dcrat | 2d7c923ab1e4849fd6897512ea7763bbe2b8b12f58267d277ca7953f8fc08c86

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TearWeapon.exe
Size

1.1MB
MD5

0c3a6b0190475de988ebaf0d788ae934
SHA1

b611c57d25b733277fee96395bc2140c1b06b166
SHA256

2d7c923ab1e4849fd6897512ea7763bbe2b8b12f58267d277ca7953f8fc08c86
SHA512

b43c50a7e81924cd874c89a3084b42e45c41c95f1647da7848d901cc2279801c7f12b73fdd2c988bc1e528b63e249fac1941d3cc48aa699b6214247196a27d14
SSDEEP

24576:U2G/nvxW3Ww0t16ZauSTtl1GuZZDZoL60:UbA301Tz1t2z

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	108	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	712	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2644	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2644	schtasks.exe	35

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/files/0x0007000000015f96-9.dat	dcrat
behavioral1/memory/2608-13-0x00000000002F0000-0x00000000003C6000-memory.dmp	dcrat
behavioral1/memory/1800-50-0x0000000000A80000-0x0000000000B56000-memory.dmp	dcrat

Executes dropped EXE 2 IoCs

Processes:

windll.exewindll.exe

pid	Process
2608	windll.exe
1800	windll.exe

Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid	Process
2604	cmd.exe
2604	cmd.exe

Drops file in Program Files directory 8 IoCs

Processes:

windll.exe

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe	windll.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\69ddcba757bf72	windll.exe
File created	C:\Program Files\Windows Portable Devices\windll.exe	windll.exe
File created	C:\Program Files\Windows Portable Devices\f5a4800ad447fa	windll.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe	windll.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\886983d96e3d3e	windll.exe
File created	C:\Program Files\Windows Portable Devices\lsm.exe	windll.exe
File created	C:\Program Files\Windows Portable Devices\101b941d020240	windll.exe

Drops file in Windows directory 10 IoCs

Processes:

windll.exe

description	ioc	Process
File created	C:\Windows\Fonts\dwm.exe	windll.exe
File created	C:\Windows\Vss\conhost.exe	windll.exe
File created	C:\Windows\Vss\088424020bedd6	windll.exe
File created	C:\Windows\twain_32\cc11b995f2a76d	windll.exe
File created	C:\Windows\SoftwareDistribution\ScanFile\windll.exe	windll.exe
File created	C:\Windows\SoftwareDistribution\ScanFile\f5a4800ad447fa	windll.exe
File opened for modification	C:\Windows\Fonts\dwm.exe	windll.exe
File created	C:\Windows\Fonts\6cb0b6c459d5d3	windll.exe
File created	C:\Windows\rescache\rc0007\smss.exe	windll.exe
File created	C:\Windows\twain_32\winlogon.exe	windll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeTearWeapon.exeWScript.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TearWeapon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
2900	schtasks.exe
1596	schtasks.exe
2328	schtasks.exe
2404	schtasks.exe
2036	schtasks.exe
2144	schtasks.exe
712	schtasks.exe
1332	schtasks.exe
3004	schtasks.exe
2904	schtasks.exe
2040	schtasks.exe
2532	schtasks.exe
960	schtasks.exe
1704	schtasks.exe
1004	schtasks.exe
2224	schtasks.exe
2188	schtasks.exe
3060	schtasks.exe
968	schtasks.exe
1168	schtasks.exe
2332	schtasks.exe
2968	schtasks.exe
2368	schtasks.exe
1776	schtasks.exe
2128	schtasks.exe
1032	schtasks.exe
108	schtasks.exe
2344	schtasks.exe
2276	schtasks.exe
2304	schtasks.exe
1216	schtasks.exe
1416	schtasks.exe
600	schtasks.exe
2548	schtasks.exe
1804	schtasks.exe
3036	schtasks.exe
2164	schtasks.exe
2092	schtasks.exe
1976	schtasks.exe
2892	schtasks.exe
588	schtasks.exe
320	schtasks.exe
1820	schtasks.exe
1360	schtasks.exe
2236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

windll.exewindll.exetaskmgr.exe

pid	Process
2608	windll.exe
2608	windll.exe
2608	windll.exe
2608	windll.exe
2608	windll.exe
2608	windll.exe
2608	windll.exe
1800	windll.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
1800	windll.exe
1800	windll.exe
1800	windll.exe
1800	windll.exe
1800	windll.exe
1800	windll.exe
1800	windll.exe
1800	windll.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid	Process
2784	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

windll.exewindll.exetaskmgr.exe

description	pid	Process
Token: SeDebugPrivilege	2608	windll.exe
Token: SeDebugPrivilege	1800	windll.exe
Token: SeDebugPrivilege	2784	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	Process
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	Process
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe
2784	taskmgr.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

TearWeapon.exeWScript.execmd.exewindll.exe

description	pid	Process	procid_target
PID 2788 wrote to memory of 2680	2788	TearWeapon.exe	31
PID 2788 wrote to memory of 2680	2788	TearWeapon.exe	31
PID 2788 wrote to memory of 2680	2788	TearWeapon.exe	31
PID 2788 wrote to memory of 2680	2788	TearWeapon.exe	31
PID 2680 wrote to memory of 2604	2680	WScript.exe	32
PID 2680 wrote to memory of 2604	2680	WScript.exe	32
PID 2680 wrote to memory of 2604	2680	WScript.exe	32
PID 2680 wrote to memory of 2604	2680	WScript.exe	32
PID 2604 wrote to memory of 2608	2604	cmd.exe	34
PID 2604 wrote to memory of 2608	2604	cmd.exe	34
PID 2604 wrote to memory of 2608	2604	cmd.exe	34
PID 2604 wrote to memory of 2608	2604	cmd.exe	34
PID 2608 wrote to memory of 1800	2608	windll.exe	81
PID 2608 wrote to memory of 1800	2608	windll.exe	81
PID 2608 wrote to memory of 1800	2608	windll.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TearWeapon.exe
"C:\Users\Admin\AppData\Local\Temp\TearWeapon.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Containercomponentwebdriverdhcp\U3fWKkdcpG4DS7iPwgMqthhMVTa.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Containercomponentwebdriverdhcp\3arP58.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Containercomponentwebdriverdhcp\windll.exe
      "C:\Containercomponentwebdriverdhcp\windll.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Program Files\Windows Portable Devices\windll.exe
        
        "C:\Program Files\Windows Portable Devices\windll.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Fonts\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windllw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\windll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windll" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\windll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windllw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\windll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windllw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\NetHood\windll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windll" /sc ONLOGON /tr "'C:\Users\Default\NetHood\windll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windllw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\NetHood\windll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Windows\Vss\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Vss\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\twain_32\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Containercomponentwebdriverdhcp\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Containercomponentwebdriverdhcp\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Containercomponentwebdriverdhcp\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windllw" /sc MINUTE /mo 12 /tr "'C:\Windows\SoftwareDistribution\ScanFile\windll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windll" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\ScanFile\windll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "windllw" /sc MINUTE /mo 7 /tr "'C:\Windows\SoftwareDistribution\ScanFile\windll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f5748e2-69f6-11ef-b486-62cb582c238c\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Containercomponentwebdriverdhcp\3arP58.bat

Filesize
47B

MD5
9c62a1550e3632fff65e95fc40f9a712

SHA1
49aed2c564039b88d36900fc64736a9194d86145

SHA256
491a4e0ade09299713f5fadf5a30ba3d2ab158ae268242a362eabdf5de24aca9

SHA512
ec281b04597cfe2228c9c920f4d9e610ac65c2e78c7dc4de8144a086b7bb095f05c6dabab418767f2259b5b3b9379eb7536bba3bd30ab684d3622d3aba5a8780

Download Submit
C:\Containercomponentwebdriverdhcp\U3fWKkdcpG4DS7iPwgMqthhMVTa.vbe

Filesize
214B

MD5
156e02341d13389aa844faf62d6edcbf

SHA1
b52920af0de575411dfe68f72f97a8a5be7f5da6

SHA256
fdd34a4d787fd3183985ec7487453fbda3b029cad7602a1fe55ff44485450346

SHA512
50df7ae65ff54507aa4afe46f2a40955c9fbc7aadad47ff805024274ec565449d7ee49dd8cc0725eb80bb52481b3358b678f17fa10114176638f6186ae64ff67

Download Submit
\Containercomponentwebdriverdhcp\windll.exe

Filesize
828KB

MD5
8afe4de25d433d6fdd54931b0c372833

SHA1
47b0de7556f4cca2e0fc7cbb444d00c90608af6d

SHA256
2faab8e27b7a41ffcc39f171b6b361ff2d5f818975ae1f25a8d28698a37ba3dc

SHA512
7b62e295084a71a934f4c7c61b92bbdf53bed7e0034e3f4a79ecab6bd56c50493b801e1c92a2c45daabee7708c9a4e08eddee54bc54f00d7d299ec95f2c39c8a

Download Submit
memory/1800-50-0x0000000000A80000-0x0000000000B56000-memory.dmp

Filesize
856KB

Download
memory/2608-13-0x00000000002F0000-0x00000000003C6000-memory.dmp

Filesize
856KB

Download
memory/2784-51-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2784-52-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2784-53-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download