dcrat | c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
Size

1.7MB
MD5

9b3e774fdf342e63dc855ce00ba70555
SHA1

2243b3e4cf15d76c33d7b791367002ddb929386d
SHA256

c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045
SHA512

d50374c8bae3c8c9d7e5abd3ca8494f0e458c9b99c444061291ea6efbc70e607d6036a647e25426da042243350cd36c49e68a2660b4b961310e26b40c00846f2
SSDEEP

24576:t3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:tgwuuEpdDLNwVMeXDL0fdSzAG

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	4984	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4984	schtasks.exe	83

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4400-1-0x0000000000250000-0x0000000000406000-memory.dmp	dcrat
behavioral2/files/0x000a000000023b7f-29.dat	dcrat
behavioral2/files/0x000c000000023b88-46.dat	dcrat
behavioral2/files/0x000e000000023b6f-69.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4364	powershell.exe
372	powershell.exe
3044	powershell.exe
4524	powershell.exe
1496	powershell.exe
3588	powershell.exe
2820	powershell.exe
5080	powershell.exe
4552	powershell.exe
4148	powershell.exe
2436	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	services.exe

Executes dropped EXE 2 IoCs

pid	Process
1420	services.exe
3816	services.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\services.exe	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
File created	C:\Program Files\Windows Security\c5b4cb5e9653cc	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
File opened for modification	C:\Program Files\Windows Security\RCX9007.tmp	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
File opened for modification	C:\Program Files\Windows Security\RCX9008.tmp	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
File opened for modification	C:\Program Files\Windows Security\services.exe	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	services.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1676	schtasks.exe
3064	schtasks.exe
2272	schtasks.exe
4800	schtasks.exe
2660	schtasks.exe
1672	schtasks.exe
1920	schtasks.exe
4260	schtasks.exe
1784	schtasks.exe
4360	schtasks.exe
4564	schtasks.exe
1308	schtasks.exe
4180	schtasks.exe
1096	schtasks.exe
3484	schtasks.exe
2324	schtasks.exe
2584	schtasks.exe
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
2436	powershell.exe
2436	powershell.exe
4148	powershell.exe
4148	powershell.exe
1496	powershell.exe
1496	powershell.exe
4552	powershell.exe
4552	powershell.exe
3044	powershell.exe
3044	powershell.exe
3588	powershell.exe
3588	powershell.exe
4364	powershell.exe
4364	powershell.exe
372	powershell.exe
372	powershell.exe
4524	powershell.exe
4524	powershell.exe
5080	powershell.exe
5080	powershell.exe
2820	powershell.exe
2820	powershell.exe
4148	powershell.exe
2436	powershell.exe
3588	powershell.exe
4364	powershell.exe
1496	powershell.exe
4552	powershell.exe
3044	powershell.exe
4524	powershell.exe
372	powershell.exe
5080	powershell.exe
2820	powershell.exe
1420	services.exe
1420	services.exe
1420	services.exe
1420	services.exe
1420	services.exe
1420	services.exe
1420	services.exe
1420	services.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	1420	services.exe
Token: SeDebugPrivilege	3816	services.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 3588	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	102
PID 4400 wrote to memory of 3588	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	102
PID 4400 wrote to memory of 2436	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	103
PID 4400 wrote to memory of 2436	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	103
PID 4400 wrote to memory of 1496	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	104
PID 4400 wrote to memory of 1496	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	104
PID 4400 wrote to memory of 4148	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	105
PID 4400 wrote to memory of 4148	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	105
PID 4400 wrote to memory of 4552	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	106
PID 4400 wrote to memory of 4552	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	106
PID 4400 wrote to memory of 4524	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	107
PID 4400 wrote to memory of 4524	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	107
PID 4400 wrote to memory of 5080	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	108
PID 4400 wrote to memory of 5080	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	108
PID 4400 wrote to memory of 3044	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	109
PID 4400 wrote to memory of 3044	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	109
PID 4400 wrote to memory of 372	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	110
PID 4400 wrote to memory of 372	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	110
PID 4400 wrote to memory of 4364	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	111
PID 4400 wrote to memory of 4364	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	111
PID 4400 wrote to memory of 2820	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	112
PID 4400 wrote to memory of 2820	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	112
PID 4400 wrote to memory of 4420	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	124
PID 4400 wrote to memory of 4420	4400	c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe	124
PID 4420 wrote to memory of 1836	4420	cmd.exe	126
PID 4420 wrote to memory of 1836	4420	cmd.exe	126
PID 4420 wrote to memory of 1420	4420	cmd.exe	130
PID 4420 wrote to memory of 1420	4420	cmd.exe	130
PID 1420 wrote to memory of 4320	1420	services.exe	134
PID 1420 wrote to memory of 4320	1420	services.exe	134
PID 1420 wrote to memory of 1512	1420	services.exe	135
PID 1420 wrote to memory of 1512	1420	services.exe	135
PID 4320 wrote to memory of 3816	4320	WScript.exe	142
PID 4320 wrote to memory of 3816	4320	WScript.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe
"C:\Users\Admin\AppData\Local\Temp\c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xxDhnLNanq.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1836
- - C:\Program Files\Windows Security\services.exe
    "C:\Program Files\Windows Security\services.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b69b0971-8e24-4c8a-9506-3215be764282.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\Program Files\Windows Security\services.exe
        
        "C:\Program Files\Windows Security\services.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\deeba79f-f7c9-42ed-9b4d-92c89b448811.vbs"
      4⤵
      PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Cookies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Security\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\SearchApp.exe

Filesize
1.7MB

MD5
6c13f6d9c70fbc2a77939c703977e873

SHA1
c5e76f2108e945717c6fe2bf05a9bd11019a147f

SHA256
d1c765ced7b10819da5f5c8db3f0c64c937690d114c717c54d71764c4e848dea

SHA512
75a72461c32c52951cf8b704838cdac0faa6cd1b369c409e553a51d19e0ace22f8df066dd4bcee86feac33263f8f4d8ec16ffab8e95bc6afc9d3400367eb5db9

Download Submit
C:\Recovery\WindowsRE\winlogon.exe

Filesize
1.7MB

MD5
9b3e774fdf342e63dc855ce00ba70555

SHA1
2243b3e4cf15d76c33d7b791367002ddb929386d

SHA256
c1d8febd8745bf2f6a446abc920b1c67f76b8f2980e65f4dca8512c70a0d6045

SHA512
d50374c8bae3c8c9d7e5abd3ca8494f0e458c9b99c444061291ea6efbc70e607d6036a647e25426da042243350cd36c49e68a2660b4b961310e26b40c00846f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services.exe.log

Filesize
1KB

MD5
3ad9a5252966a3ab5b1b3222424717be

SHA1
5397522c86c74ddbfb2585b9613c794f4b4c3410

SHA256
27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

SHA512
b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nleg1uzu.ukj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b69b0971-8e24-4c8a-9506-3215be764282.vbs

Filesize
722B

MD5
dd778f370c90955425b7709ff4b3f792

SHA1
1fb3c17cc014307b19dbbd7e8aaeb61fd171a84a

SHA256
a5a76f2cee9885ee251d2ec09076b45175ddabf3f9f2cf29d15db40890ee5cdd

SHA512
cf2c7bfad0f13959eef327e01203bee09dcfd4513f74507f7ed30690e2a754e2111c8a483ad3c041a8fedc235c7f51ca256d06ab842a0e121445951f8630d71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\deeba79f-f7c9-42ed-9b4d-92c89b448811.vbs

Filesize
498B

MD5
9360f6e95d2f336c1e1272d04314a566

SHA1
9e2d6182d43b76e9439b743ab354ca997adc0b45

SHA256
b308bdb4b0ad7b4f3ea2621b9793338adeebb0071724f5bc7d22c012917e3b1e

SHA512
659dfb1f7f553929c081891e602ef34cda06a152eb12a9a472535ce3320a8e530c13da0f15c7d452e99bdd30500430fffbf7b3c55f48dc14209ba80568c7ed11

Download Submit
C:\Users\Admin\AppData\Local\Temp\xxDhnLNanq.bat

Filesize
211B

MD5
a58575d2cce53cd9e86c042d73c2c147

SHA1
d2d1eb52a9457c064917474d031453a9ec93604e

SHA256
5becd6c9363b872a83bb2fec27042841322889adb76702b562b3200c61996a29

SHA512
71673f13d7114274061a703b4f0d24b191407c0d174689fcf840ab7709b3fd9a888ff7e0b10b5c95e3b69c2a7bf132e572f8a0d346968d2dddbd5e6e9f85be0f

Download Submit
C:\Users\Public\csrss.exe

Filesize
1.7MB

MD5
bdab66e8de80396db3cefe1b53025a67

SHA1
a26a97604b9bc83a887256288bdea65ac014d6e0

SHA256
1e2a9214173ab0e2c316cdf66f1554f43f46761a681b9c67f6e09e54d726f982

SHA512
f23de8def182b06404bfe69be76754b77c73ab6b0e45c2ac10f4c487c8df576958bc45a67fdf14a5b8d6f88a5f489a17336703d558bc638f05921404c8397a21

Download Submit
memory/1420-242-0x000000001D1B0000-0x000000001D1C2000-memory.dmp

Filesize
72KB

Download
memory/4400-9-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Filesize
64KB

Download
memory/4400-11-0x000000001B6A0000-0x000000001B6A8000-memory.dmp

Filesize
32KB

Download
memory/4400-16-0x000000001BA80000-0x000000001BA88000-memory.dmp

Filesize
32KB

Download
memory/4400-21-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4400-22-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4400-18-0x000000001BAA0000-0x000000001BAAC000-memory.dmp

Filesize
48KB

Download
memory/4400-15-0x000000001BA70000-0x000000001BA7A000-memory.dmp

Filesize
40KB

Download
memory/4400-14-0x000000001BA20000-0x000000001BA2C000-memory.dmp

Filesize
48KB

Download
memory/4400-13-0x000000001B810000-0x000000001B81C000-memory.dmp

Filesize
48KB

Download
memory/4400-1-0x0000000000250000-0x0000000000406000-memory.dmp

Filesize
1.7MB

Download
memory/4400-167-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4400-17-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Filesize
48KB

Download
memory/4400-10-0x000000001B690000-0x000000001B69C000-memory.dmp

Filesize
48KB

Download
memory/4400-0-0x00007FFEC95C3000-0x00007FFEC95C5000-memory.dmp

Filesize
8KB

Download
memory/4400-4-0x000000001B6C0000-0x000000001B710000-memory.dmp

Filesize
320KB

Download
memory/4400-6-0x0000000002620000-0x0000000002630000-memory.dmp

Filesize
64KB

Download
memory/4400-7-0x000000001B670000-0x000000001B686000-memory.dmp

Filesize
88KB

Download
memory/4400-8-0x0000000002630000-0x0000000002642000-memory.dmp

Filesize
72KB

Download
memory/4400-5-0x0000000002600000-0x0000000002608000-memory.dmp

Filesize
32KB

Download
memory/4400-3-0x0000000000BE0000-0x0000000000BFC000-memory.dmp

Filesize
112KB

Download
memory/4400-2-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/4552-126-0x00000227C8030000-0x00000227C8052000-memory.dmp

Filesize
136KB

Download