Overview

overview

10

Static

static

10

3aa1bbd17d...5b.exe

windows7-x64

10

3aa1bbd17d...5b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/12/2024, 10:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3aa1bbd17d68b0b67b7423f1fe09b05b.exe
  • Size 2.2MB
  • Sample241214-l43dpszphl
  • SHA256 7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 35 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 45 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Adds Run key to start application 2 TTPs 22 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 30 IoCs
    evasiontrojan
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 45 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe
    "C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:404
    • C:\Recovery\WindowsRE\Registry.exe
      "C:\Recovery\WindowsRE\Registry.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2020
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5232662f-518d-448c-be32-5639c3579356.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Recovery\WindowsRE\Registry.exe
          C:\Recovery\WindowsRE\Registry.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3668
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\600ecb4b-5e36-47a4-b903-68022daaf2de.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3000
            • C:\Recovery\WindowsRE\Registry.exe
              C:\Recovery\WindowsRE\Registry.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4920
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02c8a49a-8e39-453d-840b-19e68a8fff61.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5072
                • C:\Recovery\WindowsRE\Registry.exe
                  C:\Recovery\WindowsRE\Registry.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2704
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe2a95b1-7461-4539-82a9-30678ac7ece0.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3764
                    • C:\Recovery\WindowsRE\Registry.exe
                      C:\Recovery\WindowsRE\Registry.exe
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:1020
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\46c6ef8a-a494-4c78-b54d-dea411e88c13.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4004
                        • C:\Recovery\WindowsRE\Registry.exe
                          C:\Recovery\WindowsRE\Registry.exe
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4240
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1278a3b9-f60b-4f73-9fcf-718ef065399c.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2468
                            • C:\Recovery\WindowsRE\Registry.exe
                              C:\Recovery\WindowsRE\Registry.exe
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1204
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04f5945d-baaf-4d56-bc59-c347ff87828e.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4192
                                • C:\Recovery\WindowsRE\Registry.exe
                                  C:\Recovery\WindowsRE\Registry.exe
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:956
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d002079-1d5a-4279-8f68-2f759e7d559d.vbs"
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3972
                                    • C:\Recovery\WindowsRE\Registry.exe
                                      C:\Recovery\WindowsRE\Registry.exe
                                      18⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:392
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b168fc8-bdec-48fb-9b25-5b81eda6b726.vbs"
                                        19⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1992
                                        • C:\Recovery\WindowsRE\Registry.exe
                                          C:\Recovery\WindowsRE\Registry.exe
                                          20⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:1224
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bb328c0-c539-4e81-9e11-31dd79f6454c.vbs"
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4692
                                            • C:\Recovery\WindowsRE\Registry.exe
                                              C:\Recovery\WindowsRE\Registry.exe
                                              22⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:4384
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8192f27-8fec-4b8c-beaf-6a2f36b0854b.vbs"
                                                23⤵
                                                  PID:372
                                                  • C:\Recovery\WindowsRE\Registry.exe
                                                    C:\Recovery\WindowsRE\Registry.exe
                                                    24⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:3888
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d84d4d28-45f5-4a6e-b63a-cf8fb1e4956a.vbs"
                                                      25⤵
                                                        PID:3872
                                                        • C:\Recovery\WindowsRE\Registry.exe
                                                          C:\Recovery\WindowsRE\Registry.exe
                                                          26⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:2540
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33311d75-efa4-4092-91d1-64e034bb5d82.vbs"
                                                            27⤵
                                                              PID:4168
                                                              • C:\Recovery\WindowsRE\Registry.exe
                                                                C:\Recovery\WindowsRE\Registry.exe
                                                                28⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:4988
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b76c223-9704-43ce-9cf0-ce8c87e38a9c.vbs"
                                                                  29⤵
                                                                    PID:3956
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88301ed2-88ac-4c80-a63c-cdcd81535908.vbs"
                                                                    29⤵
                                                                      PID:4996
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80a37e79-2560-482d-bc99-3de8e66dde8c.vbs"
                                                                  27⤵
                                                                    PID:1304
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a73212e-3a27-4221-98c6-bcfa215fca33.vbs"
                                                                25⤵
                                                                  PID:2088
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b841718b-c799-4f58-a00b-a0cb2176246c.vbs"
                                                              23⤵
                                                                PID:4172
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cb5eac4-37bb-4a91-9f2d-f20843a79e33.vbs"
                                                            21⤵
                                                              PID:3736
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1a22eca-4163-495c-a812-7c66702b3a81.vbs"
                                                          19⤵
                                                            PID:4620
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc380726-a9b9-453e-8fcd-61a580e0d8f5.vbs"
                                                        17⤵
                                                          PID:3080
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a5f3a7fe-41e7-49d2-bfe6-0c7d11198323.vbs"
                                                      15⤵
                                                        PID:1188
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\134bc14e-e2d5-479e-a10f-534918a2012d.vbs"
                                                    13⤵
                                                      PID:1040
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e181cc6-714c-4a85-a830-3a877c1146f9.vbs"
                                                  11⤵
                                                    PID:4456
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb3c5331-fea2-4a72-9bff-749e18519b43.vbs"
                                                9⤵
                                                  PID:3664
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39395f90-5dd1-4514-a06b-4e96e75b5481.vbs"
                                              7⤵
                                                PID:1444
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56c18243-f0b3-456c-998c-b81cb35d664f.vbs"
                                            5⤵
                                              PID:60
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc17cdb1-bc37-4b79-af5b-d24c612ffcbf.vbs"
                                          3⤵
                                            PID:4604
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1184
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4836
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1008
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4376
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4920
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1488
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2232
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2032
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\services.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3028
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1936
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3064
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\SKB\LanguageModels\explorer.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:364
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2696
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2292
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1876
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4860
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:232
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4984
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\spoolsv.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4536
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4324
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5016
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\SearchApp.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3164
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3680
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\S-1-5-21-3442511616-637977696-3186306149-1000\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1116
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\csrss.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3560
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3060
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\host\fxr\7.0.16\csrss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3880
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3620
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3080
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5024
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\sihost.exe'" /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3436
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Templates\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:972
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\sihost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2708

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Winlogon Helper DLL

                                            1
                                            T1547.004

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Privilege Escalation

                                            Abuse Elevation Control Mechanism

                                            1
                                            T1548

                                            Bypass User Account Control

                                            1
                                            T1548.002

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Winlogon Helper DLL

                                            1
                                            T1547.004

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Defense Evasion

                                            Abuse Elevation Control Mechanism

                                            1
                                            T1548

                                            Bypass User Account Control

                                            1
                                            T1548.002

                                            Impair Defenses

                                            1
                                            T1562

                                            Disable or Modify Tools

                                            1
                                            T1562.001

                                            Modify Registry

                                            4
                                            T1112

                                            Credential Access

                                            Discovery

                                            Query Registry

                                            2
                                            T1012

                                            System Information Discovery

                                            3
                                            T1082

                                            Lateral Movement

                                            Collection

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            RuntimeBroker.exe
                                            • Path C:\Program Files (x86)\Windows Photo Viewer\es-ES\RuntimeBroker.exe
                                            • Size 2.2MB
                                            • SHA256 7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Registry.exe.log
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log
                                            • Size 1KB
                                            • SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            02c8a49a-8e39-453d-840b-19e68a8fff61.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\02c8a49a-8e39-453d-840b-19e68a8fff61.vbs
                                            • Size 710B
                                            • SHA256 db65401df2291987b1c3329bd2ba16854912e929b56d3ce61f901715183efd4c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            04f5945d-baaf-4d56-bc59-c347ff87828e.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\04f5945d-baaf-4d56-bc59-c347ff87828e.vbs
                                            • Size 710B
                                            • SHA256 cf07d3dcad95f68cca29366f9c3d83ff3ec74d88e6d1e71560beec251a41664c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            0b76c223-9704-43ce-9cf0-ce8c87e38a9c.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\0b76c223-9704-43ce-9cf0-ce8c87e38a9c.vbs
                                            • Size 710B
                                            • SHA256 77b74be2e6547281c5023e02c0b170e39da02077e349f2352b19566df95521c8
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            1278a3b9-f60b-4f73-9fcf-718ef065399c.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\1278a3b9-f60b-4f73-9fcf-718ef065399c.vbs
                                            • Size 710B
                                            • SHA256 798feac188d1d7d51f96de546f885c1b53b86a71c9d4f178a7d23dab425345b5
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            1b168fc8-bdec-48fb-9b25-5b81eda6b726.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\1b168fc8-bdec-48fb-9b25-5b81eda6b726.vbs
                                            • Size 709B
                                            • SHA256 9b1c8dc0a6dc11e3f8baf9f6dbfd65b9fb51601927d74f7742960b56fd8dd7b8
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            2bb328c0-c539-4e81-9e11-31dd79f6454c.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\2bb328c0-c539-4e81-9e11-31dd79f6454c.vbs
                                            • Size 710B
                                            • SHA256 0577632316bf85ee7e9c8876e0b8ec6c2a7da91f4f831d61a44a466d4ed3371e
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            2d002079-1d5a-4279-8f68-2f759e7d559d.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\2d002079-1d5a-4279-8f68-2f759e7d559d.vbs
                                            • Size 709B
                                            • SHA256 a5a626ac00291c5c164e56855f06bf073b7f8d092b01190ffcdfdedbfec8ad3f
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            33311d75-efa4-4092-91d1-64e034bb5d82.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\33311d75-efa4-4092-91d1-64e034bb5d82.vbs
                                            • Size 710B
                                            • SHA256 8ef97783cadc5ae53af219b2157a1e52569579041062cfe27a9e3618235bd02a
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            46c6ef8a-a494-4c78-b54d-dea411e88c13.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\46c6ef8a-a494-4c78-b54d-dea411e88c13.vbs
                                            • Size 710B
                                            • SHA256 85f2c94e5c9e6bac1539abcfe2fea60e69805df239035979cf560dd4c07599c7
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            5232662f-518d-448c-be32-5639c3579356.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\5232662f-518d-448c-be32-5639c3579356.vbs
                                            • Size 710B
                                            • SHA256 814b160891416886ad49aece0f9c9b5a82ee395a2884b45ae2e1337ddad5c1e2
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            600ecb4b-5e36-47a4-b903-68022daaf2de.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\600ecb4b-5e36-47a4-b903-68022daaf2de.vbs
                                            • Size 710B
                                            • SHA256 3bbb628e0f911e3cc586545e3e06fb67115923c43823c59049a156829fb5eb4c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            bc17cdb1-bc37-4b79-af5b-d24c612ffcbf.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\bc17cdb1-bc37-4b79-af5b-d24c612ffcbf.vbs
                                            • Size 486B
                                            • SHA256 9c6aeaccf33e3644aea6dce49eee5d9958671c3b68f905c39159f4113f7ef256
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            d8192f27-8fec-4b8c-beaf-6a2f36b0854b.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\d8192f27-8fec-4b8c-beaf-6a2f36b0854b.vbs
                                            • Size 710B
                                            • SHA256 dd3e5c48ad86fa270cabae06966e0e6bb4b1b7c37095bc32ba00001bce35b060
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            d84d4d28-45f5-4a6e-b63a-cf8fb1e4956a.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\d84d4d28-45f5-4a6e-b63a-cf8fb1e4956a.vbs
                                            • Size 710B
                                            • SHA256 c0ed01362c2c96b15a3b21fc227cffcee5bbca6b18c954b74d628c9c2af8caa8
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            fe2a95b1-7461-4539-82a9-30678ac7ece0.vbs
                                            • Path C:\Users\Admin\AppData\Local\Temp\fe2a95b1-7461-4539-82a9-30678ac7ece0.vbs
                                            • Size 710B
                                            • SHA256 6dd91fb993f926013494b839e0f9b5ab1d8ded8366e09754636a16e40ee9795e
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            memory/392-160-0x000000001C150000-0x000000001C162000-memory.dmp
                                            Download

                                            memory/404-14-0x0000000002C70000-0x0000000002C80000-memory.dmp
                                            Download

                                            memory/404-69-0x00007FFEC1A60000-0x00007FFEC2521000-memory.dmp
                                            Download

                                            memory/404-20-0x000000001B610000-0x000000001B622000-memory.dmp
                                            Download

                                            memory/404-21-0x000000001C390000-0x000000001C8B8000-memory.dmp
                                            Download

                                            memory/404-24-0x000000001BE70000-0x000000001BE7C000-memory.dmp
                                            Download

                                            memory/404-23-0x000000001BE60000-0x000000001BE68000-memory.dmp
                                            Download

                                            memory/404-25-0x000000001BE80000-0x000000001BE8C000-memory.dmp
                                            Download

                                            memory/404-22-0x000000001B640000-0x000000001B64C000-memory.dmp
                                            Download

                                            memory/404-26-0x000000001BF90000-0x000000001BF98000-memory.dmp
                                            Download

                                            memory/404-27-0x000000001BFA0000-0x000000001BFAC000-memory.dmp
                                            Download

                                            memory/404-32-0x000000001C0F0000-0x000000001C0FC000-memory.dmp
                                            Download

                                            memory/404-31-0x000000001C0E0000-0x000000001C0E8000-memory.dmp
                                            Download

                                            memory/404-30-0x000000001C0D0000-0x000000001C0D8000-memory.dmp
                                            Download

                                            memory/404-29-0x000000001C0C0000-0x000000001C0CE000-memory.dmp
                                            Download

                                            memory/404-28-0x000000001BFB0000-0x000000001BFBA000-memory.dmp
                                            Download

                                            memory/404-33-0x000000001C100000-0x000000001C108000-memory.dmp
                                            Download

                                            memory/404-34-0x000000001C210000-0x000000001C21A000-memory.dmp
                                            Download

                                            memory/404-35-0x000000001C110000-0x000000001C11C000-memory.dmp
                                            Download

                                            memory/404-18-0x000000001B5F0000-0x000000001B5FC000-memory.dmp
                                            Download

                                            memory/404-19-0x000000001B600000-0x000000001B608000-memory.dmp
                                            Download

                                            memory/404-17-0x000000001B5E0000-0x000000001B5E8000-memory.dmp
                                            Download

                                            memory/404-16-0x000000001B5D0000-0x000000001B5DC000-memory.dmp
                                            Download

                                            memory/404-15-0x000000001B5C0000-0x000000001B5CA000-memory.dmp
                                            Download

                                            memory/404-0-0x00007FFEC1A63000-0x00007FFEC1A65000-memory.dmp
                                            Download

                                            memory/404-13-0x0000000002C60000-0x0000000002C68000-memory.dmp
                                            Download

                                            memory/404-12-0x0000000002C80000-0x0000000002C8C000-memory.dmp
                                            Download

                                            memory/404-7-0x0000000002C00000-0x0000000002C08000-memory.dmp
                                            Download

                                            memory/404-9-0x0000000002C20000-0x0000000002C36000-memory.dmp
                                            Download

                                            memory/404-1-0x0000000000760000-0x000000000099E000-memory.dmp
                                            Download

                                            memory/404-11-0x0000000002C50000-0x0000000002C62000-memory.dmp
                                            Download

                                            memory/404-10-0x0000000002C40000-0x0000000002C48000-memory.dmp
                                            Download

                                            memory/404-8-0x0000000002C10000-0x0000000002C20000-memory.dmp
                                            Download

                                            memory/404-6-0x000000001B570000-0x000000001B5C0000-memory.dmp
                                            Download

                                            memory/404-5-0x0000000002BE0000-0x0000000002BFC000-memory.dmp
                                            Download

                                            memory/404-4-0x0000000002BD0000-0x0000000002BD8000-memory.dmp
                                            Download

                                            memory/404-3-0x0000000001260000-0x000000000126E000-memory.dmp
                                            Download

                                            memory/404-2-0x00007FFEC1A60000-0x00007FFEC2521000-memory.dmp
                                            Download

                                            memory/1204-137-0x000000001BB10000-0x000000001BB22000-memory.dmp
                                            Download

                                            memory/4988-216-0x000000001B960000-0x000000001B972000-memory.dmp
                                            Download