dcrat | 4094fea68e7a41431fe15eaf1ebbf4d88d20c10e01d4c32e4b466757e626964f

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient111.exe
Size

75KB
MD5

1c7d67e357a4c6f86fde169b8fa74639
SHA1

4168ae0daa5e17cd0928c7542e49bde8490acdb9
SHA256

4094fea68e7a41431fe15eaf1ebbf4d88d20c10e01d4c32e4b466757e626964f
SHA512

a9b87f16bd144568182d2f2dc19855d57be54b73f3066cbfc299f6132b41cd2cd49fdd4d2921d2dedf17b05f5a244c9b41dc8ff500140cbe760e11daf9038205
SSDEEP

1536:9zpyggc1VrFL5n1yubpKAXcbK8ni9o26XvmOpqKnKE1J:9lEaFVn1zbzsbKh9oPvmOIiJ

Score

10^/10

dcrat xworm discovery execution infostealer persistence rat trojan

Malware Config

Extracted

Family

xworm

5.166.171.54:5552

Attributes

Install_directory
%Temp%
install_file
CelestialUpdate.exe

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2932-1-0x0000000000CA0000-0x0000000000CBA000-memory.dmp	family_xworm
behavioral1/files/0x000e00000001202c-35.dat	family_xworm
behavioral1/memory/2272-37-0x00000000002D0000-0x00000000002EA000-memory.dmp	family_xworm
behavioral1/memory/896-262-0x00000000000C0000-0x00000000000DA000-memory.dmp	family_xworm

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\OSPPSVC.exe\", \"C:\\Program Files\\DVD Maker\\cmd.exe\", \"C:\\HypercomponentCommon\\lsass.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\OSPPSVC.exe\", \"C:\\Program Files\\DVD Maker\\cmd.exe\", \"C:\\HypercomponentCommon\\lsass.exe\", \"C:\\Windows\\IME\\imekr8\\dicts\\OSPPSVC.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\OSPPSVC.exe\", \"C:\\Program Files\\DVD Maker\\cmd.exe\", \"C:\\HypercomponentCommon\\lsass.exe\", \"C:\\Windows\\IME\\imekr8\\dicts\\OSPPSVC.exe\", \"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\OSPPSVC.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\OSPPSVC.exe\", \"C:\\Program Files\\DVD Maker\\cmd.exe\""	hyperSurrogateagentCrt.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1928	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2432	schtasks.exe	49
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2432	schtasks.exe	49

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
2680	powershell.exe
2972	powershell.exe
2500	powershell.exe
2988	powershell.exe
2152	powershell.exe
2712	powershell.exe
2976	powershell.exe
2708	powershell.exe
1988	powershell.exe

Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CelestialUpdate.lnk	XClient111.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CelestialUpdate.lnk	XClient111.exe

Executes dropped EXE 7 IoCs

pid	Process
2272	CelestialUpdate.exe
860	216MTNWR5HZLJ6T.exe
2840	hyperSurrogateagentCrt.exe
2240	OSPPSVC.exe
1632	CelestialUpdate.exe
896	CelestialUpdate.exe.exe
1500	XClient111.exe

Loads dropped DLL 2 IoCs

pid	Process
1480	cmd.exe
1480	cmd.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\OSPPSVC.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\OSPPSVC.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\DVD Maker\\cmd.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\DVD Maker\\cmd.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\HypercomponentCommon\\lsass.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\IME\\imekr8\\dicts\\OSPPSVC.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient111 = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient111 = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\XClient111.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperSurrogateagentCrt = "\"C:\\HypercomponentCommon\\hyperSurrogateagentCrt.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Windows\\IME\\imekr8\\dicts\\OSPPSVC.exe\""	hyperSurrogateagentCrt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\CelestialUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CelestialUpdate.exe"	XClient111.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\HypercomponentCommon\\lsass.exe\""	hyperSurrogateagentCrt.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC6ED356656874DB7A7FE875ABEA6A593.TMP	csc.exe
File created	\??\c:\Windows\System32\_f1q_j.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\cmd.exe	hyperSurrogateagentCrt.exe
File created	C:\Program Files\DVD Maker\ebf1f9fa8afd6d	hyperSurrogateagentCrt.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\IME\imekr8\dicts\1610b97d3ab4a7	hyperSurrogateagentCrt.exe
File created	C:\Windows\IME\imekr8\dicts\OSPPSVC.exe	hyperSurrogateagentCrt.exe
File opened for modification	C:\Windows\IME\imekr8\dicts\OSPPSVC.exe	hyperSurrogateagentCrt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	216MTNWR5HZLJ6T.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1340	PING.EXE

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	XClient111.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	XClient111.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	XClient111.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1340	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2420	schtasks.exe
2000	schtasks.exe
1680	schtasks.exe
2684	schtasks.exe
2096	schtasks.exe
1916	schtasks.exe
928	schtasks.exe
1668	schtasks.exe
2348	schtasks.exe
888	schtasks.exe
1520	schtasks.exe
944	schtasks.exe
2592	schtasks.exe
1764	schtasks.exe
2296	schtasks.exe
696	schtasks.exe
1648	schtasks.exe
2576	schtasks.exe
1928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2708	powershell.exe
2500	powershell.exe
1988	powershell.exe
2152	powershell.exe
2932	XClient111.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe
2840	hyperSurrogateagentCrt.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	XClient111.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2932	XClient111.exe
Token: SeDebugPrivilege	2272	CelestialUpdate.exe
Token: SeDebugPrivilege	2840	hyperSurrogateagentCrt.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	2240	OSPPSVC.exe
Token: SeDebugPrivilege	1500	XClient111.exe
Token: SeDebugPrivilege	896	CelestialUpdate.exe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2932	XClient111.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2708	2932	XClient111.exe	31
PID 2932 wrote to memory of 2708	2932	XClient111.exe	31
PID 2932 wrote to memory of 2708	2932	XClient111.exe	31
PID 2932 wrote to memory of 2500	2932	XClient111.exe	33
PID 2932 wrote to memory of 2500	2932	XClient111.exe	33
PID 2932 wrote to memory of 2500	2932	XClient111.exe	33
PID 2932 wrote to memory of 1988	2932	XClient111.exe	35
PID 2932 wrote to memory of 1988	2932	XClient111.exe	35
PID 2932 wrote to memory of 1988	2932	XClient111.exe	35
PID 2932 wrote to memory of 2152	2932	XClient111.exe	37
PID 2932 wrote to memory of 2152	2932	XClient111.exe	37
PID 2932 wrote to memory of 2152	2932	XClient111.exe	37
PID 2932 wrote to memory of 1764	2932	XClient111.exe	39
PID 2932 wrote to memory of 1764	2932	XClient111.exe	39
PID 2932 wrote to memory of 1764	2932	XClient111.exe	39
PID 2084 wrote to memory of 2272	2084	taskeng.exe	43
PID 2084 wrote to memory of 2272	2084	taskeng.exe	43
PID 2084 wrote to memory of 2272	2084	taskeng.exe	43
PID 2932 wrote to memory of 860	2932	XClient111.exe	44
PID 2932 wrote to memory of 860	2932	XClient111.exe	44
PID 2932 wrote to memory of 860	2932	XClient111.exe	44
PID 2932 wrote to memory of 860	2932	XClient111.exe	44
PID 860 wrote to memory of 1504	860	216MTNWR5HZLJ6T.exe	45
PID 860 wrote to memory of 1504	860	216MTNWR5HZLJ6T.exe	45
PID 860 wrote to memory of 1504	860	216MTNWR5HZLJ6T.exe	45
PID 860 wrote to memory of 1504	860	216MTNWR5HZLJ6T.exe	45
PID 1504 wrote to memory of 1480	1504	WScript.exe	46
PID 1504 wrote to memory of 1480	1504	WScript.exe	46
PID 1504 wrote to memory of 1480	1504	WScript.exe	46
PID 1504 wrote to memory of 1480	1504	WScript.exe	46
PID 1480 wrote to memory of 2840	1480	cmd.exe	48
PID 1480 wrote to memory of 2840	1480	cmd.exe	48
PID 1480 wrote to memory of 2840	1480	cmd.exe	48
PID 1480 wrote to memory of 2840	1480	cmd.exe	48
PID 2840 wrote to memory of 2016	2840	hyperSurrogateagentCrt.exe	53
PID 2840 wrote to memory of 2016	2840	hyperSurrogateagentCrt.exe	53
PID 2840 wrote to memory of 2016	2840	hyperSurrogateagentCrt.exe	53
PID 2016 wrote to memory of 2108	2016	csc.exe	55
PID 2016 wrote to memory of 2108	2016	csc.exe	55
PID 2016 wrote to memory of 2108	2016	csc.exe	55
PID 2840 wrote to memory of 448	2840	hyperSurrogateagentCrt.exe	56
PID 2840 wrote to memory of 448	2840	hyperSurrogateagentCrt.exe	56
PID 2840 wrote to memory of 448	2840	hyperSurrogateagentCrt.exe	56
PID 448 wrote to memory of 2560	448	csc.exe	58
PID 448 wrote to memory of 2560	448	csc.exe	58
PID 448 wrote to memory of 2560	448	csc.exe	58
PID 2840 wrote to memory of 2972	2840	hyperSurrogateagentCrt.exe	74
PID 2840 wrote to memory of 2972	2840	hyperSurrogateagentCrt.exe	74
PID 2840 wrote to memory of 2972	2840	hyperSurrogateagentCrt.exe	74
PID 2840 wrote to memory of 2976	2840	hyperSurrogateagentCrt.exe	75
PID 2840 wrote to memory of 2976	2840	hyperSurrogateagentCrt.exe	75
PID 2840 wrote to memory of 2976	2840	hyperSurrogateagentCrt.exe	75
PID 2840 wrote to memory of 2988	2840	hyperSurrogateagentCrt.exe	76
PID 2840 wrote to memory of 2988	2840	hyperSurrogateagentCrt.exe	76
PID 2840 wrote to memory of 2988	2840	hyperSurrogateagentCrt.exe	76
PID 2840 wrote to memory of 2680	2840	hyperSurrogateagentCrt.exe	77
PID 2840 wrote to memory of 2680	2840	hyperSurrogateagentCrt.exe	77
PID 2840 wrote to memory of 2680	2840	hyperSurrogateagentCrt.exe	77
PID 2840 wrote to memory of 2712	2840	hyperSurrogateagentCrt.exe	78
PID 2840 wrote to memory of 2712	2840	hyperSurrogateagentCrt.exe	78
PID 2840 wrote to memory of 2712	2840	hyperSurrogateagentCrt.exe	78
PID 2840 wrote to memory of 2736	2840	hyperSurrogateagentCrt.exe	79
PID 2840 wrote to memory of 2736	2840	hyperSurrogateagentCrt.exe	79
PID 2840 wrote to memory of 2736	2840	hyperSurrogateagentCrt.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient111.exe
"C:\Users\Admin\AppData\Local\Temp\XClient111.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\XClient111.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient111.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'CelestialUpdate.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "CelestialUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\216MTNWR5HZLJ6T.exe
  "C:\Users\Admin\AppData\Local\Temp\216MTNWR5HZLJ6T.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\HypercomponentCommon\cemEzm0xYx1.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\HypercomponentCommon\hyperSurrogateagentCrt.exe
        
        "C:\HypercomponentCommon/hyperSurrogateagentCrt.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q3lpxl2n\q3lpxl2n.cmdline"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E70.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCDC57336BD114BA4A93921F3BB3C3E0.TMP"
        7⤵
        
        PID:2108
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rqmjm52e\rqmjm52e.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EBE.tmp" "c:\Windows\System32\CSC6ED356656874DB7A7FE875ABEA6A593.TMP"
        7⤵
        
        PID:2560
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\XClient111.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\cmd.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\imekr8\dicts\OSPPSVC.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dq29CQUizk.bat"
        6⤵
        
        PID:1400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1340
        
        C:\Windows\IME\imekr8\dicts\OSPPSVC.exe
        
        "C:\Windows\IME\imekr8\dicts\OSPPSVC.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240

C:\Windows\system32\taskeng.exe
taskeng.exe {258CABC4-8E7C-4412-A0C6-012467F7E53A} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- - C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\XClient111.exe
    "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\XClient111.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XClient111X" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\XClient111.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XClient111" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\XClient111.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "XClient111X" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\XClient111.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\DVD Maker\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\DVD Maker\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\HypercomponentCommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\HypercomponentCommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\HypercomponentCommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\imekr8\dicts\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\IME\imekr8\dicts\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Windows\IME\imekr8\dicts\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 9 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrt" /sc ONLOGON /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperSurrogateagentCrth" /sc MINUTE /mo 9 /tr "'C:\HypercomponentCommon\hyperSurrogateagentCrt.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HypercomponentCommon\I1SNCaG9QwHssjsi1vS2b9DJmZMoJ4clEjNn.vbe

Filesize
220B

MD5
47085bdd4e3087465355c9bb9bbc6005

SHA1
bf0c5b11c20beca45cc9d4298f2a11a16c793a61

SHA256
80577e4666fad86273b01f60b8d63c15e4ce37774575ac1e0df7a7c396979752

SHA512
e74dd8e9756cab1123410a46609dc91540cc29a8fea93017155746f7bb9b7a41bfd3d7595a62788264bedceb475b2a733cce9b70f37cc4478302d5fc228d7684

Download Submit
C:\HypercomponentCommon\cemEzm0xYx1.bat

Filesize
105B

MD5
5ee2935a1949f69f67601f7375b3e8a3

SHA1
6a3229f18db384e57435bd3308298da56aa8c404

SHA256
c24a0d7f53a7aa3437f6b6566d3aaebdb36053b64e72cbd1d3796596fc8e3c06

SHA512
9777fcb9ee8a8aa0c770c835c5f30aff6efc5fb16a1819047e13d580d748703ffcb446db110067fb2546a637213cb8f25416d4b621a95a789b8e113d31d3401a

Download Submit
C:\HypercomponentCommon\hyperSurrogateagentCrt.exe

Filesize
1.9MB

MD5
7be5cea1c84ad0b2a6d2e5b6292c8d80

SHA1
631e3de0fe83ebacbe5be4e7f895dd0bd8b095ce

SHA256
6eb90684ebc56fb2713f5c468b55a964625ec2af698d9687492b1de4225693b7

SHA512
ea58d3b1664fe70968635c2722e19ce65ce4c1d66c68aed2d98441e60e773c7295f18d9c99cf4c454c510f33f5e37d3d2c0053b7434a46c542a0d63a4cc03647

Download Submit
C:\Users\Admin\AppData\Local\Temp\216MTNWR5HZLJ6T.exe

Filesize
2.2MB

MD5
05d87a4a162784fd5256f4118aff32af

SHA1
484ed03930ed6a60866b6f909b37ef0d852dbefd

SHA256
7e3d0dabaded78094abfac40d694eaebf861f3cb865d3835bb053d435e996950

SHA512
3d4ce511e9671d8bfa15e93d681fedd972f4fe4c09ac9cfd9653afe83e936654c88ee515a76e7ac80e8f34868802e68c6531fdea0b718029d2196ad1425981fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3C5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe

Filesize
4KB

MD5
c7e8a4e1b4b5383fca28a1e1a39b200c

SHA1
8bfdefdae64bd70de33137957552fcd55ca06667

SHA256
9ceca1b436cb3470195bb1dd71d08c718683b4983e2776c7cc0a72fd0ac455b7

SHA512
f3fc0cd126d2e32f8b16fbea359d41bb19339ffa7f566e58dc58f2bf5173f1b9048d3f5557e18403c98b35832df0f8389a168cc22baa726a921143c7f87cec88

Download Submit
C:\Users\Admin\AppData\Local\Temp\CelestialUpdate.exe

Filesize
75KB

MD5
1c7d67e357a4c6f86fde169b8fa74639

SHA1
4168ae0daa5e17cd0928c7542e49bde8490acdb9

SHA256
4094fea68e7a41431fe15eaf1ebbf4d88d20c10e01d4c32e4b466757e626964f

SHA512
a9b87f16bd144568182d2f2dc19855d57be54b73f3066cbfc299f6132b41cd2cd49fdd4d2921d2dedf17b05f5a244c9b41dc8ff500140cbe760e11daf9038205

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2E70.tmp

Filesize
1KB

MD5
d8c109cb7f46efcab1e238dcf0b6af5b

SHA1
329e4db7a48b537b365b7e3b3699ec0b82ac2694

SHA256
9630406c0d62108a8163d0806c461a49e712ad9b64d97e650e8b7ee984695d92

SHA512
88843011c19e4b33e8dda500a5aec4328c14f4444d6b41403244e393c99fdb053233edd49d892aafe2c4c203a20eb708e930a5bb7eecdb64961bc0d7ef5db38f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2EBE.tmp

Filesize
1KB

MD5
9b77489a7768beb5093930e42c239b9a

SHA1
d1c8cf929f22aa244cd8843bafc9ad0122487d5b

SHA256
dacaeb100902f0342ed29f0f33780172067bbd09f093479b7952cb758568076f

SHA512
6c27999a520b3e8c5a620ea02f0fe8e9db819cf68cb3098b3d329f5bab965bbcfceffba3e65d0efb97bc63d566d76af41abb222c922aea5f1967b4c9dbb051b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD3D8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dq29CQUizk.bat

Filesize
167B

MD5
db78c8bbd2e2a98225b147592a0517f3

SHA1
a0de9c6cb20aef230258b9b62c660362035f6432

SHA256
a0fe861b80d35d4bc8479bad18c1bec3df868acb5103d828078389bf37a6eae0

SHA512
113121c7fd322ab22cc2b806af453209687d6e4a8decbd85f1ab4797bd16365d406080801e48b6a27c97e4b1ec96b18648c55b6621b703d05521fe946788f996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
03b6046f7c4b05023c4507d20fc74537

SHA1
6967cc00810d73049740915e0bbcb486d47cfd61

SHA256
22e47e9fbcefc422fe50ebe43f1c713485d4f60095ef1c9d7ec026e889fa039b

SHA512
87881b8713f82599bd05506fee787f086263161ba84db90e5c8a1eea5398797fe6ad59952dfce64187fc977e4703758de7c44780138e921b25ee9f162f6239da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A0AKGESZ5SMD87I80YHB.temp

Filesize
7KB

MD5
8d274ef43aa439a6338a56f6d71ae53c

SHA1
4a09bfd4782ad39b100191270678ae3504b1d6aa

SHA256
2872aacbd41136945abba1f0ee37a4e7c5f340e31cd86afff4b38a1a766926d7

SHA512
ecff0af03660e51182b04d9b60851b10c33b2e55238234d689fffea3da5aef3421664d221f39f161bdbf32c906df24bc988f43d18aab8df1bce867fad9a35f48

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCCDC57336BD114BA4A93921F3BB3C3E0.TMP

Filesize
1KB

MD5
6aa228f10d79d9a653efe79815dc2ed0

SHA1
2623ec8c101a4e3b367d7a6fd78878fcb03cb005

SHA256
34d0afeeb68839bbbab96e8ec72c4f516785b76b95fba68f059b53e3c25995b6

SHA512
61ddd21628e3ced5a5f1fed025a83b95ad3972247b083c4a533145f0912b51d7a4fc609e5dfc37ff7a707ccb228d1c79561f8fa659d63af516a23a465804d987

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\q3lpxl2n\q3lpxl2n.0.cs

Filesize
432B

MD5
3bf6b9d1be4c7b1859734f2691bbfec9

SHA1
933fcfdeb67e0bbfbd448ed893993aaca6c82695

SHA256
497462c8f09dc00a0b939edca803d85472337c00c2abb04738bf284791133641

SHA512
a6ce0135d0ba465e07ee085b6f76c4e1393de73fb33998e2331f1338f505d50f2f9cdb053be5085979782be477eb071a90803c3e16eec103ed235c0e48afebf5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\q3lpxl2n\q3lpxl2n.cmdline

Filesize
258B

MD5
ef1fe6dca1a5c273d6a49daccb022c89

SHA1
e865e2ca77f56107ce0b464748de27e6347ed301

SHA256
c01cef1821922f73e9cc9cc3d2720d3e41b8e175af869d60a8dbd2652a84fc7a

SHA512
9b8845558a7b31591c9e71d94ff766f639963462442ff4ad81449ffbc5b3f4be4dc96d5ddc3a2e898b6c9467ca6dcd3361cd50110f208fba8d5b79c45b404ca5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rqmjm52e\rqmjm52e.0.cs

Filesize
409B

MD5
f288c8bedc633b7d9ac7ac77d7f49bc3

SHA1
9bee8fbd9862dfd58b5c94a7a65906c0cc0438bc

SHA256
f52c10b79bb0f057cebf2728ef27c297e4e231b81b73f59615ac65fcfaceae97

SHA512
fc81d27e1e6f251e36f7a07fd8790140f7e0d28a53c62e062f2abdfb6695dd32891aceb7b12adf36bb0db51ae9e07f015eb85f7ee4ce9c4dee7303d85a6f3e7c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rqmjm52e\rqmjm52e.cmdline

Filesize
235B

MD5
90fe9b71dd308504266d42144c90e008

SHA1
33c01ac8cff7469a8329c37109bd5a9b5add7034

SHA256
386084422d1c786eadd56f37a53c9e63ddace3e96dd2088668c51d7bfddec903

SHA512
e5a7c0c3dead4087469ace587131c0375ad8e0ecf8be46854db9b7078ab156ab739bd0bf12509f345509c4157c65ef2e544513beb946604aa9a91b3d7808b586

Download Submit
\??\c:\Windows\System32\CSC6ED356656874DB7A7FE875ABEA6A593.TMP

Filesize
1KB

MD5
fccbcfaf29fdccaabada579f7aaf3ae7

SHA1
f9b179b6aab6b96908d89b35aab3f503478a956d

SHA256
e70bc8ad14a70d490fe92ed86e79c40fc133a64428a2781e14514b16d83a9b02

SHA512
ac047b4ba060e72e224c1afdebbdafecbfd705a67cb8f0cd5c82bf7980c2baa23bdb5bf5d821836bc0c426069a61d8e112b45239887d2d81b8a6d4fa839c1e10

Download Submit
memory/896-262-0x00000000000C0000-0x00000000000DA000-memory.dmp

Filesize
104KB

Download
memory/1500-264-0x0000000000B80000-0x0000000000D66000-memory.dmp

Filesize
1.9MB

Download
memory/1632-259-0x0000000000D50000-0x0000000000D58000-memory.dmp

Filesize
32KB

Download
memory/2240-250-0x0000000000F30000-0x0000000001116000-memory.dmp

Filesize
1.9MB

Download
memory/2272-37-0x00000000002D0000-0x00000000002EA000-memory.dmp

Filesize
104KB

Download
memory/2500-15-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2500-16-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2708-7-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2708-8-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2708-9-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2840-174-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Filesize
48KB

Download
memory/2840-170-0x0000000000B70000-0x0000000000B88000-memory.dmp

Filesize
96KB

Download
memory/2840-164-0x00000000010C0000-0x00000000012A6000-memory.dmp

Filesize
1.9MB

Download
memory/2840-166-0x0000000000B20000-0x0000000000B2E000-memory.dmp

Filesize
56KB

Download
memory/2840-172-0x0000000000B30000-0x0000000000B3E000-memory.dmp

Filesize
56KB

Download
memory/2840-168-0x0000000000B50000-0x0000000000B6C000-memory.dmp

Filesize
112KB

Download
memory/2932-1-0x0000000000CA0000-0x0000000000CBA000-memory.dmp

Filesize
104KB

Download
memory/2932-0-0x000007FEF66B3000-0x000007FEF66B4000-memory.dmp

Filesize
4KB

Download
memory/2932-2-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-22-0x000007FEF66B3000-0x000007FEF66B4000-memory.dmp

Filesize
4KB

Download
memory/2932-38-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download
memory/2932-32-0x000007FEF66B0000-0x000007FEF709C000-memory.dmp

Filesize
9.9MB

Download
memory/2988-226-0x0000000002210000-0x0000000002218000-memory.dmp

Filesize
32KB

Download
memory/2988-221-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download