dcrat | 7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40

Analysis

max time kernel
49s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
Size

2.2MB
MD5

5862163947e4c9c8a582139802752500
SHA1

d1f83488f1609e91e410e4ecce1c8a40a0824f4d
SHA256

7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40
SHA512

07f767bdcad34165b9bdbce92154ee8fc89436471b7eb7c6bb11f34c2dd110e6163ba9781cfe2d228d915a8c56e62e2c19a677601f4d29477cc4dd1ce1c77448
SSDEEP

49152:IBJ/8S2mDpxl4U/IJL4HfAzqLwvugU6fZ9pHhjEHg2Rl+yJmu3qwX:yZ8S2mDpxl4U/IJL4HfAzqLwvugU6f12

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\csrss.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Windows\\Cursors\\taskhost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Windows\\Cursors\\taskhost.exe\", \"C:\\Users\\Default\\Pictures\\lsm.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Windows\\Cursors\\taskhost.exe\", \"C:\\Users\\Default\\Pictures\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\OSPPSVC.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\", \"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\csrss.exe\", \"C:\\Windows\\Cursors\\taskhost.exe\", \"C:\\Users\\Default\\Pictures\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\OSPPSVC.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	668	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2604	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2604	schtasks.exe	34

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1084	powershell.exe
2968	powershell.exe
2308	powershell.exe
980	powershell.exe
2196	powershell.exe
824	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2812	componentdll.exe
2192	componentdll.exe

Loads dropped DLL 2 IoCs

pid	Process
2752	cmd.exe
2752	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\sppsvc.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\csrss.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\Cursors\\taskhost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default\\Pictures\\lsm.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default\\Pictures\\lsm.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\OSPPSVC.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\OSPPSVC.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\componentdll = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\componentdll = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0116-0409-1000-0000000FF1CE}-C\\csrss.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\Cursors\\taskhost.exe\""	componentdll.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCB3A372CF2DD6478EA8E3AC6B462948D.TMP	csc.exe
File created	\??\c:\Windows\System32\dzuhbf.exe	csc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Cursors\taskhost.exe	componentdll.exe
File created	C:\Windows\Cursors\b75386f1303e64	componentdll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3028	schtasks.exe
1732	schtasks.exe
1868	schtasks.exe
1916	schtasks.exe
2236	schtasks.exe
2936	schtasks.exe
2684	schtasks.exe
2428	schtasks.exe
2900	schtasks.exe
2844	schtasks.exe
444	schtasks.exe
1912	schtasks.exe
1432	schtasks.exe
2908	schtasks.exe
1600	schtasks.exe
668	schtasks.exe
2044	schtasks.exe
764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe
2812	componentdll.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	componentdll.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	2192	componentdll.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2116	2692	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe	30
PID 2692 wrote to memory of 2116	2692	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe	30
PID 2692 wrote to memory of 2116	2692	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe	30
PID 2692 wrote to memory of 2116	2692	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe	30
PID 2116 wrote to memory of 2752	2116	WScript.exe	31
PID 2116 wrote to memory of 2752	2116	WScript.exe	31
PID 2116 wrote to memory of 2752	2116	WScript.exe	31
PID 2116 wrote to memory of 2752	2116	WScript.exe	31
PID 2752 wrote to memory of 2812	2752	cmd.exe	33
PID 2752 wrote to memory of 2812	2752	cmd.exe	33
PID 2752 wrote to memory of 2812	2752	cmd.exe	33
PID 2752 wrote to memory of 2812	2752	cmd.exe	33
PID 2812 wrote to memory of 972	2812	componentdll.exe	38
PID 2812 wrote to memory of 972	2812	componentdll.exe	38
PID 2812 wrote to memory of 972	2812	componentdll.exe	38
PID 972 wrote to memory of 1228	972	csc.exe	40
PID 972 wrote to memory of 1228	972	csc.exe	40
PID 972 wrote to memory of 1228	972	csc.exe	40
PID 2812 wrote to memory of 2196	2812	componentdll.exe	56
PID 2812 wrote to memory of 2196	2812	componentdll.exe	56
PID 2812 wrote to memory of 2196	2812	componentdll.exe	56
PID 2812 wrote to memory of 824	2812	componentdll.exe	57
PID 2812 wrote to memory of 824	2812	componentdll.exe	57
PID 2812 wrote to memory of 824	2812	componentdll.exe	57
PID 2812 wrote to memory of 1084	2812	componentdll.exe	58
PID 2812 wrote to memory of 1084	2812	componentdll.exe	58
PID 2812 wrote to memory of 1084	2812	componentdll.exe	58
PID 2812 wrote to memory of 980	2812	componentdll.exe	59
PID 2812 wrote to memory of 980	2812	componentdll.exe	59
PID 2812 wrote to memory of 980	2812	componentdll.exe	59
PID 2812 wrote to memory of 2308	2812	componentdll.exe	60
PID 2812 wrote to memory of 2308	2812	componentdll.exe	60
PID 2812 wrote to memory of 2308	2812	componentdll.exe	60
PID 2812 wrote to memory of 2968	2812	componentdll.exe	62
PID 2812 wrote to memory of 2968	2812	componentdll.exe	62
PID 2812 wrote to memory of 2968	2812	componentdll.exe	62
PID 2812 wrote to memory of 1348	2812	componentdll.exe	68
PID 2812 wrote to memory of 1348	2812	componentdll.exe	68
PID 2812 wrote to memory of 1348	2812	componentdll.exe	68
PID 1348 wrote to memory of 2364	1348	cmd.exe	70
PID 1348 wrote to memory of 2364	1348	cmd.exe	70
PID 1348 wrote to memory of 2364	1348	cmd.exe	70
PID 1348 wrote to memory of 1416	1348	cmd.exe	71
PID 1348 wrote to memory of 1416	1348	cmd.exe	71
PID 1348 wrote to memory of 1416	1348	cmd.exe	71
PID 1348 wrote to memory of 2192	1348	cmd.exe	73
PID 1348 wrote to memory of 2192	1348	cmd.exe	73
PID 1348 wrote to memory of 2192	1348	cmd.exe	73

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
"C:\Users\Admin\AppData\Local\Temp\7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\b5G22TwI5sSnSJKL7urg5tCF8EHPXDbL9yEMgA9LaYyHnpFyHeN8L6Oob76V.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\Gl46TpULdKzqTEeaDuM.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe
      "C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc/componentdll.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n5ycqeia\n5ycqeia.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:972
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCCA.tmp" "c:\Windows\System32\CSCB3A372CF2DD6478EA8E3AC6B462948D.TMP"
        6⤵
        
        PID:1228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\taskhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Pictures\lsm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\OSPPSVC.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4rJuHHN30F.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1348
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2364
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Windows\Cursors\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Cursors\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Windows\Cursors\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Pictures\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default\Pictures\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Pictures\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdllc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdll" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdllc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4rJuHHN30F.bat

Filesize
246B

MD5
1a7592a6c146841e74e211ecf928326e

SHA1
5acceae93a994641af57c9fbabc8ad812530a1e1

SHA256
e6c98a370da72800e52136c33d7901ff60b4a4b1134679a91e99964887ac32fc

SHA512
005fe21fe653f80d2996e866d250e3e1bf00818e53e3cf541598ea7d5432ff71e194b21b46971c531f427473e648df3d481889bec42a8e07978d35e553ea1fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBCCA.tmp

Filesize
1KB

MD5
e33d3de225efb83073d6910f72c741a5

SHA1
1c913b297f0dff3f422576e2e200bbd1bb0ee393

SHA256
c7b3f3c622f7b6155be334d6824f2a8336fa04f7f73c02ae051603ab8240db0a

SHA512
4f6a4cd0c4a89cadeca67ff30ac5687d165448d5ad0d8e66e33dffe9885c12c8303f36453e078002d6feaaf609690174b8fc5f1123b09dc67bdae2439c54bdb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\Gl46TpULdKzqTEeaDuM.bat

Filesize
89B

MD5
98323978cd8426bb4eaf02610b43a8b7

SHA1
60106862147c23f62a8b3c315e99614a55a83e86

SHA256
16f70a27fc2b9b69519984169dec646adc2c1ae59af5bc34c62a783bbd71657f

SHA512
a0db58f068bb80372392a4a436ff260a9729f08eed7ceef01ecdce68ebbdedb481edccd358169983542a64962c602941c41f590a52663141de2cc2b2793b326a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\b5G22TwI5sSnSJKL7urg5tCF8EHPXDbL9yEMgA9LaYyHnpFyHeN8L6Oob76V.vbe

Filesize
220B

MD5
418d6c2804f2e772fd6dca301bf12a34

SHA1
abfe7b99d95635c533a3d04f03ab28ab37dbdc6f

SHA256
6dc0862dcb39c860680a7baa09be804992f68986a5f8450f1f6b0459995cf309

SHA512
1c519fa0b9093a11c71228df5310ba580b26d3211ea1f8a4def1db50c8a42e9d1c4c8e73b98f7f5076e1c4744b18abf134c23adb744392aaf135f73395e61923

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
3a61825f060a66e35716e968cd07452d

SHA1
f936b4be55687fe9a0b0f068b09ac8b11ea3a682

SHA256
14cc7696c053cdb325fc2f78c456b23feabf1750b7fcc13b015a36afd48ea432

SHA512
726661cb504642b587b9cb6bc78c0b0239b59ae6a8cd987566c20cfb572f65f96afadd60d6a502c0097203da32e9c5da37aac6e15935bf52c51d3abc106d5cdf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n5ycqeia\n5ycqeia.0.cs

Filesize
405B

MD5
ebebb221dffba200c6273db4834a9c1e

SHA1
f26e59692ac50c891033a704731d062ffcaea1bd

SHA256
5f5c9c1c2d5632daada65c79404577eeadbed508547b4f7498a5c699cc6f456a

SHA512
62b0e15b4355dec3cbfeb42e66a1e9af751d30917e3c1363df654d9e57497be9d9ad6c593b4ce2a62ffb47c0610a5488c4f9aedd2911a202610a2c55dd9cbf0f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\n5ycqeia\n5ycqeia.cmdline

Filesize
235B

MD5
14f7699349e6d24e1563a58942ab43e9

SHA1
42df579d1e66a99e88ddf0b668db8bae50ca0d62

SHA256
04a71feea561cccde7087d6b7c26620fe710a77c7e2c98bf531bf329b838a998

SHA512
3d990b7ec13272826d05f1309520f3740129c143d281ea31c2b0edec4f077f0dea58a1d1e93e1a9bbd1ebe98f74c9be431507d50319044126474528f643d7e65

Download Submit
\??\c:\Windows\System32\CSCB3A372CF2DD6478EA8E3AC6B462948D.TMP

Filesize
1KB

MD5
9446a6998523ec187daa3d79bec9c8fa

SHA1
16c7f73aef03c8a15b4d9e8b1cfa5183caf7ca96

SHA256
f55f1bd2c1246cfb3b60cd8649fcc78b3837896bdf5132d6fc8ea0ecabf892d7

SHA512
fac3ad1b0c8663aaa94cd66b6ea0aa1848e570ff4a22b709cf2696abb76e28f42fb0d2a74316a7ad86bb6216177013c6b71ce2f4df139edc3054a03ee3467c9d

Download Submit
\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe

Filesize
1.9MB

MD5
0a65c7fe9428f97bb5efd56cc1e19617

SHA1
b88d9cca07a6aa4f47a8c705329a0b2a7a1c9be6

SHA256
1135cc4a0a57bae21afd676287902da8dc40073717570864ce05f6e590ef266d

SHA512
224a9112b9f28f517becdfe7e206693c162f486c297b2ca1fd4f41662143576cacd6f1d9a441e4c4665a4543f9595bf7d40d463a7d04f72df897d705d4c4209f

Download Submit
memory/824-76-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2192-84-0x0000000000A20000-0x0000000000C0E000-memory.dmp

Filesize
1.9MB

Download
memory/2308-75-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2812-15-0x0000000000600000-0x000000000060E000-memory.dmp

Filesize
56KB

Download
memory/2812-25-0x0000000000780000-0x000000000078C000-memory.dmp

Filesize
48KB

Download
memory/2812-23-0x0000000000730000-0x000000000073E000-memory.dmp

Filesize
56KB

Download
memory/2812-21-0x0000000000720000-0x000000000072E000-memory.dmp

Filesize
56KB

Download
memory/2812-19-0x0000000000760000-0x0000000000778000-memory.dmp

Filesize
96KB

Download
memory/2812-17-0x0000000000740000-0x000000000075C000-memory.dmp

Filesize
112KB

Download
memory/2812-13-0x0000000000130000-0x000000000031E000-memory.dmp

Filesize
1.9MB

Download