dcrat | 30e973ae2b2420c2506000813d5fc3fb12c4bedc3595b00b097840b597018df9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FATALITY/loader.exe
Size

3.2MB
MD5

8faa9e2bbcb1f98cb3971b94f9feda41
SHA1

ab03732cdbc58c752057f2dd3c39e164e222476f
SHA256

026825e9ca81fe52b1833a5e2c838336bc645778da89ff5c266c65c9d750a490
SHA512

5a660bddaf58c15503861663d018e3444c40fc9a62cc2953a60e41c78561014db4911d4f1da80f70a492d6ff912765d93e08c3c39fce921580b034dfcc47d358
SSDEEP

98304:fP8sZQDJ8Apc4VDuZc3PT9ejwigyEgKSkzd1kl86:cs6lrDlT9ej7UgKBLy

Score

10^/10

dcrat discovery infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\RuntimeBroker.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\conhost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\conhost.exe\", \"C:\\Program Files (x86)\\Adobe\\sppsvc.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\conhost.exe\", \"C:\\Program Files (x86)\\Adobe\\sppsvc.exe\", \"C:\\Users\\Default\\Links\\dllhost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\conhost.exe\", \"C:\\Program Files (x86)\\Adobe\\sppsvc.exe\", \"C:\\Users\\Default\\Links\\dllhost.exe\", \"C:\\bridgeHypercomComponentHost\\mscontainerWindll.exe\""	mscontainerWindll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3124	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3736	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3920	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	3620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	3620	schtasks.exe	88

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	mscontainerWindll.exe

Executes dropped EXE 2 IoCs

pid	Process
3740	mscontainerWindll.exe
436	sppsvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default\\Links\\dllhost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscontainerWindll = "\"C:\\bridgeHypercomComponentHost\\mscontainerWindll.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\RuntimeBroker.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\conhost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\conhost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default\\Links\\dllhost.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\it-IT\\WaaSMedicAgent.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\RuntimeBroker.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Adobe\\sppsvc.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Adobe\\sppsvc.exe\""	mscontainerWindll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscontainerWindll = "\"C:\\bridgeHypercomComponentHost\\mscontainerWindll.exe\""	mscontainerWindll.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC8A64328D79304A059028867CAAE299.TMP	csc.exe
File created	\??\c:\Windows\System32\ovufcs.exe	csc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4872	loader.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe	mscontainerWindll.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\9e8d7a4ca61bd9	mscontainerWindll.exe
File created	C:\Program Files (x86)\Adobe\sppsvc.exe	mscontainerWindll.exe
File created	C:\Program Files (x86)\Adobe\0a1fd5f707cd16	mscontainerWindll.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe	mscontainerWindll.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\088424020bedd6	mscontainerWindll.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\it-IT\WaaSMedicAgent.exe	mscontainerWindll.exe
File created	C:\Windows\it-IT\c82b8037eab33d	mscontainerWindll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4912	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	mscontainerWindll.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4912	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3048	schtasks.exe
3736	schtasks.exe
3920	schtasks.exe
996	schtasks.exe
1616	schtasks.exe
3036	schtasks.exe
4604	schtasks.exe
912	schtasks.exe
884	schtasks.exe
3124	schtasks.exe
4972	schtasks.exe
228	schtasks.exe
4152	schtasks.exe
4052	schtasks.exe
4880	schtasks.exe
3624	schtasks.exe
2892	schtasks.exe
4424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4872	loader.exe
4872	loader.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe
3740	mscontainerWindll.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
436	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	mscontainerWindll.exe
Token: SeDebugPrivilege	436	sppsvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	loader.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3552	4872	loader.exe	83
PID 4872 wrote to memory of 3552	4872	loader.exe	83
PID 4872 wrote to memory of 3552	4872	loader.exe	83
PID 3552 wrote to memory of 1932	3552	WScript.exe	90
PID 3552 wrote to memory of 1932	3552	WScript.exe	90
PID 3552 wrote to memory of 1932	3552	WScript.exe	90
PID 1932 wrote to memory of 3740	1932	cmd.exe	92
PID 1932 wrote to memory of 3740	1932	cmd.exe	92
PID 3740 wrote to memory of 4820	3740	mscontainerWindll.exe	96
PID 3740 wrote to memory of 4820	3740	mscontainerWindll.exe	96
PID 4820 wrote to memory of 4672	4820	csc.exe	100
PID 4820 wrote to memory of 4672	4820	csc.exe	100
PID 3740 wrote to memory of 4528	3740	mscontainerWindll.exe	116
PID 3740 wrote to memory of 4528	3740	mscontainerWindll.exe	116
PID 4528 wrote to memory of 4060	4528	cmd.exe	118
PID 4528 wrote to memory of 4060	4528	cmd.exe	118
PID 4528 wrote to memory of 4912	4528	cmd.exe	119
PID 4528 wrote to memory of 4912	4528	cmd.exe	119
PID 4528 wrote to memory of 436	4528	cmd.exe	125
PID 4528 wrote to memory of 436	4528	cmd.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FATALITY\loader.exe
"C:\Users\Admin\AppData\Local\Temp\FATALITY\loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\bridgeHypercomComponentHost\u95boq3b7HFvqr.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\bridgeHypercomComponentHost\AAJff1lG8RICXs2A4EYTaC5p7dZ23zLFBkqYwYWng.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\bridgeHypercomComponentHost\mscontainerWindll.exe
      "C:\bridgeHypercomComponentHost/mscontainerWindll.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hgqsnnhl\hgqsnnhl.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4820
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1400.tmp" "c:\Windows\System32\CSC8A64328D79304A059028867CAAE299.TMP"
        6⤵
        
        PID:4672
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jf7QGqZyuS.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4528
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4060
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4912
      - C:\Program Files (x86)\Adobe\sppsvc.exe
        
        "C:\Program Files (x86)\Adobe\sppsvc.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Windows\it-IT\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\it-IT\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\Links\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Links\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindllm" /sc MINUTE /mo 11 /tr "'C:\bridgeHypercomComponentHost\mscontainerWindll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindll" /sc ONLOGON /tr "'C:\bridgeHypercomComponentHost\mscontainerWindll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscontainerWindllm" /sc MINUTE /mo 9 /tr "'C:\bridgeHypercomComponentHost\mscontainerWindll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES1400.tmp

Filesize
1KB

MD5
6da70fd89aa3af146fbe08f667c510e9

SHA1
a1f9808f1aeb5a942ec9e24e4aa7f2e5002a8c71

SHA256
0e196b46ad178a0f760cc8f676f583e46240d6fc021eb2b8c33db490602c41bb

SHA512
4596861636a919044e625c79d6ed3d73a2447d52b041501850e523fc265e83f44f998f8194b3ef28b2915ef058869d33270b064d174e882ae077d08e41901e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\jf7QGqZyuS.bat

Filesize
167B

MD5
d41ebf4f2186621680285bf23a4d67e4

SHA1
dae58767d3573eb7ccf01fd8e4fc35a112169a8e

SHA256
ef6b4d16a287c7febae7f577945da62604d6932de6053e94846015165a41e592

SHA512
074b484b3ab9e5eeda0e50e478557a006d2c89bb4b7146f8409a67f4104fd71b495e181589eb02466e018c44beb46132c0d83538644dec6f383c01c96434e178

Download Submit
C:\bridgeHypercomComponentHost\AAJff1lG8RICXs2A4EYTaC5p7dZ23zLFBkqYwYWng.bat

Filesize
108B

MD5
836fc705ac99bb9e9c32457cd334e13e

SHA1
ebbb2cfd6a3260e482447d1c7871391ea8c75551

SHA256
e0446f377405745b3712c210adeda645441bc9f6b987756b53aa05ed167fbf9c

SHA512
ae2915671fee13ce19947eed0733d3de5b462ca8ef55b422259814004cc51df54a1ea58a6659a36a886103e84191f93fee5d7a134a50439a81c856645f88cc90

Download Submit
C:\bridgeHypercomComponentHost\mscontainerWindll.exe

Filesize
1.9MB

MD5
5a7bf976e09d1835a65809093075a1bc

SHA1
d2de32c02c3d6e79f185b6b5f91e95144ae5a033

SHA256
20ea6e36a40896c99a0549118ac01b9508dd72b484050c9b2ce4fb5ac805a950

SHA512
60c6f582e29415186d2fef58a469a6bd87e84daf084d8705f09605f331d015abb1a825d06343a797532561915e754015692e745de21c55ed6e52cb5ba47129c6

Download Submit
C:\bridgeHypercomComponentHost\u95boq3b7HFvqr.vbe

Filesize
246B

MD5
a672021e4678a1cee46a924baa63411c

SHA1
c4c27bf73768a3cc97d070e3d560e4f45affe9b4

SHA256
65a576bed74898f83fd527be9a715aaac80609066d01e8b16a691c5287bd15b5

SHA512
ea08511f0859767abdbc080e7dcbad20bced260cfb2b58ba51cc8d48d544fb36256f56887c25763f25d799fa225674d487d6f5826f835fb8462c0c6441c64b67

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hgqsnnhl\hgqsnnhl.0.cs

Filesize
367B

MD5
464169e3704aac1bb1f61b8cf01b3a86

SHA1
53e6a84441b94a82432fe6aa499098a5c5bfabca

SHA256
fefb2e4c050893f56d8d10eb89a3f6559f414897805a678663be286dbc258ae1

SHA512
a9c5c80302304b409e269bb900c0b8e7dac43f775916663e9f35968be286ab553bfae38c343be9eb738e787f1ea866290b67d348642a105f661fbc5458bad080

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hgqsnnhl\hgqsnnhl.cmdline

Filesize
235B

MD5
f786036b4a332e9dcf8f6be5f2bfb8a2

SHA1
b0c6aaf83c6b294326c97fbca2bb1605c539de2e

SHA256
b763d6729171d99fdecac756de79057e82f192157ffdda5082e3abfa372f80fb

SHA512
9eae474c3c00c5912eb4e1856bfe07c66d567cb3c6b2383b8dc5e8158bfef986e47781c982e13d918b5086730181ebf159e6f649e73addc293f0d5e7265999c6

Download Submit
\??\c:\Windows\System32\CSC8A64328D79304A059028867CAAE299.TMP

Filesize
1KB

MD5
1c519e4618f2b468d0f490d4a716da11

SHA1
1a693d0046e48fa813e4fa3bb94ccd20d43e3106

SHA256
4dbf16e3b3bb06c98eeaf27d0a25d9f34ee0ceac51e6365218ef7cd09edb3438

SHA512
99f293878a08b56db6ff2297f243f5f5b85864e6925a1d6af61a65369f7eb323ae1b75fe5f1465fac0b982ac9f49b9e0a295b5dac947da40f61991c4411233fd

Download Submit
memory/3740-20-0x000000001B6D0000-0x000000001B6EC000-memory.dmp

Filesize
112KB

Download
memory/3740-21-0x000000001BB60000-0x000000001BBB0000-memory.dmp

Filesize
320KB

Download
memory/3740-23-0x000000001B6F0000-0x000000001B708000-memory.dmp

Filesize
96KB

Download
memory/3740-25-0x0000000002E90000-0x0000000002E9E000-memory.dmp

Filesize
56KB

Download
memory/3740-27-0x000000001B6B0000-0x000000001B6BC000-memory.dmp

Filesize
48KB

Download
memory/3740-18-0x0000000002E80000-0x0000000002E8E000-memory.dmp

Filesize
56KB

Download
memory/3740-15-0x00007FFB25093000-0x00007FFB25095000-memory.dmp

Filesize
8KB

Download
memory/3740-16-0x00000000009A0000-0x0000000000B86000-memory.dmp

Filesize
1.9MB

Download
memory/4872-0-0x0000000000D20000-0x0000000001116000-memory.dmp

Filesize
4.0MB

Download
memory/4872-10-0x0000000000D20000-0x0000000001116000-memory.dmp

Filesize
4.0MB

Download