dcrat | 4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482

Analysis

max time kernel
95s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe
Size

2.2MB
MD5

a6d7768b3c9f9aae725153c932c2b689
SHA1

04666444433ca3503a63a3846b074947e474f828
SHA256

4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482
SHA512

b1b4812900a97b2edeea374bea01ade8a27e33f106061cf277eb0f15ec499be044f2e4e7e168767ad8287f2347d08102cf32ffb90cf9e7a1796a88034c225deb
SSDEEP

49152:IBJ/8S2mDpxl4U/IJL4HfAzqLwvugU6fZ9pHhjEHg2Rl+yJmu3qwl:yZ8S2mDpxl4U/IJL4HfAzqLwvugU6f1S

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\", \"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\sppsvc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\", \"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\sppsvc.exe\", \"C:\\Users\\Default User\\System.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\", \"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\sppsvc.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Windows\\Migration\\WTR\\sysmon.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\", \"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\sppsvc.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Windows\\Migration\\WTR\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\", \"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\sppsvc.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Windows\\Migration\\WTR\\sysmon.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\""	componentdll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4544	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	212	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	4836	schtasks.exe	92
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4836	schtasks.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2508	powershell.exe
2000	powershell.exe
2008	powershell.exe
4476	powershell.exe
912	powershell.exe
4356	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	componentdll.exe

Executes dropped EXE 2 IoCs

pid	Process
4960	componentdll.exe
1920	services.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\componentdll = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\sppsvc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\Migration\\WTR\\sysmon.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Windows\\Migration\\WTR\\sysmon.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\componentdll = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\Reader\\DC\\services.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Temp\\MsEdgeCrashpad\\reports\\sppsvc.exe\""	componentdll.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCA1BB18AD7B404F9991A21537647B8A4E.TMP	csc.exe
File created	\??\c:\Windows\System32\ovufcs.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\services.exe	componentdll.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\c5b4cb5e9653cc	componentdll.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\sysmon.exe	componentdll.exe
File created	C:\Windows\Migration\WTR\121e5b5079f7c0	componentdll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1400	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	componentdll.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1400	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4012	schtasks.exe
4604	schtasks.exe
3480	schtasks.exe
4768	schtasks.exe
2404	schtasks.exe
1896	schtasks.exe
4544	schtasks.exe
212	schtasks.exe
2284	schtasks.exe
1612	schtasks.exe
552	schtasks.exe
3388	schtasks.exe
1576	schtasks.exe
4204	schtasks.exe
372	schtasks.exe
2248	schtasks.exe
3292	schtasks.exe
3004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe
4960	componentdll.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	componentdll.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	1920	services.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 4964	2420	4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe	83
PID 2420 wrote to memory of 4964	2420	4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe	83
PID 2420 wrote to memory of 4964	2420	4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe	83
PID 4964 wrote to memory of 2988	4964	WScript.exe	87
PID 4964 wrote to memory of 2988	4964	WScript.exe	87
PID 4964 wrote to memory of 2988	4964	WScript.exe	87
PID 2988 wrote to memory of 4960	2988	cmd.exe	90
PID 2988 wrote to memory of 4960	2988	cmd.exe	90
PID 4960 wrote to memory of 4620	4960	componentdll.exe	97
PID 4960 wrote to memory of 4620	4960	componentdll.exe	97
PID 4620 wrote to memory of 1748	4620	csc.exe	99
PID 4620 wrote to memory of 1748	4620	csc.exe	99
PID 4960 wrote to memory of 4476	4960	componentdll.exe	115
PID 4960 wrote to memory of 4476	4960	componentdll.exe	115
PID 4960 wrote to memory of 2008	4960	componentdll.exe	116
PID 4960 wrote to memory of 2008	4960	componentdll.exe	116
PID 4960 wrote to memory of 2000	4960	componentdll.exe	117
PID 4960 wrote to memory of 2000	4960	componentdll.exe	117
PID 4960 wrote to memory of 2508	4960	componentdll.exe	118
PID 4960 wrote to memory of 2508	4960	componentdll.exe	118
PID 4960 wrote to memory of 4356	4960	componentdll.exe	119
PID 4960 wrote to memory of 4356	4960	componentdll.exe	119
PID 4960 wrote to memory of 912	4960	componentdll.exe	120
PID 4960 wrote to memory of 912	4960	componentdll.exe	120
PID 4960 wrote to memory of 4588	4960	componentdll.exe	127
PID 4960 wrote to memory of 4588	4960	componentdll.exe	127
PID 4588 wrote to memory of 4464	4588	cmd.exe	129
PID 4588 wrote to memory of 4464	4588	cmd.exe	129
PID 4588 wrote to memory of 1400	4588	cmd.exe	130
PID 4588 wrote to memory of 1400	4588	cmd.exe	130
PID 4588 wrote to memory of 1920	4588	cmd.exe	138
PID 4588 wrote to memory of 1920	4588	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe
"C:\Users\Admin\AppData\Local\Temp\4dca2f0ac5ac98e370099d515a40d03059894d9d905fe83d55401d07cfc43482.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\b5G22TwI5sSnSJKL7urg5tCF8EHPXDbL9yEMgA9LaYyHnpFyHeN8L6Oob76V.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\Gl46TpULdKzqTEeaDuM.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe
      "C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc/componentdll.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4960
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0cp4bndp\0cp4bndp.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4620
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES199E.tmp" "c:\Windows\System32\CSCA1BB18AD7B404F9991A21537647B8A4E.TMP"
        6⤵
        
        PID:1748
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Adobe\Reader\DC\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\MsEdgeCrashpad\reports\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dQBvvvQC8Z.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4588
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4464
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1400
      - C:\Program Files (x86)\Common Files\Adobe\Reader\DC\services.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Adobe\Reader\DC\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Reader\DC\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\Adobe\Reader\DC\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Windows\Migration\WTR\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdllc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdll" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdllc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES199E.tmp

Filesize
1KB

MD5
fbc3b8bec9c3a94df7a5a99f29249ee7

SHA1
c09d618cbbc64bbab96e80152c7f52534af589d7

SHA256
394d5a9531e6b9b08cd1d09c31e1c0e57040431e91ad64331435f2a53f0e6a11

SHA512
0ad00a9f7590ca85f451cf8235c4fd91fa63290d62d387af026e4160a48bdaa2b1116df0cf4fc92d06d6acf01cf9af1f418f89dcf358f827b4b7277dc14d7427

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kywpwu2b.w4z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dQBvvvQC8Z.bat

Filesize
192B

MD5
ef53d0a38f5893559347e925745830d6

SHA1
0d7d8d0c6191f82dd677e6801977f828cffeb19c

SHA256
be099060b7480ab75e3683b6cdb6c88134c638811d3f3ca962a4003da9ec0284

SHA512
cc8cbdb76b0ab135f73a5b327ab9ae9ed96895a012414b81c703878340f60a091b319bc1bb80181ae699f919f13d787c65b006ed03c2624014923a0a9b549389

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\Gl46TpULdKzqTEeaDuM.bat

Filesize
89B

MD5
98323978cd8426bb4eaf02610b43a8b7

SHA1
60106862147c23f62a8b3c315e99614a55a83e86

SHA256
16f70a27fc2b9b69519984169dec646adc2c1ae59af5bc34c62a783bbd71657f

SHA512
a0db58f068bb80372392a4a436ff260a9729f08eed7ceef01ecdce68ebbdedb481edccd358169983542a64962c602941c41f590a52663141de2cc2b2793b326a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\b5G22TwI5sSnSJKL7urg5tCF8EHPXDbL9yEMgA9LaYyHnpFyHeN8L6Oob76V.vbe

Filesize
220B

MD5
418d6c2804f2e772fd6dca301bf12a34

SHA1
abfe7b99d95635c533a3d04f03ab28ab37dbdc6f

SHA256
6dc0862dcb39c860680a7baa09be804992f68986a5f8450f1f6b0459995cf309

SHA512
1c519fa0b9093a11c71228df5310ba580b26d3211ea1f8a4def1db50c8a42e9d1c4c8e73b98f7f5076e1c4744b18abf134c23adb744392aaf135f73395e61923

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe

Filesize
1.9MB

MD5
0a65c7fe9428f97bb5efd56cc1e19617

SHA1
b88d9cca07a6aa4f47a8c705329a0b2a7a1c9be6

SHA256
1135cc4a0a57bae21afd676287902da8dc40073717570864ce05f6e590ef266d

SHA512
224a9112b9f28f517becdfe7e206693c162f486c297b2ca1fd4f41662143576cacd6f1d9a441e4c4665a4543f9595bf7d40d463a7d04f72df897d705d4c4209f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0cp4bndp\0cp4bndp.0.cs

Filesize
396B

MD5
60429604c68a98f6bffaed43f1783327

SHA1
0f95a0dec0251a50686fe7222a8382d9ab713196

SHA256
85d97b4ff2c807efdbbdb20bc0c44d3c1a4f55be668669b5b4a2a197a385fc5f

SHA512
3ec62a54eba9932edaad7dfddd0c8524102f3d6f4f5a0540a89989e0e24a82117428884e45721e31509adda3ca156a54aa9d2bc3ebba50808da9e66388679089

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0cp4bndp\0cp4bndp.cmdline

Filesize
235B

MD5
5e7809c9667febf7560b8e3c717964db

SHA1
94427444d7110920260925114acd9bb8f6fb8a60

SHA256
62bf987e26b5ef5a2390826c7d8ea12fd2e58172409daa8162bc9f7b915d5b74

SHA512
3df3239e224a72eb2c9f07a176b4bff277e485544c34159e5f9b88d4da80c97a957e2ab5cf03a33260f0c277416980b6f63dbf8eb6b4d17114b4e2c8384470e7

Download Submit
\??\c:\Windows\System32\CSCA1BB18AD7B404F9991A21537647B8A4E.TMP

Filesize
1KB

MD5
1c519e4618f2b468d0f490d4a716da11

SHA1
1a693d0046e48fa813e4fa3bb94ccd20d43e3106

SHA256
4dbf16e3b3bb06c98eeaf27d0a25d9f34ee0ceac51e6365218ef7cd09edb3438

SHA512
99f293878a08b56db6ff2297f243f5f5b85864e6925a1d6af61a65369f7eb323ae1b75fe5f1465fac0b982ac9f49b9e0a295b5dac947da40f61991c4411233fd

Download Submit
memory/2008-70-0x000001B25F910000-0x000001B25F932000-memory.dmp

Filesize
136KB

Download
memory/4960-15-0x0000000000DF0000-0x0000000000DFE000-memory.dmp

Filesize
56KB

Download
memory/4960-26-0x0000000002660000-0x000000000266C000-memory.dmp

Filesize
48KB

Download
memory/4960-24-0x0000000002650000-0x000000000265E000-memory.dmp

Filesize
56KB

Download
memory/4960-22-0x00000000025F0000-0x00000000025FE000-memory.dmp

Filesize
56KB

Download
memory/4960-20-0x0000000002690000-0x00000000026A8000-memory.dmp

Filesize
96KB

Download
memory/4960-18-0x000000001B0D0000-0x000000001B120000-memory.dmp

Filesize
320KB

Download
memory/4960-17-0x0000000002670000-0x000000000268C000-memory.dmp

Filesize
112KB

Download
memory/4960-13-0x0000000000330000-0x000000000051E000-memory.dmp

Filesize
1.9MB

Download
memory/4960-12-0x00007FFCD3A63000-0x00007FFCD3A65000-memory.dmp

Filesize
8KB

Download