dcrat | b20fbaf6e01ac6b5cf8737f4b27047319a569d2102c271e672dff9879e568998

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FATALITY/loader.exe
Size

3.2MB
MD5

2307ca04c2633d28345fb0580c77c2ec
SHA1

edbd1f092ed03cb2674877aba6e874722ee07814
SHA256

168637ea64d64afefd1f88b91ffecb74715ccb6a98acf73d4a16175511628276
SHA512

c2646c5bf3dcd6ef4679af80ae6424c1f88e3f29a40beff729b59bebd8fd3d9b0d45392d2e11f4e1b69ada0f4ec20cfc45430d184cdf0238f2845b7deaff7e9b
SSDEEP

98304:ups+iZyomWShz+6WumEq5GGxLnIlP2NgQKGfxx:ndZOhNWumEqxLIB21K6H

Score

10^/10

dcrat discovery infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\", \"C:\\Users\\Public\\Libraries\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\", \"C:\\Users\\Public\\Libraries\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Windows\\SysWOW64\\sr-Latn-RS\\Registry.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\", \"C:\\Users\\Public\\Libraries\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Windows\\SysWOW64\\sr-Latn-RS\\Registry.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\upfc.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\", \"C:\\Users\\Public\\Libraries\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\services.exe\", \"C:\\Windows\\SysWOW64\\sr-Latn-RS\\Registry.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\upfc.exe\", \"C:\\ServerWinRuntimeBroker\\chainPorthostCommon.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\", \"C:\\Users\\Public\\Libraries\\StartMenuExperienceHost.exe\""	chainPorthostCommon.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	1740	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	1740	schtasks.exe	89

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	chainPorthostCommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2012	chainPorthostCommon.exe
3564	Registry.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\upfc.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\upfc.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chainPorthostCommon = "\"C:\\ServerWinRuntimeBroker\\chainPorthostCommon.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\SysWOW64\\sr-Latn-RS\\Registry.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\SysWOW64\\sr-Latn-RS\\Registry.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chainPorthostCommon = "\"C:\\ServerWinRuntimeBroker\\chainPorthostCommon.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\dllhost.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\Libraries\\StartMenuExperienceHost.exe\""	chainPorthostCommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\Libraries\\StartMenuExperienceHost.exe\""	chainPorthostCommon.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sr-Latn-RS\ee2ad38f3d4382	chainPorthostCommon.exe
File created	\??\c:\Windows\System32\CSC392B862D76E84A3EBC708FAC6AC2550.TMP	csc.exe
File created	\??\c:\Windows\System32\s_kgxh.exe	csc.exe
File created	C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe	chainPorthostCommon.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3948	loader.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe	chainPorthostCommon.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe	chainPorthostCommon.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\ea1d8f6d871115	chainPorthostCommon.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\dllhost.exe	chainPorthostCommon.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\5940a34987c991	chainPorthostCommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	chainPorthostCommon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4196	schtasks.exe
3212	schtasks.exe
4076	schtasks.exe
2188	schtasks.exe
1236	schtasks.exe
456	schtasks.exe
3704	schtasks.exe
1524	schtasks.exe
744	schtasks.exe
2576	schtasks.exe
1436	schtasks.exe
1968	schtasks.exe
1204	schtasks.exe
4796	schtasks.exe
4124	schtasks.exe
1568	schtasks.exe
1692	schtasks.exe
4884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	loader.exe
3948	loader.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe
2012	chainPorthostCommon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	chainPorthostCommon.exe
Token: SeDebugPrivilege	3564	Registry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3948	loader.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 2768	3948	loader.exe	82
PID 3948 wrote to memory of 2768	3948	loader.exe	82
PID 3948 wrote to memory of 2768	3948	loader.exe	82
PID 2768 wrote to memory of 2176	2768	WScript.exe	85
PID 2768 wrote to memory of 2176	2768	WScript.exe	85
PID 2768 wrote to memory of 2176	2768	WScript.exe	85
PID 2176 wrote to memory of 2012	2176	cmd.exe	87
PID 2176 wrote to memory of 2012	2176	cmd.exe	87
PID 2012 wrote to memory of 4544	2012	chainPorthostCommon.exe	93
PID 2012 wrote to memory of 4544	2012	chainPorthostCommon.exe	93
PID 4544 wrote to memory of 4360	4544	csc.exe	95
PID 4544 wrote to memory of 4360	4544	csc.exe	95
PID 2012 wrote to memory of 980	2012	chainPorthostCommon.exe	111
PID 2012 wrote to memory of 980	2012	chainPorthostCommon.exe	111
PID 980 wrote to memory of 3756	980	cmd.exe	113
PID 980 wrote to memory of 3756	980	cmd.exe	113
PID 980 wrote to memory of 3428	980	cmd.exe	114
PID 980 wrote to memory of 3428	980	cmd.exe	114
PID 980 wrote to memory of 3564	980	cmd.exe	118
PID 980 wrote to memory of 3564	980	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FATALITY\loader.exe
"C:\Users\Admin\AppData\Local\Temp\FATALITY\loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\ServerWinRuntimeBroker\chainPorthostCommon.exe
      "C:\ServerWinRuntimeBroker/chainPorthostCommon.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2012
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fju4ku5b\fju4ku5b.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4544
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA3F1.tmp" "c:\Windows\System32\CSC392B862D76E84A3EBC708FAC6AC2550.TMP"
        6⤵
        
        PID:4360
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BASt1yHq1g.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:980
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3756
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3428
      - C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe
        
        "C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Libraries\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\sr-Latn-RS\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainPorthostCommonc" /sc MINUTE /mo 11 /tr "'C:\ServerWinRuntimeBroker\chainPorthostCommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainPorthostCommon" /sc ONLOGON /tr "'C:\ServerWinRuntimeBroker\chainPorthostCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chainPorthostCommonc" /sc MINUTE /mo 9 /tr "'C:\ServerWinRuntimeBroker\chainPorthostCommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ServerWinRuntimeBroker\OAKCwEsKnudXsAgphVRYMDBaoP2ZIjCO6J5QYyd0q81GMNjCqOkwlC1.vbe

Filesize
223B

MD5
3569aec6289503482c7877ad3f205301

SHA1
cf016699d614c9f2e9a899c646cd24aca6b75fcf

SHA256
a2bb38c2d2eafac2d73af9247252de8cfac9a4f9522b4f66ad73d9a003fc7754

SHA512
d8df28cd229e31eb97a705d02aac38f836b5b05741bdb7c97f4a8d9d3eec183a3883e39b30c2141e9c8b650c98edfb51a8cb7fce1c87d67b15bd9dc52a1b1ef5

Download Submit
C:\ServerWinRuntimeBroker\chainPorthostCommon.exe

Filesize
1.9MB

MD5
cf5b49706562ba2047cda4a451dd573a

SHA1
d7d66016b5ea4215581f208c7972b2ff49cbeed1

SHA256
74547e5b862bd3691947b78eabbdab88c468e26144bd03911be68941376dc89b

SHA512
0dc54fc8afe4a1b8ce0d72e215cf617dbc657f4e02cabe7be694b0d20be385f63848e49717bd4856547dbb52f8a762e54c63323b53188cc1d8127c54b6a10f1e

Download Submit
C:\ServerWinRuntimeBroker\wJc3A8cK4hSMmtCgCMOA49.bat

Filesize
96B

MD5
ca78c31c7fad40ca729ce40659dd91fa

SHA1
b649a3669cffe53122ad50f62f769faa45b96a92

SHA256
88b4be83a053855858771fda50d7f6fe0cd5f5fd0cd33b3299c28aab5eb40e2b

SHA512
b606a335ac5f28030e60a00f99e519240bc3d47d7d88e84eb8de1f34ef19ae6df56f01f5f6d83fa215f445732596f0865d630675706626545b15e0c64b0a21ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\BASt1yHq1g.bat

Filesize
219B

MD5
fb7e7536e5f20986f513d5c810d178b4

SHA1
0c888d1b860f7c66a6ba7e7524e34e5cdfa8dec1

SHA256
004414074266e2225a01a2fcb190c54e01c9c224e0dcdcf7ba2333d498932b3b

SHA512
ba7c171b3ccf8ff21b6c66826a4d213d7c7ab6663854a017c8968dc1e2020c34effbf86ba81d09cc0fd4a524a2f78c4a4fab53e651036cbc44cae97559457590

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA3F1.tmp

Filesize
1KB

MD5
001c2475bfa3d04f6257ddbe0d9a6d7c

SHA1
1f170c7d068b10a7d9fe2523c3fe00ef4dd2c1b5

SHA256
0dee3d4be745c7356f558453e77e255c980dd7e39e3d385cd1ba9f7e393ab13f

SHA512
34b0743eef9a572e6ac8f9210966a4993931e020c3a486edc861479e38dbd53b432cb439802ed40c1fb2b6c0f91ab45abcb2818404a37a244dcd5d2d9c3a63c3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fju4ku5b\fju4ku5b.0.cs

Filesize
397B

MD5
b0c44acbd1c843e6cde8e6f32354f648

SHA1
3043a3e67fb35501ef40924126efdb50e38241e8

SHA256
79d1e37c3a99faec272741e89fc07296dce2c48889de926e9f6f8713843d189e

SHA512
892db59892c305e125aebb87bb74497cd23f1d09fc970b544051de932a3e326ef9e94346561e1cae60496bbb0d83472e849d2256de4edac7779d8405bee57d8b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fju4ku5b\fju4ku5b.cmdline

Filesize
235B

MD5
2d6a9d69214b7b592112da5be2387d76

SHA1
fb71ab84b726bef4325e1cc2e996d5def3c5b685

SHA256
38e89d299ac0c410e640fce175ba323caa89811e748a9d2bd75216fcfca10c80

SHA512
478e227c8e4efcedb2f6d513ab7f12d184a9e39c33bdb75c4c5834a9421669b65aa160d70644d18731fb6c1960ca3ea6549df79df70b3d296dca86a20afebd4e

Download Submit
\??\c:\Windows\System32\CSC392B862D76E84A3EBC708FAC6AC2550.TMP

Filesize
1KB

MD5
634e281a00b7b9f516c3048badfa1530

SHA1
af6369715ce2fe9b99609e470d4f66698880a35a

SHA256
0d990336ae793f3f6903048004c8d707d7a7191927bd7df46b7fe887116506c8

SHA512
1cb35fa0759f5362c9c7eee5546710874121005a3924bcfec2cf33ac90a257a807ce7ec0db7bc84dcb327604d708009449c34f52560ed936b54eeba49be7d27b

Download Submit
memory/2012-14-0x00007FFFFBCA3000-0x00007FFFFBCA5000-memory.dmp

Filesize
8KB

Download
memory/2012-20-0x0000000002F40000-0x0000000002F90000-memory.dmp

Filesize
320KB

Download
memory/2012-22-0x0000000002EF0000-0x0000000002F08000-memory.dmp

Filesize
96KB

Download
memory/2012-24-0x0000000001550000-0x000000000155E000-memory.dmp

Filesize
56KB

Download
memory/2012-26-0x0000000002D90000-0x0000000002D9C000-memory.dmp

Filesize
48KB

Download
memory/2012-19-0x0000000002ED0000-0x0000000002EEC000-memory.dmp

Filesize
112KB

Download
memory/2012-17-0x0000000001540000-0x000000000154E000-memory.dmp

Filesize
56KB

Download
memory/2012-15-0x0000000000A80000-0x0000000000C66000-memory.dmp

Filesize
1.9MB

Download
memory/2012-55-0x000000001B880000-0x000000001B94D000-memory.dmp

Filesize
820KB

Download
memory/3564-66-0x000000001AE60000-0x000000001AE68000-memory.dmp

Filesize
32KB

Download
memory/3564-65-0x000000001B480000-0x000000001B54D000-memory.dmp

Filesize
820KB

Download
memory/3948-0-0x00000000007A0000-0x0000000000B95000-memory.dmp

Filesize
4.0MB

Download
memory/3948-8-0x00000000007A0000-0x0000000000B95000-memory.dmp

Filesize
4.0MB

Download