
memory/3132-0-0x00007FF8DBE33000-0x00007FF8DBE35000-memory.dmp

Filesize
8KB

Download