dcrat | 87fa5d0d7912d7a1295e7d585f41797bc5c76a5ea7d9d7b362fcc20472715f9b

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6706364c78566c589c6c45217e852b02.exe
Size

1.9MB
MD5

6706364c78566c589c6c45217e852b02
SHA1

e0bc8a67a91d5ea42c072e63f36f4993d9620c2d
SHA256

87fa5d0d7912d7a1295e7d585f41797bc5c76a5ea7d9d7b362fcc20472715f9b
SHA512

3aed779886dcb08bac7eda66cf4b4adbcf420ac0dfc702ef645f231cc40f0801cd16b35cafb12dc5b7125c237df65df091366c884ce20158447752507e1023f7
SSDEEP

49152:JV9LiEUzT6V+qiRGVcqb++v8PlPwvwOfPGZyM1b2DAWsM:JnezTGriRRq3vGNCJfPOy4b

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Adobe\\winlogon.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\wininit.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Adobe\\winlogon.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\wininit.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Adobe\\winlogon.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\wininit.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\6706364c78566c589c6c45217e852b02.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Adobe\\winlogon.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Adobe\\winlogon.exe\", \"C:\\Program Files\\Common Files\\microsoft shared\\fontdrvhost.exe\""	6706364c78566c589c6c45217e852b02.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	3616	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	3616	schtasks.exe	82

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2632	powershell.exe
3580	powershell.exe
4428	powershell.exe
3948	powershell.exe
1200	powershell.exe
1244	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	6706364c78566c589c6c45217e852b02.exe

Executes dropped EXE 1 IoCs

pid	Process
116	fontdrvhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\wininit.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Photo Viewer\\ja-JP\\wininit.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\RuntimeBroker.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Adobe\\winlogon.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Common Files\\microsoft shared\\fontdrvhost.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Common Files\\microsoft shared\\fontdrvhost.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\RuntimeBroker.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6706364c78566c589c6c45217e852b02 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6706364c78566c589c6c45217e852b02.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6706364c78566c589c6c45217e852b02 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6706364c78566c589c6c45217e852b02.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Google\\Chrome\\RuntimeBroker.exe\""	6706364c78566c589c6c45217e852b02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Adobe\\winlogon.exe\""	6706364c78566c589c6c45217e852b02.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCA4B371FC12394624A6F9C5E26D3820DD.TMP	csc.exe
File created	\??\c:\Windows\System32\enb1sa.exe	csc.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\RuntimeBroker.exe	6706364c78566c589c6c45217e852b02.exe
File created	C:\Program Files\Google\Chrome\9e8d7a4ca61bd9	6706364c78566c589c6c45217e852b02.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\wininit.exe	6706364c78566c589c6c45217e852b02.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\56085415360792	6706364c78566c589c6c45217e852b02.exe
File created	C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe	6706364c78566c589c6c45217e852b02.exe
File created	C:\Program Files\Common Files\microsoft shared\5b884080fd4f94	6706364c78566c589c6c45217e852b02.exe
File created	C:\Program Files (x86)\Adobe\winlogon.exe	6706364c78566c589c6c45217e852b02.exe
File created	C:\Program Files (x86)\Adobe\cc11b995f2a76d	6706364c78566c589c6c45217e852b02.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4768	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	6706364c78566c589c6c45217e852b02.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4768	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1184	schtasks.exe
3268	schtasks.exe
1160	schtasks.exe
1156	schtasks.exe
1532	schtasks.exe
3236	schtasks.exe
1592	schtasks.exe
5044	schtasks.exe
1696	schtasks.exe
3808	schtasks.exe
1748	schtasks.exe
2972	schtasks.exe
4136	schtasks.exe
3448	schtasks.exe
2352	schtasks.exe
2536	schtasks.exe
2060	schtasks.exe
4060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe
4076	6706364c78566c589c6c45217e852b02.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	6706364c78566c589c6c45217e852b02.exe
Token: SeDebugPrivilege	3580	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	116	fontdrvhost.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4916	4076	6706364c78566c589c6c45217e852b02.exe	86
PID 4076 wrote to memory of 4916	4076	6706364c78566c589c6c45217e852b02.exe	86
PID 4916 wrote to memory of 2384	4916	csc.exe	88
PID 4916 wrote to memory of 2384	4916	csc.exe	88
PID 4076 wrote to memory of 1200	4076	6706364c78566c589c6c45217e852b02.exe	104
PID 4076 wrote to memory of 1200	4076	6706364c78566c589c6c45217e852b02.exe	104
PID 4076 wrote to memory of 3948	4076	6706364c78566c589c6c45217e852b02.exe	105
PID 4076 wrote to memory of 3948	4076	6706364c78566c589c6c45217e852b02.exe	105
PID 4076 wrote to memory of 4428	4076	6706364c78566c589c6c45217e852b02.exe	106
PID 4076 wrote to memory of 4428	4076	6706364c78566c589c6c45217e852b02.exe	106
PID 4076 wrote to memory of 3580	4076	6706364c78566c589c6c45217e852b02.exe	107
PID 4076 wrote to memory of 3580	4076	6706364c78566c589c6c45217e852b02.exe	107
PID 4076 wrote to memory of 2632	4076	6706364c78566c589c6c45217e852b02.exe	108
PID 4076 wrote to memory of 2632	4076	6706364c78566c589c6c45217e852b02.exe	108
PID 4076 wrote to memory of 1244	4076	6706364c78566c589c6c45217e852b02.exe	109
PID 4076 wrote to memory of 1244	4076	6706364c78566c589c6c45217e852b02.exe	109
PID 4076 wrote to memory of 4324	4076	6706364c78566c589c6c45217e852b02.exe	116
PID 4076 wrote to memory of 4324	4076	6706364c78566c589c6c45217e852b02.exe	116
PID 4324 wrote to memory of 4464	4324	cmd.exe	118
PID 4324 wrote to memory of 4464	4324	cmd.exe	118
PID 4324 wrote to memory of 4768	4324	cmd.exe	119
PID 4324 wrote to memory of 4768	4324	cmd.exe	119
PID 4324 wrote to memory of 116	4324	cmd.exe	123
PID 4324 wrote to memory of 116	4324	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6706364c78566c589c6c45217e852b02.exe
"C:\Users\Admin\AppData\Local\Temp\6706364c78566c589c6c45217e852b02.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dt2mrnee\dt2mrnee.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72DE.tmp" "c:\Windows\System32\CSCA4B371FC12394624A6F9C5E26D3820DD.TMP"
    3⤵
    PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\ja-JP\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6706364c78566c589c6c45217e852b02.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OcEG4zAE9d.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4464
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4768
- - C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe
    "C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\microsoft shared\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6706364c78566c589c6c45217e852b026" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\6706364c78566c589c6c45217e852b02.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6706364c78566c589c6c45217e852b02" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\6706364c78566c589c6c45217e852b02.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6706364c78566c589c6c45217e852b026" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\6706364c78566c589c6c45217e852b02.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\RuntimeBroker.exe

Filesize
1.9MB

MD5
6706364c78566c589c6c45217e852b02

SHA1
e0bc8a67a91d5ea42c072e63f36f4993d9620c2d

SHA256
87fa5d0d7912d7a1295e7d585f41797bc5c76a5ea7d9d7b362fcc20472715f9b

SHA512
3aed779886dcb08bac7eda66cf4b4adbcf420ac0dfc702ef645f231cc40f0801cd16b35cafb12dc5b7125c237df65df091366c884ce20158447752507e1023f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Temp\OcEG4zAE9d.bat

Filesize
190B

MD5
58a626c45c499e53b5c6379b540f72c6

SHA1
8835674602950c917ed0b8fe758aa1ed15335d04

SHA256
45738999e7f5bac99fef48d330322e6985ecb694dc9e1a6fb7f887cfbd1a1769

SHA512
8dfac724078faf002471c21d3c60706ca1a96dfc6b9d8db263fac365e25b1eb8810e531dc72331e2a6ca5686f56f6fcf6da04ecc7e664627158f341c93a724fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES72DE.tmp

Filesize
1KB

MD5
933cc45adf18919f998203a9ec9a9d19

SHA1
a87309f603caab34896dd03d9b075f2244a1b3a2

SHA256
1b32908562c877ac06b9a87b9d1991be309e133e47200a9d3b495a66cc2bffe9

SHA512
0355cb9688bcb0c6874e0a0d383ec4ea9843a027372c1d48cf1e9cc591d2b133c2cbc5767cf17d4b1ac0f1fe8ee34e7920d9629490bdc05ed1f2ba338cbcc4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jx0hfuyq.3rg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dt2mrnee\dt2mrnee.0.cs

Filesize
380B

MD5
a5065aaca2952ed63f6c4123eee44d8e

SHA1
fb2f31c5d5e32c689add4056c74839dee0b8eae8

SHA256
8a9b57515a4f133604bc6a647cec6a815ff2d3162d7c17053fc0c75b09243fab

SHA512
269db36a99b9810f518bd70026f8cc3f2c8bda705ac9da385f695ed1b0f6e6090c8999ceeea7805a9dda892fecc3d71d2b1a1b379c2232dc6961ba2300eb7a41

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dt2mrnee\dt2mrnee.cmdline

Filesize
235B

MD5
d0142e85e4a96caaf978f479179b36c5

SHA1
694b113710c010e436f8b1beff97fe25587c4bd6

SHA256
dd02b5308a4507f62ca8cad92c266cc4b5193aa01184c453850211918867e491

SHA512
e087d0a847e8fed2385592be8efc041b4d6bcc819b0aa27d638dd5adb41a7468d16d3535104685e7cbcda886af179bb2735ffae2a8ddadbd15d9de4c76760e62

Download Submit
\??\c:\Windows\System32\CSCA4B371FC12394624A6F9C5E26D3820DD.TMP

Filesize
1KB

MD5
5984679060d0fc54eba47cead995f65a

SHA1
f72bbbba060ac80ac6abedc7b8679e8963f63ebf

SHA256
4104fdf5499f0aa7dd161568257acae002620ec385f2ede2072d4f550ecff433

SHA512
bc8aadfabe5dbb4e3ea5e07a5ccbddd363400005675acda3e9cb414dc75fb0ba74f41b4a6baf34d42f85a9ae0af7d2418420c78b0c643f7243fe93a49b8140b5

Download Submit
memory/116-129-0x000000001C190000-0x000000001C1FB000-memory.dmp

Filesize
428KB

Download
memory/3580-55-0x000002146AD40000-0x000002146AD62000-memory.dmp

Filesize
136KB

Download
memory/4076-12-0x00000000023B0000-0x00000000023C8000-memory.dmp

Filesize
96KB

Download
memory/4076-84-0x00000000023D0000-0x000000000243B000-memory.dmp

Filesize
428KB

Download
memory/4076-30-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-31-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-35-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-15-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-17-0x0000000002370000-0x000000000237C000-memory.dmp

Filesize
48KB

Download
memory/4076-14-0x0000000002350000-0x000000000235E000-memory.dmp

Filesize
56KB

Download
memory/4076-10-0x000000001AF50000-0x000000001AFA0000-memory.dmp

Filesize
320KB

Download
memory/4076-19-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-94-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-0-0x00007FFA88833000-0x00007FFA88835000-memory.dmp

Filesize
8KB

Download
memory/4076-9-0x0000000002390000-0x00000000023AC000-memory.dmp

Filesize
112KB

Download
memory/4076-6-0x0000000002300000-0x000000000230E000-memory.dmp

Filesize
56KB

Download
memory/4076-7-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-4-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-3-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-2-0x00007FFA88830000-0x00007FFA892F1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-1-0x0000000000050000-0x0000000000236000-memory.dmp

Filesize
1.9MB

Download