Analysis
-
max time kernel
91s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 13:57
Static task
static1
Behavioral task
behavioral1
Sample
a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe
Resource
win10v2004-20241007-en
General
-
Target
a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe
-
Size
10.1MB
-
MD5
2ee8eb2b3997b0cce6cc7c562a785719
-
SHA1
b2d31d2a30815fa0c6dd1e637d7276bfb0547411
-
SHA256
a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae
-
SHA512
34ee0171c041205b4b6bb631e0b72fb2f4d3056892281839f0b2e63b9f1997e037755cedd0d56dd64d96ddc878874148611f6eb4ee83238dd560ed59848e8059
-
SSDEEP
24576:W+O4GptFtiU9SsYm1oO9teGnlcZ/uIO0EdZX0usIW6fgtixy4s+8BIbT19h8OCht:x5o9Y+Iu0u+YoAgO9kK4XyWDAyH6eB
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\System32\\tcpmon\\dwm.exe\", \"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\ideograf\\dwm.exe\", \"C:\\Windows\\System32\\licensingdiag\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\LanguageOverlayServer\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\System32\\tcpmon\\dwm.exe\", \"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\ideograf\\dwm.exe\", \"C:\\Windows\\System32\\licensingdiag\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\LanguageOverlayServer\\dwm.exe\", \"C:\\Windows\\System32\\wbem\\WmiDcPrv\\unsecapp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\System32\\tcpmon\\dwm.exe\", \"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\ideograf\\dwm.exe\", \"C:\\Windows\\System32\\licensingdiag\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\LanguageOverlayServer\\dwm.exe\", \"C:\\Windows\\System32\\wbem\\WmiDcPrv\\unsecapp.exe\", \"C:\\Windows\\System32\\Mpeg2Data\\lsass.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\System32\\tcpmon\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\System32\\tcpmon\\dwm.exe\", \"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\System32\\tcpmon\\dwm.exe\", \"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\ideograf\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\", \"C:\\Windows\\regedit\\explorer.exe\", \"C:\\Users\\Public\\Music\\sihost.exe\", \"C:\\Documents and Settings\\SearchApp.exe\", \"C:\\Windows\\System32\\tcpmon\\dwm.exe\", \"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\", \"C:\\Windows\\System32\\ideograf\\dwm.exe\", \"C:\\Windows\\System32\\licensingdiag\\RuntimeBroker.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe -
Process spawned unexpected child process 11 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3936 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1632 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4876 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3832 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4224 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2192 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1080 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 328 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3004 2080 schtasks.exe 82 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 2080 schtasks.exe 82 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe -
Executes dropped EXE 1 IoCs
pid Process 5016 dwm.exe -
Adds Run key to start application 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\Mpeg2Data\\lsass.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\WmiDcPrv\\unsecapp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\Mpeg2Data\\lsass.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\Music\\sihost.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Documents and Settings\\SearchApp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\ideograf\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ProgramData\\USOShared\\RuntimeBroker.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\ideograf\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\licensingdiag\\RuntimeBroker.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\LanguageOverlayServer\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\WmiDcPrv\\unsecapp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\regedit\\explorer.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Public\\Music\\sihost.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\tcpmon\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\tcpmon\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\licensingdiag\\RuntimeBroker.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\LanguageOverlayServer\\dwm.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\rspndr\\unsecapp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\regedit\\explorer.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Documents and Settings\\SearchApp.exe\"" a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe -
Drops file in System32 directory 16 IoCs
description ioc Process File created C:\Windows\System32\wbem\rspndr\unsecapp.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File opened for modification C:\Windows\System32\wbem\rspndr\unsecapp.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\ideograf\dwm.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\wbem\rspndr\29c1c3cc0f76855c7e7456076a4ffc27e4947119 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File opened for modification C:\Windows\System32\tcpmon\dwm.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\tcpmon\6cb0b6c459d5d3455a3da700e713f2e2529862ff a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\licensingdiag\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\LanguageOverlayServer\dwm.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\wbem\WmiDcPrv\unsecapp.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\wbem\WmiDcPrv\29c1c3cc0f76855c7e7456076a4ffc27e4947119 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\Mpeg2Data\lsass.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\tcpmon\dwm.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\ideograf\6cb0b6c459d5d3455a3da700e713f2e2529862ff a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\LanguageOverlayServer\6cb0b6c459d5d3455a3da700e713f2e2529862ff a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\licensingdiag\RuntimeBroker.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\System32\Mpeg2Data\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\regedit\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe File created C:\Windows\regedit\explorer.exe a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2192 schtasks.exe 2712 schtasks.exe 3936 schtasks.exe 1632 schtasks.exe 4876 schtasks.exe 3832 schtasks.exe 4224 schtasks.exe 1080 schtasks.exe 328 schtasks.exe 3004 schtasks.exe 1088 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1608 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe 1124 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe 5016 dwm.exe 5016 dwm.exe 5016 dwm.exe 5016 dwm.exe 5016 dwm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1608 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Token: SeDebugPrivilege 1124 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe Token: SeDebugPrivilege 5016 dwm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1608 wrote to memory of 1124 1608 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe 87 PID 1608 wrote to memory of 1124 1608 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe 87 PID 1124 wrote to memory of 4992 1124 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe 95 PID 1124 wrote to memory of 4992 1124 a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe 95 PID 4992 wrote to memory of 2948 4992 cmd.exe 97 PID 4992 wrote to memory of 2948 4992 cmd.exe 97 PID 4992 wrote to memory of 5016 4992 cmd.exe 100 PID 4992 wrote to memory of 5016 4992 cmd.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe"C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe"C:\Users\Admin\AppData\Local\Temp\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RbgId1oCFU.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵PID:2948
-
-
C:\Windows\System32\tcpmon\dwm.exe"C:\Windows\System32\tcpmon\dwm.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\rspndr\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\regedit\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Music\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Documents and Settings\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\tcpmon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProgramData\USOShared\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\ideograf\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\licensingdiag\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\LanguageOverlayServer\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\WmiDcPrv\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\Mpeg2Data\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae.exe.log
Filesize1KB
MD5b7c0c43fc7804baaa7dc87152cdc9554
SHA11bab62bd56af745678d4e967d91e1ccfdeed4038
SHA25646386a61f3aaf1b1c2e6efc9fc7e9e9ff16cd13ae58b8d856835771fedb6d457
SHA5129fda3dd00a3406137e0113f13f78e77b20a76512b35820d38df696842cbbf2e2ebabfb99a3846c9637ecb54af858ec1551521187e379872973006426a253f769
-
Filesize
198B
MD5226bdd756748251c1d3043c934703ced
SHA11c80e92001d3a0ac74c8c6dd757eb5536ca9f43a
SHA2567f8b9df0963529cef51b578a621c602e04917a351a8fdb84a1f4be443eb730c7
SHA512b66aa21b9fb3dbae8cdd42a4552936787c4424297466a5d5d9ed665c60a1bfbf5f077e9a735bae38b4c0d2a060dca5b0be185b7466f629f136e15d60362a850f
-
Filesize
10.1MB
MD52ee8eb2b3997b0cce6cc7c562a785719
SHA1b2d31d2a30815fa0c6dd1e637d7276bfb0547411
SHA256a9c9416b056e0834e13cc89adf3f8960fac7d0314a7474368df1a56a3404e8ae
SHA51234ee0171c041205b4b6bb631e0b72fb2f4d3056892281839f0b2e63b9f1997e037755cedd0d56dd64d96ddc878874148611f6eb4ee83238dd560ed59848e8059