dcrat | fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4.exe
Size

2.0MB
MD5

ff6e26dc9893c97196aefe245defeff9
SHA1

6ec3649790e948299b43bc522ee6d3fc9d10f769
SHA256

fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4
SHA512

6c4f76b35b0a90ca8e132d20a3b9d0eaf4752c6c49efe9a6f180b3b7a2091af55f8cab0be881e499a90da496ccbce7550eba4d8a3bc124060b429d44fb08e0a0
SSDEEP

49152:1Djlabwz9WV429A3twp/pZ5zUg45hGUrf/osAX4RUhpKT/+qYiv:Zqw+T9ewpRzz6OUkR4R7TmqYK

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\swidtag\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\swidtag\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\fontdrvhost.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\swidtag\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\fontdrvhost.exe\", \"C:\\Users\\Public\\Documents\\winlogon.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\swidtag\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\fontdrvhost.exe\", \"C:\\Users\\Public\\Documents\\winlogon.exe\", \"C:\\blockPortServerdriverRuntime.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\swidtag\\csrss.exe\""	blockPortServerdriverRuntime.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	216	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	216	schtasks.exe	87

Checks computer location settings 2 TTPs 20 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	blockPortServerdriverRuntime.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	blockPortServerdriverRuntime.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 19 IoCs

pid	Process
3668	blockPortServerdriverRuntime.sfx.exe
4980	blockPortServerdriverRuntime.exe
2452	fontdrvhost.exe
3668	fontdrvhost.exe
916	fontdrvhost.exe
4164	fontdrvhost.exe
4388	fontdrvhost.exe
3168	fontdrvhost.exe
5000	fontdrvhost.exe
4872	fontdrvhost.exe
4960	fontdrvhost.exe
808	fontdrvhost.exe
1512	fontdrvhost.exe
5088	fontdrvhost.exe
1708	fontdrvhost.exe
2372	fontdrvhost.exe
3208	fontdrvhost.exe
740	fontdrvhost.exe
3992	fontdrvhost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\fontdrvhost.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Documents\\winlogon.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockPortServerdriverRuntime = "\"C:\\blockPortServerdriverRuntime.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Esl\\fontdrvhost.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Documents\\winlogon.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockPortServerdriverRuntime = "\"C:\\blockPortServerdriverRuntime.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\PackageManifests\\RuntimeBroker.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\dotnet\\swidtag\\csrss.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\dotnet\\swidtag\\csrss.exe\""	blockPortServerdriverRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	blockPortServerdriverRuntime.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC6B40C998AA314DEAA1718E26B1DDFE1.TMP	csc.exe
File created	\??\c:\Windows\System32\s_kgxh.exe	csc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\swidtag\886983d96e3d3e	blockPortServerdriverRuntime.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe	blockPortServerdriverRuntime.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\9e8d7a4ca61bd9	blockPortServerdriverRuntime.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe	blockPortServerdriverRuntime.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\5b884080fd4f94	blockPortServerdriverRuntime.exe
File created	C:\Program Files\dotnet\swidtag\csrss.exe	blockPortServerdriverRuntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5080	PING.EXE
5036	PING.EXE
4196	PING.EXE
4672	PING.EXE
1076	PING.EXE
5072	PING.EXE
3528	PING.EXE
1496	PING.EXE
912	PING.EXE
3720	PING.EXE

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	blockPortServerdriverRuntime.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	fontdrvhost.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
912	PING.EXE
1076	PING.EXE
5072	PING.EXE
5080	PING.EXE
5036	PING.EXE
4672	PING.EXE
3720	PING.EXE
3528	PING.EXE
1496	PING.EXE
4196	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2956	schtasks.exe
3628	schtasks.exe
4220	schtasks.exe
2844	schtasks.exe
2516	schtasks.exe
1464	schtasks.exe
372	schtasks.exe
1176	schtasks.exe
836	schtasks.exe
2568	schtasks.exe
320	schtasks.exe
2144	schtasks.exe
2784	schtasks.exe
1660	schtasks.exe
4768	schtasks.exe
4804	schtasks.exe
2792	schtasks.exe
2864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe
4980	blockPortServerdriverRuntime.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	blockPortServerdriverRuntime.exe
Token: SeDebugPrivilege	2452	fontdrvhost.exe
Token: SeDebugPrivilege	3668	fontdrvhost.exe
Token: SeDebugPrivilege	916	fontdrvhost.exe
Token: SeDebugPrivilege	4164	fontdrvhost.exe
Token: SeDebugPrivilege	4388	fontdrvhost.exe
Token: SeDebugPrivilege	3168	fontdrvhost.exe
Token: SeDebugPrivilege	5000	fontdrvhost.exe
Token: SeDebugPrivilege	4872	fontdrvhost.exe
Token: SeDebugPrivilege	4960	fontdrvhost.exe
Token: SeDebugPrivilege	808	fontdrvhost.exe
Token: SeDebugPrivilege	1512	fontdrvhost.exe
Token: SeDebugPrivilege	5088	fontdrvhost.exe
Token: SeDebugPrivilege	1708	fontdrvhost.exe
Token: SeDebugPrivilege	2372	fontdrvhost.exe
Token: SeDebugPrivilege	3208	fontdrvhost.exe
Token: SeDebugPrivilege	740	fontdrvhost.exe
Token: SeDebugPrivilege	3992	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 4128	4784	fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4.exe	82
PID 4784 wrote to memory of 4128	4784	fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4.exe	82
PID 4128 wrote to memory of 3668	4128	cmd.exe	85
PID 4128 wrote to memory of 3668	4128	cmd.exe	85
PID 3668 wrote to memory of 4980	3668	blockPortServerdriverRuntime.sfx.exe	86
PID 3668 wrote to memory of 4980	3668	blockPortServerdriverRuntime.sfx.exe	86
PID 4980 wrote to memory of 1980	4980	blockPortServerdriverRuntime.exe	91
PID 4980 wrote to memory of 1980	4980	blockPortServerdriverRuntime.exe	91
PID 1980 wrote to memory of 2424	1980	csc.exe	93
PID 1980 wrote to memory of 2424	1980	csc.exe	93
PID 4980 wrote to memory of 2564	4980	blockPortServerdriverRuntime.exe	109
PID 4980 wrote to memory of 2564	4980	blockPortServerdriverRuntime.exe	109
PID 2564 wrote to memory of 2388	2564	cmd.exe	111
PID 2564 wrote to memory of 2388	2564	cmd.exe	111
PID 2564 wrote to memory of 5080	2564	cmd.exe	112
PID 2564 wrote to memory of 5080	2564	cmd.exe	112
PID 2564 wrote to memory of 2452	2564	cmd.exe	117
PID 2564 wrote to memory of 2452	2564	cmd.exe	117
PID 2452 wrote to memory of 4484	2452	fontdrvhost.exe	120
PID 2452 wrote to memory of 4484	2452	fontdrvhost.exe	120
PID 4484 wrote to memory of 4852	4484	cmd.exe	122
PID 4484 wrote to memory of 4852	4484	cmd.exe	122
PID 4484 wrote to memory of 4844	4484	cmd.exe	123
PID 4484 wrote to memory of 4844	4484	cmd.exe	123
PID 4484 wrote to memory of 3668	4484	cmd.exe	124
PID 4484 wrote to memory of 3668	4484	cmd.exe	124
PID 3668 wrote to memory of 1484	3668	fontdrvhost.exe	125
PID 3668 wrote to memory of 1484	3668	fontdrvhost.exe	125
PID 1484 wrote to memory of 3032	1484	cmd.exe	127
PID 1484 wrote to memory of 3032	1484	cmd.exe	127
PID 1484 wrote to memory of 3528	1484	cmd.exe	128
PID 1484 wrote to memory of 3528	1484	cmd.exe	128
PID 1484 wrote to memory of 916	1484	cmd.exe	129
PID 1484 wrote to memory of 916	1484	cmd.exe	129
PID 916 wrote to memory of 1488	916	fontdrvhost.exe	131
PID 916 wrote to memory of 1488	916	fontdrvhost.exe	131
PID 1488 wrote to memory of 3324	1488	cmd.exe	133
PID 1488 wrote to memory of 3324	1488	cmd.exe	133
PID 1488 wrote to memory of 1168	1488	cmd.exe	134
PID 1488 wrote to memory of 1168	1488	cmd.exe	134
PID 1488 wrote to memory of 4164	1488	cmd.exe	136
PID 1488 wrote to memory of 4164	1488	cmd.exe	136
PID 4164 wrote to memory of 3772	4164	fontdrvhost.exe	137
PID 4164 wrote to memory of 3772	4164	fontdrvhost.exe	137
PID 3772 wrote to memory of 3620	3772	cmd.exe	139
PID 3772 wrote to memory of 3620	3772	cmd.exe	139
PID 3772 wrote to memory of 1496	3772	cmd.exe	140
PID 3772 wrote to memory of 1496	3772	cmd.exe	140
PID 3772 wrote to memory of 4388	3772	cmd.exe	141
PID 3772 wrote to memory of 4388	3772	cmd.exe	141
PID 4388 wrote to memory of 920	4388	fontdrvhost.exe	142
PID 4388 wrote to memory of 920	4388	fontdrvhost.exe	142
PID 920 wrote to memory of 3012	920	cmd.exe	144
PID 920 wrote to memory of 3012	920	cmd.exe	144
PID 920 wrote to memory of 5036	920	cmd.exe	145
PID 920 wrote to memory of 5036	920	cmd.exe	145
PID 920 wrote to memory of 3168	920	cmd.exe	146
PID 920 wrote to memory of 3168	920	cmd.exe	146
PID 3168 wrote to memory of 2448	3168	fontdrvhost.exe	147
PID 3168 wrote to memory of 2448	3168	fontdrvhost.exe	147
PID 2448 wrote to memory of 4748	2448	cmd.exe	149
PID 2448 wrote to memory of 4748	2448	cmd.exe	149
PID 2448 wrote to memory of 4196	2448	cmd.exe	150
PID 2448 wrote to memory of 4196	2448	cmd.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4.exe
"C:\Users\Admin\AppData\Local\Temp\fb145a248667da2c0f287c070250dc501c7b3d03df44f22e4f50a735599923d4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\blockPortServerdriverRuntime.sfx.exe
    blockPortServerdriverRuntime.sfx.exe -p1234
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\blockPortServerdriverRuntime.exe
      "C:\blockPortServerdriverRuntime.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vi1zp25p\vi1zp25p.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1980
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8D0D.tmp" "c:\Windows\System32\CSC6B40C998AA314DEAA1718E26B1DDFE1.TMP"
        6⤵
        
        PID:2424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjvtj6sJcO.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2564
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2388
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5080
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0T9X0LKmT6.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4852
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4844
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XA2Giq7lse.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3032
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3528
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ij3ogloIkp.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1168
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fGOYhFobNz.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3620
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1496
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jyswAWn9wk.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5036
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dmjHjjptz9.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4748
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4196
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c7Mmfs6BdK.bat"
        19⤵
        
        PID:4484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3100
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4672
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B35ds8t0En.bat"
        21⤵
        
        PID:1484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:544
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ZUpyl1cxR.bat"
        23⤵
        
        PID:2244
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4804
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1176
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x0UH1pL55G.bat"
        25⤵
        
        PID:3064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3464
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:448
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1512
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\s4Al4mMfKa.bat"
        27⤵
        
        PID:1064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3220
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bsXeB76KRP.bat"
        29⤵
        
        PID:920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1204
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:912
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MGTgtuIFSm.bat"
        31⤵
        
        PID:1500
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2592
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1076
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rAx8WBe6mr.bat"
        33⤵
        
        PID:4704
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        34⤵
        
        PID:2520
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:832
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MGTgtuIFSm.bat"
        35⤵
        
        PID:4344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        36⤵
        
        PID:2676
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        36⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3720
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        36⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ij3ogloIkp.bat"
        37⤵
        
        PID:3988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        38⤵
        
        PID:4948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        38⤵
        
        PID:1812
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe"
        38⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3992
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MGTgtuIFSm.bat"
        39⤵
        
        PID:3944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        40⤵
        
        PID:2792
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        40⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\PackageManifests\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\swidtag\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockPortServerdriverRuntimeb" /sc MINUTE /mo 14 /tr "'C:\blockPortServerdriverRuntime.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockPortServerdriverRuntime" /sc ONLOGON /tr "'C:\blockPortServerdriverRuntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockPortServerdriverRuntimeb" /sc MINUTE /mo 9 /tr "'C:\blockPortServerdriverRuntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.bat

Filesize
62B

MD5
3caf9e84bed0774d4503d0a9832e3489

SHA1
57e750cc31918f91bf15309f182f5b84265ecfcc

SHA256
2b335dd0175798cd62d16dc74c7961835afe69f47e4c04529caba0b1dd9d1aa2

SHA512
e359ad56cad85fb27617f4393dfe6a33a454d506fe4be0024814175f3fb12b5ef7c3e9e3e2c1d6dcbec90d6f54015e9210b499e5ff8a2f537a1f46abccb42100

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
f8b2fca3a50771154571c11f1c53887b

SHA1
2e83b0c8e2f4c10b145b7fb4832ed1c78743de3f

SHA256
0efa72802031a8f902c3a4ab18fe3d667dafc71c93eb3a1811e78353ecf4a6b6

SHA512
b98b8d5516593d13415199d4ac6fbe4ff924488487c4bd863cb677601048785d872a3ff30129148e2961cb6fb2fc33117540302980a132f57f7ec9a497813f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\0T9X0LKmT6.bat

Filesize
242B

MD5
f4faab8d1614ed52c84e02507d5c4517

SHA1
716121f973da3579ce6e740d56bb96c48113dad8

SHA256
07d096c7cd011792addccfd845f33b3e3cef508954e9d224792e77d812d5f1b4

SHA512
24cc90ef7b6d99750f405c0cd61947136565d225acdbda7d4e9c0d94320284e080ded343ada10f370a63f29a65cbb3848b256af3d62d67579eecbeee895736e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZUpyl1cxR.bat

Filesize
242B

MD5
862cffdc08ccffe34846eb524e6260fd

SHA1
0b7050e9536e21a9e4a99434a04fb80ac218ba8f

SHA256
e529d87dcd57d2c085eec7404cb237876211185b806c15689575eefcbf240708

SHA512
fd0a2e96dc3b602ddbd3a65266462cc4e13538730c1dfcdbbfab686a8d6c44066691260ea9d807682f8f423b765cab7c16ec1a1b701116eff1f21a12b13c149d

Download Submit
C:\Users\Admin\AppData\Local\Temp\B35ds8t0En.bat

Filesize
242B

MD5
60722cbee2638ba63c5ff7200712335a

SHA1
6f9e0c9c33cc95c08383713df4b86a21edb5e100

SHA256
255180e0a3af8aa6b86651b9e99a5916ec3f26be5175747c26722ddcb8860e38

SHA512
ea4e86665619d55657a62f7442248ffc11409f5454a2ed32d47488eb6efd3d17f1f0ae76f789143d58d6cba898e668a43a42afd1950443cc75341e05fdbef046

Download Submit
C:\Users\Admin\AppData\Local\Temp\MGTgtuIFSm.bat

Filesize
194B

MD5
e7ba466ac3c4265bd4ec39b9119cd907

SHA1
fd14f08a82b81de07b8b27620b1c19fb12163738

SHA256
dc62b22dc200bb0c2bc7c062696bc93d3c079ebea4cf9bdbeda6b716ea3cc347

SHA512
ed5f3c18f6f2a40cda6819dd3d8abe9a666bbd6306e57671283adc69d294c4ea983f6b9376f43d85d46283c79344f0bf63ff421d66d616da7766b6c5a15f5e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8D0D.tmp

Filesize
1KB

MD5
4e3ae823fb647e7b435962ce19038d1c

SHA1
b8cdf79806474a10a9386508e4f428efa15d566e

SHA256
7aeac3f88f8771a86b0b47af337aca47dca01b233f277bf3b3ee402c2b228d55

SHA512
927db83360e66f079adfc6b7da348ba6a63eb30114743f6ec4983e09ccd0270706f390f8999ab1952202fd021eef46c7daa4eb655e58d9edaa283ad5025c79a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\XA2Giq7lse.bat

Filesize
194B

MD5
ee69eda46eb94418b7e4cec2df4e101b

SHA1
56afeff868afff5df958c151fd9e5b22b86bb9a2

SHA256
584a6251fe6b3f6b7120f040950158d7e2a7a27f5a026c902679f0476aa303ce

SHA512
f1c64eaf6a055597c76497e61f027586187e68728bec3e66dfbdf9e6dd2edf8b3cb635e53bde76bb25842f00ba1f8b58b80c5e842e37fbd4f26e890f5f15652a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bsXeB76KRP.bat

Filesize
194B

MD5
c089704b7d9ab43d856507cb461e58d1

SHA1
cc414e959b6b8eb75e6cc57a29a0f434e64a0847

SHA256
6e0dcc019f840c933ec9be7d36bfc8e3311c3c7374e0a153f529bc1d0654acf2

SHA512
0a411aa660befb38e1bfac8bf4cc31f8ebc25f2f2a65bd7e8fe71f7cddc1ebf9b7c1df1d66b3a64b0d03d927d5c383be8e5b693a440d48b59855494b026e7094

Download Submit
C:\Users\Admin\AppData\Local\Temp\c7Mmfs6BdK.bat

Filesize
194B

MD5
4702dd493a74d9bc938108cc121e5a13

SHA1
a90fde282471acc5b23ae32ee65b3c41cb289350

SHA256
be8ceeb96578ad46d8c0eeb2a5f39ab5cce70b1de7680e29d36b4abe7b2f8835

SHA512
f59e63ba0a949a8366496603b87b5742762437eab58f8ecd9371552d63809c251782f9500d4fc85890f42475a03f9918d2c7cf06ba81cf48da6162fec925e738

Download Submit
C:\Users\Admin\AppData\Local\Temp\dmjHjjptz9.bat

Filesize
194B

MD5
c105f3c8cfbf4bfcb923931117367391

SHA1
8e635e585f35191a08b80c0ed1b6ca81f545a9b3

SHA256
95f85468fa392b2eaecfb52cec9f6079db06798528adfc66340613eeee0ecaae

SHA512
a03d1dd923738467317dc74d34fc706d50b184bb9132c823701c5082121d5114f8ca7055f475b11f583c0e92e0dcec496e085057ddc81507b9e60650f0210bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\fGOYhFobNz.bat

Filesize
194B

MD5
04f36aeeffff969f3a2d802650fedc3e

SHA1
a41e4202dad943db4bd7df449247d7c3db903f35

SHA256
873027aa5ca52e681049c58e14e95fae184576f62ad2b4500b284dff46332e7f

SHA512
c917e41c0d4aff1aee04e1bc3bde0fa388bf4678432d02362cdedab29b26c6f0ca92ffd06ccb50f3149dc99876b4bb3b5d4c2a8c671703cc28e956cffa4c0c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjvtj6sJcO.bat

Filesize
194B

MD5
9bb7efc42f4ff62780cda0721530e64c

SHA1
1e088c425640563b7f2b2d3c82b854d6ffa6cbf4

SHA256
35589deb2f706157aa9400794244c2f8708e4fe25283f242a31c8b5c05457009

SHA512
09cc4ec86fec34992d6d5d7de04ea1bcb91b6838a59c93f9e6edf40c6785eb87667f7943c058bf6a171662a4d1b1247779aaf9acf4151240eaf0719d2f6c61d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ij3ogloIkp.bat

Filesize
242B

MD5
8aaa44f92d51707b8177b3ca8a089b00

SHA1
0f0c4467e4977206aba6f4d4d1ccb27dd122fe26

SHA256
2562fe56f49b95d6b7b79fd484f831a4cf44fa906ea9df0579d15a84a457ed0a

SHA512
5a92891b0b39dfa9b856e99302a31c76a148744aed13c6d9cd6996a84ded911dac0907fe2e8ca4a8764958c22587ba3734a88120e4f0e82991a5d81b8bbc370b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jyswAWn9wk.bat

Filesize
194B

MD5
2bdc604d0b6604583c3787e706202409

SHA1
104a2fdc4062780868b9d2202cea624825465973

SHA256
614a154844288b09fdbc3f1339582b8ecfcc43b4a66b3afa331e3f9fce372f8d

SHA512
7a0291dc3140cbb6bad0a94d23202139e32afa09273184f2c516a11557d64502b3807c7f1ffafbb53e82cb7f3ed3648e5700997bb61add240505b0d87f467ba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rAx8WBe6mr.bat

Filesize
242B

MD5
f9782ef59599d5c15501f00d09ad8699

SHA1
4d0c0874cff022e0a6c4e69367a95b85df6d1d3d

SHA256
3912b39bdc78e4f7490c2869722632855d72c7a62eb90bdb7fa3d4a4a8eb443f

SHA512
27b73d9b7df73b12a2ff4783d4ba0ee9e9d16a08d1c7114a60962959bc67a8dcd2068b3fa2def1fb35eb16132fad9470b87814eae3733ff812f6e011f9185a8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\s4Al4mMfKa.bat

Filesize
242B

MD5
96bf964251cf7e16abd76b7b6deb9e74

SHA1
2a92c96d670632436c6c35f709b6b0271a3b9407

SHA256
f0f617816d2f7d899da603717bfa256fd86f59afbc4921daf87af2114e9452a6

SHA512
d3a5e248a4cea8f983b28d3c2886d29a1acd71018c05a4a70f57a0328fd207bce78ac0803567adaae6498c304a6c80677975b9d7c5d9d9e5ec5027b04048745e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x0UH1pL55G.bat

Filesize
242B

MD5
036979844244ee8daff97c055bc51584

SHA1
ddc1d50f9941a1d949d195fb4f246d16380f7dd6

SHA256
a561e7e9e1a5047a2e91944e5bd63e6532018f2076d6d5072b703a560af01d2a

SHA512
ee405a42f51b2078cb4339387f253f0c3bff6e3a2db8c08bf91c64e6fe732778c594abe21f43f170de415c03efc52e328f68a561e08d60606c89c43f5490bfda

Download Submit
C:\blockPortServerdriverRuntime.exe

Filesize
1.8MB

MD5
cd66d0673239c0998cf9f49c73f15cd3

SHA1
67054ee170e7a637dddc1604081815fb3e9d04e3

SHA256
eb7028f8db4bf6e44ef8e3d2250304c604cbd350d93529d2bfe24ddf773383de

SHA512
328e36bd61e8a00f10ea22af5e86921278217c23546f7502e5ed02881d8c1155372578d83141e8da3e564c3fce7bf212493b15e74585d97d67644dc6f4184274

Download Submit
C:\blockPortServerdriverRuntime.sfx.exe

Filesize
1.8MB

MD5
b5a4e3bf294fd3e5b4d82af34eeca853

SHA1
ba027c0af5d3c7c5e38b25ee037cd157037096bc

SHA256
3b20edc0a80f388a8178aa1b540b335e66810f8be9deb5fc9876ecbd848f7ff6

SHA512
00aa0a2befd1cfbf2b72941d34bd1042a3b5e27016f3775276cd46778c94b64a5a0ca03283a52f60d00fa11ef4d787a5d72b0fd2971a5bdec9203e43e3a85952

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vi1zp25p\vi1zp25p.0.cs

Filesize
400B

MD5
e733cf54de106dc6de03e7f874b377d4

SHA1
c59de6ec7a81dd5778ac1032580b1a5589446eab

SHA256
0a222ba4b93070f6feecae05d0295c90812e05c2f12eac2d722b89f5ac5d0058

SHA512
aefb7a0fc259d01477fea16fc7538cbbe40959329306a142fb9fe956ff0ebf4377482a49dad5447da303eeeb81d6387bb3e6c87d0b717368ab0bc7eeb1824df1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vi1zp25p\vi1zp25p.cmdline

Filesize
235B

MD5
367ea2d20610895f58b1759967efe6f7

SHA1
59be8fb17ab3ce6926f59a2eb4c90aafef1e408d

SHA256
f9991ae92307eaa312debe5547eba18fdc08a8367ae62c16eba9be0cec225a1c

SHA512
4c490f6564f26fb79fc59ea82d26e8e4c6926df7f00d45dd9b660af53d1eafcb963efb0a79911068cb0e6286aeddba133ddb3df762821d38a0e8ef8a73fe58ed

Download Submit
\??\c:\Windows\System32\CSC6B40C998AA314DEAA1718E26B1DDFE1.TMP

Filesize
1KB

MD5
634e281a00b7b9f516c3048badfa1530

SHA1
af6369715ce2fe9b99609e470d4f66698880a35a

SHA256
0d990336ae793f3f6903048004c8d707d7a7191927bd7df46b7fe887116506c8

SHA512
1cb35fa0759f5362c9c7eee5546710874121005a3924bcfec2cf33ac90a257a807ce7ec0db7bc84dcb327604d708009449c34f52560ed936b54eeba49be7d27b

Download Submit
memory/740-240-0x000000001C9E0000-0x000000001CAAD000-memory.dmp

Filesize
820KB

Download
memory/808-174-0x000000001D0E0000-0x000000001D1AD000-memory.dmp

Filesize
820KB

Download
memory/916-97-0x000000001B6F0000-0x000000001B7BD000-memory.dmp

Filesize
820KB

Download
memory/1512-185-0x000000001CCE0000-0x000000001CDAD000-memory.dmp

Filesize
820KB

Download
memory/1708-207-0x000000001B460000-0x000000001B52D000-memory.dmp

Filesize
820KB

Download
memory/2372-218-0x000000001D2C0000-0x000000001D38D000-memory.dmp

Filesize
820KB

Download
memory/2452-74-0x000000001D490000-0x000000001D55D000-memory.dmp

Filesize
820KB

Download
memory/3168-130-0x000000001CD00000-0x000000001CDCD000-memory.dmp

Filesize
820KB

Download
memory/3208-229-0x000000001C940000-0x000000001CA0D000-memory.dmp

Filesize
820KB

Download
memory/3668-86-0x000000001C8F0000-0x000000001C9BD000-memory.dmp

Filesize
820KB

Download
memory/3992-251-0x000000001B350000-0x000000001B41D000-memory.dmp

Filesize
820KB

Download
memory/4164-108-0x000000001C8E0000-0x000000001C9AD000-memory.dmp

Filesize
820KB

Download
memory/4388-119-0x000000001CD40000-0x000000001CE0D000-memory.dmp

Filesize
820KB

Download
memory/4872-152-0x000000001D800000-0x000000001D8CD000-memory.dmp

Filesize
820KB

Download
memory/4960-163-0x000000001D8A0000-0x000000001D96D000-memory.dmp

Filesize
820KB

Download
memory/4980-29-0x000000001B9B0000-0x000000001B9C8000-memory.dmp

Filesize
96KB

Download
memory/4980-26-0x000000001B990000-0x000000001B9AC000-memory.dmp

Filesize
112KB

Download
memory/4980-24-0x0000000002E40000-0x0000000002E4E000-memory.dmp

Filesize
56KB

Download
memory/4980-27-0x000000001BC20000-0x000000001BC70000-memory.dmp

Filesize
320KB

Download
memory/4980-22-0x0000000000A80000-0x0000000000C5A000-memory.dmp

Filesize
1.9MB

Download
memory/4980-31-0x0000000002E50000-0x0000000002E5C000-memory.dmp

Filesize
48KB

Download
memory/4980-60-0x000000001BEB0000-0x000000001BF7D000-memory.dmp

Filesize
820KB

Download
memory/5000-141-0x000000001C8D0000-0x000000001C99D000-memory.dmp

Filesize
820KB

Download
memory/5088-196-0x000000001CF90000-0x000000001D05D000-memory.dmp

Filesize
820KB

Download