dcrat | 7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40

Analysis

max time kernel
93s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
Size

2.2MB
MD5

5862163947e4c9c8a582139802752500
SHA1

d1f83488f1609e91e410e4ecce1c8a40a0824f4d
SHA256

7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40
SHA512

07f767bdcad34165b9bdbce92154ee8fc89436471b7eb7c6bb11f34c2dd110e6163ba9781cfe2d228d915a8c56e62e2c19a677601f4d29477cc4dd1ce1c77448
SSDEEP

49152:IBJ/8S2mDpxl4U/IJL4HfAzqLwvugU6fZ9pHhjEHg2Rl+yJmu3qwX:yZ8S2mDpxl4U/IJL4HfAzqLwvugU6f12

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\Tasks\\explorer.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\Tasks\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\Tasks\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Windows\\Tasks\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Public\\fontdrvhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	componentdll.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1012	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3764	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	1068	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	1068	schtasks.exe	86

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe
3596	powershell.exe
3092	powershell.exe
804	powershell.exe
3592	powershell.exe
824	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	componentdll.exe

Executes dropped EXE 2 IoCs

pid	Process
3028	componentdll.exe
4956	explorer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Public\\fontdrvhost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\componentdll = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\TextInputHost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Tasks\\explorer.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\Tasks\\explorer.exe\""	componentdll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Public\\fontdrvhost.exe\""	componentdll.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\componentdll = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msserverfontHostsvc\\componentdll.exe\""	componentdll.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC256DD421A0BB43D6A8D17B7A9F70C3D1.TMP	csc.exe
File created	\??\c:\Windows\System32\lhkpi-.exe	csc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\7a0fd90576e088	componentdll.exe
File created	C:\Windows\ServiceProfiles\NetworkService\TextInputHost.exe	componentdll.exe
File created	C:\Windows\ServiceProfiles\NetworkService\22eafd247d37c3	componentdll.exe
File created	C:\Windows\Tasks\explorer.exe	componentdll.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1284	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	componentdll.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1284	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1012	schtasks.exe
4168	schtasks.exe
1460	schtasks.exe
2544	schtasks.exe
4676	schtasks.exe
3440	schtasks.exe
5072	schtasks.exe
2228	schtasks.exe
4504	schtasks.exe
376	schtasks.exe
4656	schtasks.exe
392	schtasks.exe
432	schtasks.exe
4712	schtasks.exe
3764	schtasks.exe
4584	schtasks.exe
2664	schtasks.exe
1032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe
3028	componentdll.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	componentdll.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe
Token: SeDebugPrivilege	4956	explorer.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3084	2108	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe	82
PID 2108 wrote to memory of 3084	2108	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe	82
PID 2108 wrote to memory of 3084	2108	7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe	82
PID 3084 wrote to memory of 4060	3084	WScript.exe	87
PID 3084 wrote to memory of 4060	3084	WScript.exe	87
PID 3084 wrote to memory of 4060	3084	WScript.exe	87
PID 4060 wrote to memory of 3028	4060	cmd.exe	89
PID 4060 wrote to memory of 3028	4060	cmd.exe	89
PID 3028 wrote to memory of 4872	3028	componentdll.exe	93
PID 3028 wrote to memory of 4872	3028	componentdll.exe	93
PID 4872 wrote to memory of 1612	4872	csc.exe	95
PID 4872 wrote to memory of 1612	4872	csc.exe	95
PID 3028 wrote to memory of 3592	3028	componentdll.exe	111
PID 3028 wrote to memory of 3592	3028	componentdll.exe	111
PID 3028 wrote to memory of 824	3028	componentdll.exe	112
PID 3028 wrote to memory of 824	3028	componentdll.exe	112
PID 3028 wrote to memory of 804	3028	componentdll.exe	113
PID 3028 wrote to memory of 804	3028	componentdll.exe	113
PID 3028 wrote to memory of 3092	3028	componentdll.exe	114
PID 3028 wrote to memory of 3092	3028	componentdll.exe	114
PID 3028 wrote to memory of 3596	3028	componentdll.exe	115
PID 3028 wrote to memory of 3596	3028	componentdll.exe	115
PID 3028 wrote to memory of 3536	3028	componentdll.exe	116
PID 3028 wrote to memory of 3536	3028	componentdll.exe	116
PID 3028 wrote to memory of 3556	3028	componentdll.exe	123
PID 3028 wrote to memory of 3556	3028	componentdll.exe	123
PID 3556 wrote to memory of 1816	3556	cmd.exe	125
PID 3556 wrote to memory of 1816	3556	cmd.exe	125
PID 3556 wrote to memory of 1284	3556	cmd.exe	127
PID 3556 wrote to memory of 1284	3556	cmd.exe	127
PID 3556 wrote to memory of 4956	3556	cmd.exe	130
PID 3556 wrote to memory of 4956	3556	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe
"C:\Users\Admin\AppData\Local\Temp\7fdcec09216465295e52ef182d3d999dbb943b9ca64301171ae6f8fc153d7b40N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\b5G22TwI5sSnSJKL7urg5tCF8EHPXDbL9yEMgA9LaYyHnpFyHeN8L6Oob76V.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\Gl46TpULdKzqTEeaDuM.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe
      "C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc/componentdll.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ecusgwwk\ecusgwwk.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4872
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AF8.tmp" "c:\Windows\System32\CSC256DD421A0BB43D6A8D17B7A9F70C3D1.TMP"
        6⤵
        
        PID:1612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3092
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3536
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NS2Q2QdDJD.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3556
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1816
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1284
      - C:\Windows\Tasks\explorer.exe
        
        "C:\Windows\Tasks\explorer.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\NetworkService\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\ServiceProfiles\NetworkService\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\Tasks\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Public\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdllc" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdll" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "componentdllc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
119B

MD5
65b00f95261544847526f2f3b2a69fa7

SHA1
858d0e311b0b7654dbfa230b4bbe4b069534423f

SHA256
5e09ce7dfdcd9d8dbc1c011b967218dfa53930b286d1d4125fef59b7380649cc

SHA512
1385d27fb53b839ec30bdbfc197b974921166d0de86a9c33b8b41aa5e1a3b88540e7d2c6db2324d3d98f94ce651a51587b713f0abef033007509ad1d5d8e5d64

Download Submit
C:\Users\Admin\AppData\Local\Temp\NS2Q2QdDJD.bat

Filesize
157B

MD5
70f9de83db677d56cc73e0824177acee

SHA1
d9c863a3c0becc62cc7f0a17c23ffaeb7aadba45

SHA256
550c3e14f4ff63a08e2ef5deca588a8767aaa7de37adc1c8fd3d7ca5bfcc7337

SHA512
bf9b16863d5774a5312483ab9c32aa1a045179565d55ce9fa32513f55500883922a80ecb7140da14ef8623f6b22bd441cede411fdd2870367d505cbc7bf4cef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9AF8.tmp

Filesize
1KB

MD5
11ecd4a193d5700be1f9e45d84f57bb3

SHA1
dac1394526a57454d80f122787e065c80220e39a

SHA256
3ce806ca4983ba3f940e14c238d175b3c14462dd85beb6a7bf4d1a526e054079

SHA512
ca9157a1ea6a832f1d5d43bef36b681f4dd5e68df17df374cf92a652539394eaf560c93c88b6d0697296e1c7e71e5c1d039601204ae9d8dd0a4d9d7e9ff5e04a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ck2jaykg.ufj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\Gl46TpULdKzqTEeaDuM.bat

Filesize
89B

MD5
98323978cd8426bb4eaf02610b43a8b7

SHA1
60106862147c23f62a8b3c315e99614a55a83e86

SHA256
16f70a27fc2b9b69519984169dec646adc2c1ae59af5bc34c62a783bbd71657f

SHA512
a0db58f068bb80372392a4a436ff260a9729f08eed7ceef01ecdce68ebbdedb481edccd358169983542a64962c602941c41f590a52663141de2cc2b2793b326a

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\b5G22TwI5sSnSJKL7urg5tCF8EHPXDbL9yEMgA9LaYyHnpFyHeN8L6Oob76V.vbe

Filesize
220B

MD5
418d6c2804f2e772fd6dca301bf12a34

SHA1
abfe7b99d95635c533a3d04f03ab28ab37dbdc6f

SHA256
6dc0862dcb39c860680a7baa09be804992f68986a5f8450f1f6b0459995cf309

SHA512
1c519fa0b9093a11c71228df5310ba580b26d3211ea1f8a4def1db50c8a42e9d1c4c8e73b98f7f5076e1c4744b18abf134c23adb744392aaf135f73395e61923

Download Submit
C:\Users\Admin\AppData\Local\Temp\msserverfontHostsvc\componentdll.exe

Filesize
1.9MB

MD5
0a65c7fe9428f97bb5efd56cc1e19617

SHA1
b88d9cca07a6aa4f47a8c705329a0b2a7a1c9be6

SHA256
1135cc4a0a57bae21afd676287902da8dc40073717570864ce05f6e590ef266d

SHA512
224a9112b9f28f517becdfe7e206693c162f486c297b2ca1fd4f41662143576cacd6f1d9a441e4c4665a4543f9595bf7d40d463a7d04f72df897d705d4c4209f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ecusgwwk\ecusgwwk.0.cs

Filesize
391B

MD5
e3503643d1aa00df5a6b63b1a775df99

SHA1
ba12554ef5176203ef78a187cf77ca21969918fd

SHA256
b66364b73922ef8393202aa5b7815e35c59e1ce2ddbda4c56e5e4b711be9dee1

SHA512
6f40998dd7ec66994eb3a93f3feb047dd12f3adfc8c0dbd7d350c07a986333f52d0996f682fdd3b990ef11608dd61a12fa80dda970336b4e4df4b0d20dce6823

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ecusgwwk\ecusgwwk.cmdline

Filesize
235B

MD5
10ee45c81f15a2145bf1548a4c9d7bcc

SHA1
f7cf0e350b492cd37846ff155ddc3130e3f18c61

SHA256
3fcf8194aa61a0c0b018339963ea85d880d48d7df44ee3ed9a81326dd81eebdf

SHA512
e78748fec4ac3f6fdfb85e44e3a2d209c76660b728ae234b54e19b384776fc4c8294f9fef66554853c09c3a8d1a71fcf995dc60da1e83b657fa3c61fa4eb0dfe

Download Submit
\??\c:\Windows\System32\CSC256DD421A0BB43D6A8D17B7A9F70C3D1.TMP

Filesize
1KB

MD5
75e32610d8ef6143201c7c28465fcda9

SHA1
b2bae99fade2dda07aecbe1659d184be0fc4e7a6

SHA256
97ee1cac3965d9cc55a60f20206f384719431f19ac96bdc52b93a98de51a639b

SHA512
b303fb99586efd19a08223ba93472fa6d33fcf9198bbf42fb16ba61001db59e5fd5835ea7696ed34e4004d23fa60697e724e6085d1269d788204bf95dfe46abc

Download Submit
memory/3028-26-0x0000000002E70000-0x0000000002E7C000-memory.dmp

Filesize
48KB

Download
memory/3028-24-0x0000000001450000-0x000000000145E000-memory.dmp

Filesize
56KB

Download
memory/3028-22-0x0000000001440000-0x000000000144E000-memory.dmp

Filesize
56KB

Download
memory/3028-20-0x0000000002E50000-0x0000000002E68000-memory.dmp

Filesize
96KB

Download
memory/3028-18-0x000000001B6D0000-0x000000001B720000-memory.dmp

Filesize
320KB

Download
memory/3028-17-0x0000000002E30000-0x0000000002E4C000-memory.dmp

Filesize
112KB

Download
memory/3028-15-0x00000000010A0000-0x00000000010AE000-memory.dmp

Filesize
56KB

Download
memory/3028-13-0x0000000000900000-0x0000000000AEE000-memory.dmp

Filesize
1.9MB

Download
memory/3028-12-0x00007FF916063000-0x00007FF916065000-memory.dmp

Filesize
8KB

Download
memory/3536-71-0x000002122B130000-0x000002122B152000-memory.dmp

Filesize
136KB

Download