dcrat | 93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1d

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Size

1.1MB
MD5

a4ea523b57cc90848732ee08117646d0
SHA1

a9706d93616af18f00027c6d9c29b6b877497c1e
SHA256

93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1d
SHA512

b280ef14615e5ebd8aece055c6a1eed253a68b47c26df4e92ed16df054db86d838495056806ff87893e04717e939983aae05dcf4c90eb1c5d2176728a0716a05
SSDEEP

24576:AMYPCI+q+U4cIG409ozWucypk1Nd4AX+iB/YjuM6kyh+i:ABPZ0Kr1FXHB/guM6k+V

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\dllhost.exe\", \"C:\\Users\\Default\\Application Data\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\dllhost.exe\", \"C:\\Users\\Default\\Application Data\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\dllhost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\dllhost.exe\", \"C:\\Users\\Default\\Application Data\\StartMenuExperienceHost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Users\\Admin\\Downloads\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\", \"C:\\Windows\\SoftwareDistribution\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\dllhost.exe\", \"C:\\Users\\Default\\Application Data\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\es-ES\\SppExtComObj.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	732	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	460	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	1004	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	1004	schtasks.exe	82

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3152-1-0x00000000008A0000-0x00000000009CE000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cbb-17.dat	dcrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe

Executes dropped EXE 1 IoCs

pid	Process
548	Idle.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Common Files\\DESIGNER\\dllhost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Common Files\\DESIGNER\\dllhost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\SoftwareDistribution\\dwm.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Internet Explorer\\es-ES\\SppExtComObj.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files (x86)\\Internet Explorer\\es-ES\\SppExtComObj.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Migration\\WTR\\Idle.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\sppsvc.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\SoftwareDistribution\\dwm.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Admin\\Downloads\\Idle.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Admin\\Downloads\\Idle.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Default\\Application Data\\StartMenuExperienceHost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Default\\Application Data\\StartMenuExperienceHost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\winlogon.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Migration\\WTR\\Idle.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\RuntimeBroker.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\SearchApp.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Mail\\TextInputHost.exe\""	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\DESIGNER\dllhost.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\cc11b995f2a76d	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Windows Mail\TextInputHost.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\SppExtComObj.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\e1ef82546f0b02	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\38384e6a620884	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Windows Mail\22eafd247d37c3	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files\Common Files\DESIGNER\5940a34987c991	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\SearchApp.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\sppsvc.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\0a1fd5f707cd16	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\9e8d7a4ca61bd9	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\6cb0b6c459d5d3	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Windows\Migration\WTR\Idle.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File opened for modification	C:\Windows\Migration\WTR\Idle.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Windows\Migration\WTR\6ccacd8608530f	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
File created	C:\Windows\SoftwareDistribution\dwm.exe	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4496	schtasks.exe
460	schtasks.exe
2912	schtasks.exe
4244	schtasks.exe
2360	schtasks.exe
2208	schtasks.exe
1848	schtasks.exe
2216	schtasks.exe
4088	schtasks.exe
3052	schtasks.exe
3576	schtasks.exe
732	schtasks.exe
2444	schtasks.exe
1684	schtasks.exe
1504	schtasks.exe
3728	schtasks.exe
3744	schtasks.exe
3116	schtasks.exe
3012	schtasks.exe
4236	schtasks.exe
4284	schtasks.exe
2288	schtasks.exe
4884	schtasks.exe
2088	schtasks.exe
4888	schtasks.exe
1960	schtasks.exe
1520	schtasks.exe
1256	schtasks.exe
2876	schtasks.exe
1144	schtasks.exe
3624	schtasks.exe
3940	schtasks.exe
3376	schtasks.exe
2520	schtasks.exe
1980	schtasks.exe
3676	schtasks.exe
5076	schtasks.exe
2132	schtasks.exe
2204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
548	Idle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
Token: SeDebugPrivilege	548	Idle.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2336	3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe	122
PID 3152 wrote to memory of 2336	3152	93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe	122
PID 2336 wrote to memory of 3120	2336	cmd.exe	124
PID 2336 wrote to memory of 3120	2336	cmd.exe	124
PID 2336 wrote to memory of 548	2336	cmd.exe	128
PID 2336 wrote to memory of 548	2336	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe
"C:\Users\Admin\AppData\Local\Temp\93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1dN.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\64hpDSsbhR.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3120
- - C:\Windows\Migration\WTR\Idle.exe
    "C:\Windows\Migration\WTR\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Downloads\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Downloads\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\SoftwareDistribution\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\DESIGNER\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\DESIGNER\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\sppsvc.exe

Filesize
1.1MB

MD5
a4ea523b57cc90848732ee08117646d0

SHA1
a9706d93616af18f00027c6d9c29b6b877497c1e

SHA256
93e88c0eeb14a25944205694761570f5e1700e260910134faf82eafe33d0ee1d

SHA512
b280ef14615e5ebd8aece055c6a1eed253a68b47c26df4e92ed16df054db86d838495056806ff87893e04717e939983aae05dcf4c90eb1c5d2176728a0716a05

Download Submit
C:\Users\Admin\AppData\Local\Temp\64hpDSsbhR.bat

Filesize
198B

MD5
8ff872a88e22ea49f908b98e6e115692

SHA1
7b76367f77b481cca28a66ca1522539e9c88f1ab

SHA256
41d8a2263b5339a6f5adddef7353c70fe7fb1a82bf87c5bba73b82ec274973d1

SHA512
da15cc790a223b4baca13f983a24e6fc3b9fab74ef6f1857ed313d1c718e40604a441466b5d3eee83e93082e49e23c26cc63e86bf4954647ed698c9589414351

Download Submit
memory/3152-0-0x00007FFA105F3000-0x00007FFA105F5000-memory.dmp

Filesize
8KB

Download
memory/3152-1-0x00000000008A0000-0x00000000009CE000-memory.dmp

Filesize
1.2MB

Download
memory/3152-2-0x00007FFA105F0000-0x00007FFA110B1000-memory.dmp

Filesize
10.8MB

Download
memory/3152-3-0x0000000002A90000-0x0000000002AAC000-memory.dmp

Filesize
112KB

Download
memory/3152-5-0x000000001B4E0000-0x000000001B4F2000-memory.dmp

Filesize
72KB

Download
memory/3152-4-0x000000001B530000-0x000000001B580000-memory.dmp

Filesize
320KB

Download
memory/3152-6-0x000000001C2F0000-0x000000001C818000-memory.dmp

Filesize
5.2MB

Download
memory/3152-8-0x000000001B520000-0x000000001B528000-memory.dmp

Filesize
32KB

Download
memory/3152-7-0x000000001B510000-0x000000001B51E000-memory.dmp

Filesize
56KB

Download
memory/3152-41-0x00007FFA105F0000-0x00007FFA110B1000-memory.dmp

Filesize
10.8MB

Download