dcrat | f9ce5f29f9fee9b30206253d77cf17870ee82765b36f51749e08b3a14d52d6db

Analysis

max time kernel
62s
max time network
105s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
20-11-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

install.exe
Size

4.3MB
MD5

c8868d0efa08db9acf9f1be0ea1de96b
SHA1

327b71fa12b87caf9868a6bc18857f78a19fbc43
SHA256

f9ce5f29f9fee9b30206253d77cf17870ee82765b36f51749e08b3a14d52d6db
SHA512

5ac067b46391fb2c41487235eb2a3e57d8b2984ee906f869ad8a20154baba09c09852d9384999bbdee6a2f83263201dcc811bf8386fba3a9a2151c181d6d4690
SSDEEP

98304:4Ps0/vuEKE162HsxtixUU4hR1HxtixUU4hR1F:KaTxtixRCZxtixRC3

Score

10^/10

dcrat discovery infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\wininit.exe\", \"C:\\Users\\All Users\\Microsoft\\Windows Defender\\System.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\wininit.exe\", \"C:\\Users\\All Users\\Microsoft\\Windows Defender\\System.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\FaPY477v1P.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Music\\RuntimeBroker.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\", \"C:\\Users\\Default\\Music\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Google\\Update\\wininit.exe\""	FaPY477v1P.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	920	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3564	920	schtasks.exe	92

DCRat payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x0029000000045074-34.dat	family_dcrat_v2
behavioral1/memory/568-33-0x0000000000400000-0x0000000000510000-memory.dmp	family_dcrat_v2
behavioral1/memory/1988-37-0x0000000000310000-0x00000000003EA000-memory.dmp	family_dcrat_v2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	FaPY477v1P.exe

Executes dropped EXE 3 IoCs

pid	Process
1880	RkQPx1nNk6.exe
1988	FaPY477v1P.exe
4488	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Music\\RuntimeBroker.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Google\\Update\\wininit.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FaPY477v1P = "\"C:\\Users\\Admin\\AppData\\Roaming\\FaPY477v1P.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default\\Music\\RuntimeBroker.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Google\\Update\\wininit.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\Microsoft\\Windows Defender\\System.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\Microsoft\\Windows Defender\\System.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FaPY477v1P = "\"C:\\Users\\Admin\\AppData\\Roaming\\FaPY477v1P.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Common Files\\Services\\RuntimeBroker.exe\""	FaPY477v1P.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	FaPY477v1P.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC8270A442E5C248C8A272A1118AF6BE6.TMP	csc.exe
File created	\??\c:\Windows\System32\o4w30s.exe	csc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1784 set thread context of 568	1784	install.exe	83

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\wininit.exe	FaPY477v1P.exe
File created	C:\Program Files (x86)\Google\Update\56085415360792	FaPY477v1P.exe
File created	C:\Program Files\Common Files\Services\RuntimeBroker.exe	FaPY477v1P.exe
File created	C:\Program Files\Common Files\Services\9e8d7a4ca61bd9	FaPY477v1P.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	1784	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	install.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	FaPY477v1P.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
444	schtasks.exe
840	schtasks.exe
2140	schtasks.exe
1352	schtasks.exe
3564	schtasks.exe
2668	schtasks.exe
2012	schtasks.exe
4952	schtasks.exe
1572	schtasks.exe
4084	schtasks.exe
5060	schtasks.exe
4120	schtasks.exe
1288	schtasks.exe
4180	schtasks.exe
1996	schtasks.exe
2900	schtasks.exe
2824	schtasks.exe
2280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe
1988	FaPY477v1P.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	FaPY477v1P.exe
Token: SeDebugPrivilege	4488	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4488	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 1784 wrote to memory of 568	1784	install.exe	83
PID 568 wrote to memory of 1880	568	install.exe	87
PID 568 wrote to memory of 1880	568	install.exe	87
PID 568 wrote to memory of 1988	568	install.exe	89
PID 568 wrote to memory of 1988	568	install.exe	89
PID 1988 wrote to memory of 3952	1988	FaPY477v1P.exe	97
PID 1988 wrote to memory of 3952	1988	FaPY477v1P.exe	97
PID 3952 wrote to memory of 4324	3952	csc.exe	99
PID 3952 wrote to memory of 4324	3952	csc.exe	99
PID 1988 wrote to memory of 1344	1988	FaPY477v1P.exe	116
PID 1988 wrote to memory of 1344	1988	FaPY477v1P.exe	116
PID 1344 wrote to memory of 4708	1344	cmd.exe	118
PID 1344 wrote to memory of 4708	1344	cmd.exe	118
PID 1344 wrote to memory of 2548	1344	cmd.exe	119
PID 1344 wrote to memory of 2548	1344	cmd.exe	119
PID 1344 wrote to memory of 4488	1344	cmd.exe	122
PID 1344 wrote to memory of 4488	1344	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\install.exe
  "C:\Users\Admin\AppData\Local\Temp\install.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Users\Admin\AppData\Roaming\RkQPx1nNk6.exe
    "C:\Users\Admin\AppData\Roaming\RkQPx1nNk6.exe"
    3⤵
    - Executes dropped EXE
    PID:1880
- - C:\Users\Admin\AppData\Roaming\FaPY477v1P.exe
    "C:\Users\Admin\AppData\Roaming\FaPY477v1P.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\urocnujc\urocnujc.cmdline"
      4⤵
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC15C.tmp" "c:\Windows\System32\CSC8270A442E5C248C8A272A1118AF6BE6.TMP"
        5⤵
        
        PID:4324
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Cq6BV118wO.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4708
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:2548
    - - C:\Users\Default\Music\RuntimeBroker.exe
        
        "C:\Users\Default\Music\RuntimeBroker.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 312
  2⤵
  - Program crash
  PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1784 -ip 1784
1⤵
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\Services\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\Services\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Music\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft\Windows Defender\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Windows Defender\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "FaPY477v1PF" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\FaPY477v1P.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "FaPY477v1P" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\FaPY477v1P.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "FaPY477v1PF" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Roaming\FaPY477v1P.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cq6BV118wO.bat

Filesize
216B

MD5
176070b00759051d9a932ad2259db157

SHA1
c46ce54c1ddf063fc693bb514e8c5d3bded967ce

SHA256
2640b860929474ee225c4568ae39cdf2e0750bee754ee1af32afbdf3a0a55976

SHA512
e3405c47abff8b351d9ce4d73f4b07908b178a95ccf3222d9834137578078932768770d0e699bb486dfcdf7ed34b75d3b908196d5a1aed3c2a1d26f19f92d4eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC15C.tmp

Filesize
1KB

MD5
06eff2742134b81b8c2403e14369a236

SHA1
2422dbfa2dd9e8688bda1e9443f814bf059f4aee

SHA256
1a12d6a38761179226a11f24132fbdec69d4b3cc23d002e39a85f02cef6d35f1

SHA512
a965930815de3cc9180dacb9d2dce68f6d34b171596f3baf42dcce446d20374a16fb00844fce77994a2f3d0a6e8e6c003c7a5e5609c9bad99e5c80c11d53314d

Download Submit
C:\Users\Admin\AppData\Roaming\FaPY477v1P.exe

Filesize
843KB

MD5
32cae9f5844cb03f0504c3ba6519c937

SHA1
6886d2706d23fc131e21c9e96f25c641ac04db15

SHA256
f147fbaad060811085df8d6f6324c395a8552896e7b611ec24ba9a506f04c3c0

SHA512
dd5c3f0adc23bae3c71775227b326abecd8668ff56ecac7030663129d5d99efd6c454057733d41ccc38e680e95f2669d2e110c29714b295932c59ed49ae2039e

Download Submit
C:\Users\Admin\AppData\Roaming\RkQPx1nNk6.exe

Filesize
18KB

MD5
f3edff85de5fd002692d54a04bcb1c09

SHA1
4c844c5b0ee7cb230c9c28290d079143e00cb216

SHA256
caf29650446db3842e1c1e8e5e1bafadaf90fc82c5c37b9e2c75a089b7476131

SHA512
531d920e2567f58e8169afc786637c1a0f7b9b5c27b27b5f0eddbfc3e00cecd7bea597e34061d836647c5f8c7757f2fe02952a9793344e21b39ddd4bf7985f9d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\urocnujc\urocnujc.0.cs

Filesize
388B

MD5
598d30acd16ac06a082756cba74761cf

SHA1
5ce21c91fc1ee835aedb79c5a2c7a684f513532b

SHA256
89c589c3202ad49ff405f4f48574e32fe4152286e4dd076cff204904b5dec19d

SHA512
6888c072361479be59814ec9fd69737b742ea5584a0d26e65fae6ee934bb419b957c0ef943774607190a467da78c2b8d44d9656c9639c4181705fdaebf35c7f3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\urocnujc\urocnujc.cmdline

Filesize
235B

MD5
9cdd1dc1f33dd37a60c59a80180deac0

SHA1
fe444ba6191ecf2ee66d376655d9929b1d341864

SHA256
9f0a9a6c552b7d1163a9058a010e65e547c066afc411128191afa913ca7ffb6d

SHA512
f653aefabdead10c161ae6544291848355306bdb0554b5692a68dd758adfe6141f05ba642a70b8e8a82169b5852b12a4d0bf78c2b7256f00f32722dba155aa04

Download Submit
\??\c:\Windows\System32\CSC8270A442E5C248C8A272A1118AF6BE6.TMP

Filesize
1KB

MD5
2ddaf10e7350236c8cb4081912188ca2

SHA1
2a13673a51e96fef6374a4a6748157f19ebbdbfa

SHA256
c4d9cf358c5fef64c8dc24d46b1c43130b5177bdf381d5062e5fd093b3e7e64b

SHA512
2edbc7b83b15203e14520a77bbcc777e26d807f438288a10d5e9ea5dae002f00513d6b9c29ffe39b117c8319418087f6394da1949c0bfb3065b76e24260b0861

Download Submit
memory/568-3-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/568-2-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/568-5-0x0000000000C00000-0x0000000001046000-memory.dmp

Filesize
4.3MB

Download
memory/568-33-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/568-4-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/568-1-0x0000000000400000-0x0000000000510000-memory.dmp

Filesize
1.1MB

Download
memory/1784-0-0x0000000000E25000-0x0000000000E26000-memory.dmp

Filesize
4KB

Download
memory/1988-46-0x0000000000BF0000-0x0000000000C08000-memory.dmp

Filesize
96KB

Download
memory/1988-61-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download
memory/1988-43-0x0000000000BD0000-0x0000000000BEC000-memory.dmp

Filesize
112KB

Download
memory/1988-49-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download
memory/1988-48-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download
memory/1988-50-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download
memory/1988-51-0x000000001CA10000-0x000000001CF38000-memory.dmp

Filesize
5.2MB

Download
memory/1988-53-0x0000000000A90000-0x0000000000A9E000-memory.dmp

Filesize
56KB

Download
memory/1988-54-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download
memory/1988-44-0x0000000000C80000-0x0000000000CD0000-memory.dmp

Filesize
320KB

Download
memory/1988-62-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download
memory/1988-41-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download
memory/1988-40-0x0000000000A80000-0x0000000000A8E000-memory.dmp

Filesize
56KB

Download
memory/1988-38-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download
memory/1988-37-0x0000000000310000-0x00000000003EA000-memory.dmp

Filesize
872KB

Download
memory/1988-36-0x00007FF8DEC73000-0x00007FF8DEC75000-memory.dmp

Filesize
8KB

Download
memory/1988-83-0x00007FF8DEC70000-0x00007FF8DF732000-memory.dmp

Filesize
10.8MB

Download