dcrat | 4a7e93517c69ba331bd816159caa16524903ea49a8a2ea2b01e89f744894e6f0

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f7a0b0d633254c477f9d8650d485d11.exe
Size

1.8MB
MD5

2f7a0b0d633254c477f9d8650d485d11
SHA1

1ce7e5c3989077d2965d9aac2a256f9930e5b98f
SHA256

4a7e93517c69ba331bd816159caa16524903ea49a8a2ea2b01e89f744894e6f0
SHA512

b6141e51687d39942fb04f593c7bb2c0a7ec9e0bc53200f22e4d4c94fdb5ce55aed3169ca35d014fb746089bd2087f585ad3f057931642650ff0063195054299
SSDEEP

49152:VbA3GzW8NA/VUPoFVwrIIV+DJGfZ19qigh:Vbs8NA/VUPoXIV+Dwbwfh

Score

10^/10

dcrat discovery evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat 53 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\0a1fd5f707cd16		Crtmonitor.exe
		2168	schtasks.exe
		1784	schtasks.exe
		2388	schtasks.exe
		1616	schtasks.exe
		2744	schtasks.exe
		2092	schtasks.exe
		1580	schtasks.exe
		2652	schtasks.exe
		484	schtasks.exe
		2112	schtasks.exe
		2144	schtasks.exe
		2288	schtasks.exe
		840	schtasks.exe
		1888	schtasks.exe
		2204	schtasks.exe
		2564	schtasks.exe
		2808	schtasks.exe
		768	schtasks.exe
		448	schtasks.exe
		1040	schtasks.exe
		2292	schtasks.exe
		2288	schtasks.exe
		2548	schtasks.exe
		2624	schtasks.exe
		548	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		2f7a0b0d633254c477f9d8650d485d11.exe
		1772	schtasks.exe
		2476	schtasks.exe
		2560	schtasks.exe
File created	C:\Program Files\Microsoft Games\Purble Place\69ddcba757bf72		Crtmonitor.exe
		3052	schtasks.exe
		1524	schtasks.exe
		380	schtasks.exe
		2620	schtasks.exe
		1100	schtasks.exe
		2440	schtasks.exe
		1616	schtasks.exe
		3000	schtasks.exe
		2992	schtasks.exe
		1256	schtasks.exe
		2148	schtasks.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\42af1c969fbb7b		Crtmonitor.exe
		1664	schtasks.exe
		1788	schtasks.exe
		668	schtasks.exe
		1832	schtasks.exe
		288	schtasks.exe
		900	schtasks.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\69ddcba757bf72		Crtmonitor.exe
		1312	schtasks.exe
		608	schtasks.exe
		812	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	288	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	2688	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2688	schtasks.exe	35

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016c3d-12.dat	dcrat
behavioral1/memory/1996-13-0x0000000001300000-0x000000000148E000-memory.dmp	dcrat
behavioral1/memory/2784-201-0x0000000000220000-0x00000000003AE000-memory.dmp	dcrat
behavioral1/memory/2332-212-0x0000000001140000-0x00000000012CE000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
348	powershell.exe
2360	powershell.exe
2900	powershell.exe
1744	powershell.exe
1888	powershell.exe
2996	powershell.exe
2556	powershell.exe
1736	powershell.exe
2732	powershell.exe
2580	powershell.exe
1624	powershell.exe
2200	powershell.exe
2056	powershell.exe
2920	powershell.exe
2892	powershell.exe
2956	powershell.exe
1416	powershell.exe
2496	powershell.exe
1276	powershell.exe
2960	powershell.exe
2932	powershell.exe
2684	powershell.exe
2780	powershell.exe
2908	powershell.exe
2380	powershell.exe
660	powershell.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 4 IoCs

pid	Process
1996	Crtmonitor.exe
2816	Crtmonitor.exe
2784	explorer.exe
2332	explorer.exe

Loads dropped DLL 2 IoCs

pid	Process
1908	cmd.exe
1908	cmd.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crtmonitor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crtmonitor.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\sppsvc.exe	Crtmonitor.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\services.exe	Crtmonitor.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\services.exe	Crtmonitor.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\spoolsv.exe	Crtmonitor.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\audiodg.exe	Crtmonitor.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\es-ES\audiodg.exe	Crtmonitor.exe
File created	C:\Program Files\Microsoft Games\Purble Place\69ddcba757bf72	Crtmonitor.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\audiodg.exe	Crtmonitor.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\42af1c969fbb7b	Crtmonitor.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\42af1c969fbb7b	Crtmonitor.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\smss.exe	Crtmonitor.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\69ddcba757bf72	Crtmonitor.exe
File created	C:\Program Files\Microsoft Games\Purble Place\smss.exe	Crtmonitor.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\0a1fd5f707cd16	Crtmonitor.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\it-IT\services.exe	Crtmonitor.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\886983d96e3d3e	Crtmonitor.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\c5b4cb5e9653cc	Crtmonitor.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\c5b4cb5e9653cc	Crtmonitor.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\f3b6ecef712a24	Crtmonitor.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\csrss.exe	Crtmonitor.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\smss.exe	Crtmonitor.exe
File created	C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\69ddcba757bf72	Crtmonitor.exe
File created	C:\Windows\Speech\Common\es-ES\wininit.exe	Crtmonitor.exe
File created	C:\Windows\servicing\Editions\dllhost.exe	Crtmonitor.exe
File created	C:\Windows\servicing\Editions\5940a34987c991	Crtmonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f7a0b0d633254c477f9d8650d485d11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2384	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
484	schtasks.exe
1784	schtasks.exe
2476	schtasks.exe
2652	schtasks.exe
288	schtasks.exe
2292	schtasks.exe
1616	schtasks.exe
2288	schtasks.exe
1772	schtasks.exe
1524	schtasks.exe
548	schtasks.exe
2112	schtasks.exe
2440	schtasks.exe
812	schtasks.exe
2992	schtasks.exe
2548	schtasks.exe
2564	schtasks.exe
2620	schtasks.exe
1100	schtasks.exe
1664	schtasks.exe
608	schtasks.exe
1580	schtasks.exe
900	schtasks.exe
1040	schtasks.exe
2168	schtasks.exe
840	schtasks.exe
1888	schtasks.exe
2744	schtasks.exe
1312	schtasks.exe
2560	schtasks.exe
1832	schtasks.exe
2204	schtasks.exe
2148	schtasks.exe
2092	schtasks.exe
2808	schtasks.exe
1788	schtasks.exe
3000	schtasks.exe
2388	schtasks.exe
2288	schtasks.exe
768	schtasks.exe
380	schtasks.exe
1256	schtasks.exe
2624	schtasks.exe
1616	schtasks.exe
3052	schtasks.exe
2144	schtasks.exe
668	schtasks.exe
448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1996	Crtmonitor.exe
1996	Crtmonitor.exe
1996	Crtmonitor.exe
1996	Crtmonitor.exe
1996	Crtmonitor.exe
1744	powershell.exe
348	powershell.exe
2892	powershell.exe
1736	powershell.exe
2932	powershell.exe
2960	powershell.exe
2360	powershell.exe
1888	powershell.exe
2900	powershell.exe
2920	powershell.exe
1416	powershell.exe
2056	powershell.exe
2956	powershell.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2816	Crtmonitor.exe
2200	powershell.exe
2496	powershell.exe
2580	powershell.exe
660	powershell.exe
2732	powershell.exe
2780	powershell.exe
1624	powershell.exe
1276	powershell.exe
2380	powershell.exe
2556	powershell.exe
2684	powershell.exe
2908	powershell.exe
2996	powershell.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe
2784	explorer.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	Crtmonitor.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	348	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2816	Crtmonitor.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	660	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2908	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2784	explorer.exe
Token: SeDebugPrivilege	2332	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2444	1980	2f7a0b0d633254c477f9d8650d485d11.exe	31
PID 1980 wrote to memory of 2444	1980	2f7a0b0d633254c477f9d8650d485d11.exe	31
PID 1980 wrote to memory of 2444	1980	2f7a0b0d633254c477f9d8650d485d11.exe	31
PID 1980 wrote to memory of 2444	1980	2f7a0b0d633254c477f9d8650d485d11.exe	31
PID 2444 wrote to memory of 1908	2444	WScript.exe	32
PID 2444 wrote to memory of 1908	2444	WScript.exe	32
PID 2444 wrote to memory of 1908	2444	WScript.exe	32
PID 2444 wrote to memory of 1908	2444	WScript.exe	32
PID 1908 wrote to memory of 1996	1908	cmd.exe	34
PID 1908 wrote to memory of 1996	1908	cmd.exe	34
PID 1908 wrote to memory of 1996	1908	cmd.exe	34
PID 1908 wrote to memory of 1996	1908	cmd.exe	34
PID 1996 wrote to memory of 348	1996	Crtmonitor.exe	51
PID 1996 wrote to memory of 348	1996	Crtmonitor.exe	51
PID 1996 wrote to memory of 348	1996	Crtmonitor.exe	51
PID 1996 wrote to memory of 1736	1996	Crtmonitor.exe	52
PID 1996 wrote to memory of 1736	1996	Crtmonitor.exe	52
PID 1996 wrote to memory of 1736	1996	Crtmonitor.exe	52
PID 1996 wrote to memory of 1416	1996	Crtmonitor.exe	54
PID 1996 wrote to memory of 1416	1996	Crtmonitor.exe	54
PID 1996 wrote to memory of 1416	1996	Crtmonitor.exe	54
PID 1996 wrote to memory of 1888	1996	Crtmonitor.exe	55
PID 1996 wrote to memory of 1888	1996	Crtmonitor.exe	55
PID 1996 wrote to memory of 1888	1996	Crtmonitor.exe	55
PID 1996 wrote to memory of 1744	1996	Crtmonitor.exe	56
PID 1996 wrote to memory of 1744	1996	Crtmonitor.exe	56
PID 1996 wrote to memory of 1744	1996	Crtmonitor.exe	56
PID 1996 wrote to memory of 2932	1996	Crtmonitor.exe	57
PID 1996 wrote to memory of 2932	1996	Crtmonitor.exe	57
PID 1996 wrote to memory of 2932	1996	Crtmonitor.exe	57
PID 1996 wrote to memory of 2956	1996	Crtmonitor.exe	58
PID 1996 wrote to memory of 2956	1996	Crtmonitor.exe	58
PID 1996 wrote to memory of 2956	1996	Crtmonitor.exe	58
PID 1996 wrote to memory of 2900	1996	Crtmonitor.exe	59
PID 1996 wrote to memory of 2900	1996	Crtmonitor.exe	59
PID 1996 wrote to memory of 2900	1996	Crtmonitor.exe	59
PID 1996 wrote to memory of 2892	1996	Crtmonitor.exe	60
PID 1996 wrote to memory of 2892	1996	Crtmonitor.exe	60
PID 1996 wrote to memory of 2892	1996	Crtmonitor.exe	60
PID 1996 wrote to memory of 2920	1996	Crtmonitor.exe	61
PID 1996 wrote to memory of 2920	1996	Crtmonitor.exe	61
PID 1996 wrote to memory of 2920	1996	Crtmonitor.exe	61
PID 1996 wrote to memory of 2960	1996	Crtmonitor.exe	63
PID 1996 wrote to memory of 2960	1996	Crtmonitor.exe	63
PID 1996 wrote to memory of 2960	1996	Crtmonitor.exe	63
PID 1996 wrote to memory of 2056	1996	Crtmonitor.exe	66
PID 1996 wrote to memory of 2056	1996	Crtmonitor.exe	66
PID 1996 wrote to memory of 2056	1996	Crtmonitor.exe	66
PID 1996 wrote to memory of 2360	1996	Crtmonitor.exe	68
PID 1996 wrote to memory of 2360	1996	Crtmonitor.exe	68
PID 1996 wrote to memory of 2360	1996	Crtmonitor.exe	68
PID 1996 wrote to memory of 892	1996	Crtmonitor.exe	77
PID 1996 wrote to memory of 892	1996	Crtmonitor.exe	77
PID 1996 wrote to memory of 892	1996	Crtmonitor.exe	77
PID 1908 wrote to memory of 2384	1908	cmd.exe	79
PID 1908 wrote to memory of 2384	1908	cmd.exe	79
PID 1908 wrote to memory of 2384	1908	cmd.exe	79
PID 1908 wrote to memory of 2384	1908	cmd.exe	79
PID 892 wrote to memory of 1976	892	cmd.exe	80
PID 892 wrote to memory of 1976	892	cmd.exe	80
PID 892 wrote to memory of 1976	892	cmd.exe	80
PID 892 wrote to memory of 2816	892	cmd.exe	81
PID 892 wrote to memory of 2816	892	cmd.exe	81
PID 892 wrote to memory of 2816	892	cmd.exe	81

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Crtmonitor.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2f7a0b0d633254c477f9d8650d485d11.exe
"C:\Users\Admin\AppData\Local\Temp\2f7a0b0d633254c477f9d8650d485d11.exe"
1⤵
- DcRat
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\CombrowserSavesInto\8XvFTVLpT5xtXdrooGsphRu.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\CombrowserSavesInto\gFc2W3El0.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\CombrowserSavesInto\Crtmonitor.exe
      "C:\CombrowserSavesInto\Crtmonitor.exe"
      4⤵
      DcRat
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/CombrowserSavesInto/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mo97XyALGj.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:892
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1976
      - C:\CombrowserSavesInto\Crtmonitor.exe
        
        "C:\CombrowserSavesInto\Crtmonitor.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/CombrowserSavesInto/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zeW9hUBvdy.bat"
        7⤵
        
        PID:1988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:340
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe
        
        "C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05209c49-65d0-41e2-be0f-b98a5a52f0a8.vbs"
        9⤵
        
        PID:2128
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe
        
        C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2332
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5ab0422-468b-4297-8af4-c0d62f18fd9e.vbs"
        9⤵
        
        PID:2244
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\Purble Place\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Purble Place\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\Purble Place\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\it-IT\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\servicing\Editions\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\servicing\Editions\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\servicing\Editions\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\audiodg.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\audiodg.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office14\1033\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Office14\1033\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Start Menu\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f276ee2-69f6-11ef-8b31-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\plugins\video_output\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\video_output\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\plugins\video_output\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\CombrowserSavesInto\8XvFTVLpT5xtXdrooGsphRu.vbe

Filesize
205B

MD5
f9aa9ba9ca708623a6d8eafcab82b460

SHA1
c75bfeade1de9cd48b255a60679a2afd045fd737

SHA256
0b51137a1e50b6fde4624ccff526ceb7a3fb911c811c45dcdd2fd30004993471

SHA512
31ef0b612045b9261ab91921336931c318e4ff853197c58d29e9741c86eeb4db859a97d413d92ac6d6d18fbeabd4ee4a1c8d4512f25468818421c4ce63a4c7a8

Download Submit
C:\CombrowserSavesInto\Crtmonitor.exe

Filesize
1.5MB

MD5
4667f5be1002ce912e5590cca8da93b6

SHA1
2e408e483dd447b69d2e938218989265fbfdc2af

SHA256
fcfa3c615b1c3c703e0ebfaf3fa68093b3894f4b9b7b5b37a5283e419f44022e

SHA512
cdc57befaf7bad8917cc885b394f37d9dac3beabca5d07ab74cfee24f076dc088c2631ad2176dd7b9e62c555692b4c51e3280d5cf5d432ea5172db4ab8fa8c7f

Download Submit
C:\CombrowserSavesInto\gFc2W3El0.bat

Filesize
151B

MD5
341c56654b4b916155226d31ae60c33b

SHA1
15625cf5fdc9c74cd7ab2df39433ec7a3e1587e8

SHA256
a5712bbb877663ebb6f017ecb478fe7c79337afa84dbda0b7b1c75120cf7b38d

SHA512
32509ecdeed2748d7e66d26b1d8927f6ab1ee98bd7e3c2b585c1ac697f9aaccb6efd44c0f8d30c70c8baebb1b4e07a51a5ce6e437ad155975b33a7dfe7dbf994

Download Submit
C:\Users\Admin\AppData\Local\Temp\05209c49-65d0-41e2-be0f-b98a5a52f0a8.vbs

Filesize
737B

MD5
e799d98d7ddba2840bb46869f00a3356

SHA1
7a663f201c518c0a3c1d771d3cbac4ebf5dc010b

SHA256
b2131405b0ff7ba4c3a3ecabe3ac4ed070b73c9c65b74fe2b3e869b1f6b3a073

SHA512
ab403d23da9a1d93fe8fb8107339cb28d76c05e37df9e875d3bd6f78f0514738c0591c154f51214d0bc876a027fffd94bf4bb2df3e641df324af705b129aa0ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\f5ab0422-468b-4297-8af4-c0d62f18fd9e.vbs

Filesize
513B

MD5
931fff1d51d1ad7f27e8c5274bfc8d33

SHA1
02202cb57abad86a0be53b8f1c5f99e8125cc1d0

SHA256
ba48d8cf8e4b6955448ab42d67ff4d11e8086dde172876b78698acdafac8b073

SHA512
891413ae5e6288619ed5b1607b3ed3d8dfb0f378d0dab96b0ad5430651d592853165c17fb94d188f17464732251e1f45d5593cff07dc6a8ecd84e75c690965f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mo97XyALGj.bat

Filesize
202B

MD5
a54632687d119b8b60211dae421c31b1

SHA1
8c202a352634fe147a274debe03b2ef719a795f1

SHA256
9bea0a574bd966498d68d4838efcbb0b4960d3d4a8e9d3d129e32061bfce8b72

SHA512
5e23bee44641ae9b9fe43416f2c7a5a293b869d753797585410a1a5a0c9ccd6e5f34b9a2c69b0782346c0d4828b5d44aa8de0dfb7c06af5269c663ba264e89ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\zeW9hUBvdy.bat

Filesize
226B

MD5
86f6015f2a6a8b3c7fecd2e53a7084f8

SHA1
44945ad52da751d36d9ca1243a0e47bcb4828d1b

SHA256
28fac1306c7aae227e0d5424bed1d38e94cf835da9753ec1222081ae84b1e729

SHA512
709691a2df227a486add5d2e32a755e5f19a14ec63ba5c888fa63508324a41e7260e99045100e873e8b57419c563af28909add2e3677736b96aa7f610bbb619d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2f3a56623c95f2460f3e9c77911a954f

SHA1
4847667b4b60ca5ad0c5f96ae6e06114ed800c65

SHA256
f4e1d3025a2829a4b18abc3afd000c3e500c5f5afa416196e97d15fe05769fc0

SHA512
0c88fb642ab8e561af84f536d7bd365145fb79376f7a966876a336538f984f5d1005659f1819cd28894d494fa9def1e3c69fa6d30f5253bc39594270a6d0eb5c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
60cc3d8791061c56b998244dd246483e

SHA1
3d1f728aaab565e57ef1722243ac6a2323c2fc56

SHA256
0561629a6aeb60039c7c148769ccae97b9fcb2a4c02059c8c8970f1f5fcbc757

SHA512
ce8cbc921f641be0951eaf79cb1afe81d624f7c2b18d48d6f982d90c6531dc2352ed889ec3a7808233588446df0aef7e6cdc417582a162075fb011a5c29545de

Download Submit
memory/1744-50-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1744-52-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/1996-17-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/1996-18-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/1996-24-0x0000000000AB0000-0x0000000000ABC000-memory.dmp

Filesize
48KB

Download
memory/1996-25-0x0000000000AC0000-0x0000000000AC8000-memory.dmp

Filesize
32KB

Download
memory/1996-26-0x0000000000AD0000-0x0000000000ADC000-memory.dmp

Filesize
48KB

Download
memory/1996-22-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/1996-21-0x00000000004D0000-0x00000000004DA000-memory.dmp

Filesize
40KB

Download
memory/1996-20-0x0000000000A90000-0x0000000000A9C000-memory.dmp

Filesize
48KB

Download
memory/1996-19-0x00000000004C0000-0x00000000004C8000-memory.dmp

Filesize
32KB

Download
memory/1996-23-0x0000000000AA0000-0x0000000000AA8000-memory.dmp

Filesize
32KB

Download
memory/1996-16-0x0000000000360000-0x000000000036A000-memory.dmp

Filesize
40KB

Download
memory/1996-15-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/1996-13-0x0000000001300000-0x000000000148E000-memory.dmp

Filesize
1.6MB

Download
memory/1996-14-0x0000000000330000-0x000000000034C000-memory.dmp

Filesize
112KB

Download
memory/2200-138-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2332-212-0x0000000001140000-0x00000000012CE000-memory.dmp

Filesize
1.6MB

Download
memory/2496-160-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download
memory/2784-201-0x0000000000220000-0x00000000003AE000-memory.dmp

Filesize
1.6MB

Download