dcrat | 961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe
Size

1.9MB
MD5

897337394338c3de4be5d55a5d23595a
SHA1

33712202b478a39b89b6d81dc757ab3ee9c52923
SHA256

961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d
SHA512

1c30fbe2772accec7da8503064c82f364168e4e5359896a54afb47c72c117e7ee01d0b9a87fd9b89bb79e3dcd9985ef8d2d8e90bc1fe2c04c7ee237cc7939296
SSDEEP

49152:OB8cAUiFBfBfQigyb/9aYabCnHLuoLk+kig2+5HNf:Q/iF/fQdCrzLk+kiIXf

Score

10^/10

dcrat discovery execution infostealer rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	1156	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1156	schtasks.exe	87

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
4968	powershell.exe
4936	powershell.exe
1408	powershell.exe
3172	powershell.exe
2184	powershell.exe
1076	powershell.exe
3980	powershell.exe
3324	powershell.exe
3216	powershell.exe
2188	powershell.exe
1204	powershell.exe
2628	powershell.exe
3472	powershell.exe
1692	powershell.exe
4344	powershell.exe
4888	powershell.exe
1272	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exeWScript.exeWinRAR.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WinRAR.exe

Executes dropped EXE 2 IoCs

Processes:

WinRAR.exeWinRAR.exe

pid	Process
2932	WinRAR.exe
3196	WinRAR.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
21	ipinfo.io
20	ipinfo.io

Drops file in Windows directory 5 IoCs

Processes:

WinRAR.exe

description	ioc	Process
File opened for modification	C:\Windows\IME\de-DE\RuntimeBroker.exe	WinRAR.exe
File created	C:\Windows\IME\de-DE\9e8d7a4ca61bd9	WinRAR.exe
File created	C:\Windows\INF\MSDTC\0407\RuntimeBroker.exe	WinRAR.exe
File created	C:\Windows\INF\MSDTC\0407\9e8d7a4ca61bd9	WinRAR.exe
File created	C:\Windows\IME\de-DE\RuntimeBroker.exe	WinRAR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exeWScript.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

Processes:

961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exeWinRAR.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	WinRAR.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
4956	schtasks.exe
3048	schtasks.exe
2236	schtasks.exe
4040	schtasks.exe
3916	schtasks.exe
1676	schtasks.exe
4924	schtasks.exe
3984	schtasks.exe
4576	schtasks.exe
4876	schtasks.exe
992	schtasks.exe
5076	schtasks.exe
1004	schtasks.exe
2692	schtasks.exe
2856	schtasks.exe
880	schtasks.exe
2200	schtasks.exe
4372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

WinRAR.exe

pid	Process
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe
2932	WinRAR.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

WinRAR.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeWinRAR.exe

description	pid	Process
Token: SeDebugPrivilege	2932	WinRAR.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	1408	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	3196	WinRAR.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exeWScript.execmd.exeWinRAR.execmd.exe

description	pid	Process	procid_target
PID 2244 wrote to memory of 2980	2244	961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe	89
PID 2244 wrote to memory of 2980	2244	961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe	89
PID 2244 wrote to memory of 2980	2244	961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe	89
PID 2980 wrote to memory of 3100	2980	WScript.exe	91
PID 2980 wrote to memory of 3100	2980	WScript.exe	91
PID 2980 wrote to memory of 3100	2980	WScript.exe	91
PID 3100 wrote to memory of 2932	3100	cmd.exe	94
PID 3100 wrote to memory of 2932	3100	cmd.exe	94
PID 2932 wrote to memory of 2628	2932	WinRAR.exe	118
PID 2932 wrote to memory of 2628	2932	WinRAR.exe	118
PID 2932 wrote to memory of 3472	2932	WinRAR.exe	119
PID 2932 wrote to memory of 3472	2932	WinRAR.exe	119
PID 2932 wrote to memory of 1692	2932	WinRAR.exe	120
PID 2932 wrote to memory of 1692	2932	WinRAR.exe	120
PID 2932 wrote to memory of 4968	2932	WinRAR.exe	121
PID 2932 wrote to memory of 4968	2932	WinRAR.exe	121
PID 2932 wrote to memory of 3980	2932	WinRAR.exe	122
PID 2932 wrote to memory of 3980	2932	WinRAR.exe	122
PID 2932 wrote to memory of 1076	2932	WinRAR.exe	123
PID 2932 wrote to memory of 1076	2932	WinRAR.exe	123
PID 2932 wrote to memory of 3324	2932	WinRAR.exe	124
PID 2932 wrote to memory of 3324	2932	WinRAR.exe	124
PID 2932 wrote to memory of 3216	2932	WinRAR.exe	125
PID 2932 wrote to memory of 3216	2932	WinRAR.exe	125
PID 2932 wrote to memory of 4936	2932	WinRAR.exe	126
PID 2932 wrote to memory of 4936	2932	WinRAR.exe	126
PID 2932 wrote to memory of 1408	2932	WinRAR.exe	127
PID 2932 wrote to memory of 1408	2932	WinRAR.exe	127
PID 2932 wrote to memory of 2188	2932	WinRAR.exe	128
PID 2932 wrote to memory of 2188	2932	WinRAR.exe	128
PID 2932 wrote to memory of 4344	2932	WinRAR.exe	131
PID 2932 wrote to memory of 4344	2932	WinRAR.exe	131
PID 2932 wrote to memory of 1204	2932	WinRAR.exe	140
PID 2932 wrote to memory of 1204	2932	WinRAR.exe	140
PID 2932 wrote to memory of 2184	2932	WinRAR.exe	142
PID 2932 wrote to memory of 2184	2932	WinRAR.exe	142
PID 2932 wrote to memory of 3172	2932	WinRAR.exe	143
PID 2932 wrote to memory of 3172	2932	WinRAR.exe	143
PID 2932 wrote to memory of 1272	2932	WinRAR.exe	144
PID 2932 wrote to memory of 1272	2932	WinRAR.exe	144
PID 2932 wrote to memory of 4888	2932	WinRAR.exe	145
PID 2932 wrote to memory of 4888	2932	WinRAR.exe	145
PID 2932 wrote to memory of 3176	2932	WinRAR.exe	152
PID 2932 wrote to memory of 3176	2932	WinRAR.exe	152
PID 3176 wrote to memory of 5656	3176	cmd.exe	154
PID 3176 wrote to memory of 5656	3176	cmd.exe	154
PID 3176 wrote to memory of 6028	3176	cmd.exe	155
PID 3176 wrote to memory of 6028	3176	cmd.exe	155
PID 3176 wrote to memory of 3196	3176	cmd.exe	157
PID 3176 wrote to memory of 3196	3176	cmd.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe
"C:\Users\Admin\AppData\Local\Temp\961491690742f96da48d1ca1c9dcb91b0d23a803e16dcc8852d90b2f4e54028d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\PN3845DtPXfCcoisvbdBJiLsp6plsWC5nHzTerGVBK9Aa7lWb6.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\OrxRhfTKfGvHwDBiFG3cEmHkYN.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\WinRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850/Root/Resources/bin/cache/winrar-x64-701ru/WinRAR.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\MSDTC\0407\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Oracle\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\de-DE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\WinRAR.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xkxPaijJFf.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3176
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5656
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\WinRAR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\WinRAR.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\INF\MSDTC\0407\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\INF\MSDTC\0407\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\INF\MSDTC\0407\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Oracle\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Oracle\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Oracle\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\IME\de-DE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IME\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Windows\IME\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinRARW" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\WinRAR.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinRAR" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\WinRAR.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinRARW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\WinRAR.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WinRAR.exe.log

Filesize
1KB

MD5
cb4338b342d00bfe6111ffee5cbfc2ed

SHA1
fc16673b6833ad3cb00743a32868b859e90aa536

SHA256
343ed6661687e81c9615dcaea42fb1a98b70572bb9fe07e16f020108725dbbe9

SHA512
4bcea1366b8be00d08eb15cfd78c87e1c8f3aea140a4ea30efb3c0511cd3de21b7ce8c933c7478fb06a356573ecb928e50df23d340fbd9a6e6c156a004d2a77a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ak5gqzqm.34p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\OrxRhfTKfGvHwDBiFG3cEmHkYN.bat

Filesize
140B

MD5
bb47412af9d5e3192218ee1de8ce3e99

SHA1
15e980722e57fe678cced7441e89234b0590241d

SHA256
2ac628b32907d0b2545bf2954e31bfe10553c4ed061ee662184a25c0fa19792a

SHA512
db660453f66b054b11fd99bb9eda292d3b8dfd64bc75f7af810ab04ccd025c6fbe7d36e62ee14716ac932e3eb7b9e978ae41c3398b2b06216ea4373458b0532f

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_BITS_8712_1425929850\Root\Resources\bin\cache\winrar-x64-701ru\PN3845DtPXfCcoisvbdBJiLsp6plsWC5nHzTerGVBK9Aa7lWb6.vbe

Filesize
277B

MD5
8b13dc9793a5e8ec37e0413d8dcf35ac

SHA1
1069fccfdfad6aa0c331a6861c7f1d6c544c1a98

SHA256
c2ac42b495068dc4b86c5d58c30caa1a7e4e2b63c3dba39e0bf79c106d37cb89

SHA512
e7ca859c50a9ed50a865c7efb9fdf873c2db0cc468a6302690c975e7b36d64dc53c3bf7ea5ae336020ff77aaf9ff02f73278b344f64ac0a3a92febc5908d029a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xkxPaijJFf.bat

Filesize
290B

MD5
8a4496dfbe37cbb43342474ad765e0d6

SHA1
9ad92867da0afbb7d792a1805a7a6c8d00d94443

SHA256
8b4d24082c47db5d71832530ba412790a1ee9d72b286ff5839c58116d7a3eaca

SHA512
6c2ae48361f2d550dbfad3021401061699fb2675993e09235b3fd13e2a49806fb7f64b0fad7fdd3b10136bf260fef222af2be5c6c5783dda7b09d90ccafcf590

Download Submit
memory/2628-56-0x000002E543660000-0x000002E543682000-memory.dmp

Filesize
136KB

Download
memory/2932-18-0x000000001B170000-0x000000001B1C0000-memory.dmp

Filesize
320KB

Download
memory/2932-30-0x000000001B050000-0x000000001B05C000-memory.dmp

Filesize
48KB

Download
memory/2932-28-0x000000001B040000-0x000000001B048000-memory.dmp

Filesize
32KB

Download
memory/2932-26-0x000000001AFD0000-0x000000001AFDE000-memory.dmp

Filesize
56KB

Download
memory/2932-24-0x000000001AFC0000-0x000000001AFCC000-memory.dmp

Filesize
48KB

Download
memory/2932-22-0x000000001B020000-0x000000001B032000-memory.dmp

Filesize
72KB

Download
memory/2932-20-0x000000001B000000-0x000000001B018000-memory.dmp

Filesize
96KB

Download
memory/2932-17-0x000000001AFE0000-0x000000001AFFC000-memory.dmp

Filesize
112KB

Download
memory/2932-15-0x000000001AFB0000-0x000000001AFBE000-memory.dmp

Filesize
56KB

Download
memory/2932-13-0x00000000002C0000-0x00000000004C0000-memory.dmp

Filesize
2.0MB

Download
memory/2932-12-0x00007FFA80EA3000-0x00007FFA80EA5000-memory.dmp

Filesize
8KB

Download