dcrat | 91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d

Analysis

max time kernel
75s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/12/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
Size 1.7MB
Sample241230-wfwlcstrhs
SHA256 91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d
MD5 2526937c096baa22a3af4104efd8466c
SHA1 7b3459bc0bef82889b96baef0d10c6f8853f5647
SHA512 2a1f7482680c435617ff0de3efb99f738c820dd336d5cc1fe6d055d0c2c41e5aa8f3b7f25b5039b0b43f7b9e081575c7e2d72d6a9573a1c6817a1506d72b4418
SSDEEP 24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ0:NgwuuEpdDLNwVMeXDL0fdSzAGB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2520	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	332	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2840	schtasks.exe	30

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1964-1-0x0000000000C60000-0x0000000000E16000-memory.dmp	dcrat
behavioral1/files/0x0005000000019467-27.dat	dcrat
behavioral1/files/0x000c000000018731-95.dat	dcrat
behavioral1/files/0x0007000000019467-106.dat	dcrat
behavioral1/files/0x000600000001952f-128.dat	dcrat
behavioral1/memory/2600-145-0x00000000009D0000-0x0000000000B86000-memory.dmp	dcrat
behavioral1/memory/1540-212-0x0000000000DC0000-0x0000000000F76000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1984	powershell.exe
2184	powershell.exe
3032	powershell.exe
1792	powershell.exe
2432	powershell.exe
2440	powershell.exe
2072	powershell.exe
2416	powershell.exe
1236	powershell.exe
552	powershell.exe
2188	powershell.exe
2464	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe

Executes dropped EXE 2 IoCs

pid	Process
2600	smss.exe
1540	smss.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCX165.tmp	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\OSPPSVC.exe	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\OSPPSVC.exe	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\1610b97d3ab4a7	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCXF7.tmp	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\csrss.exe	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File created	C:\Windows\Offline Web Pages\886983d96e3d3e	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File opened for modification	C:\Windows\Offline Web Pages\RCX369.tmp	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File opened for modification	C:\Windows\Offline Web Pages\RCX36A.tmp	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
File opened for modification	C:\Windows\Offline Web Pages\csrss.exe	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2200	schtasks.exe
1992	schtasks.exe
2860	schtasks.exe
636	schtasks.exe
332	schtasks.exe
2968	schtasks.exe
3012	schtasks.exe
2136	schtasks.exe
2332	schtasks.exe
2760	schtasks.exe
2972	schtasks.exe
2412	schtasks.exe
532	schtasks.exe
2552	schtasks.exe
1756	schtasks.exe
1036	schtasks.exe
1740	schtasks.exe
1104	schtasks.exe
2808	schtasks.exe
2396	schtasks.exe
2984	schtasks.exe
2000	schtasks.exe
2636	schtasks.exe
2520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
2072	powershell.exe
2188	powershell.exe
1792	powershell.exe
1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
3032	powershell.exe
2416	powershell.exe
2440	powershell.exe
552	powershell.exe
2184	powershell.exe
1236	powershell.exe
1984	powershell.exe
2464	powershell.exe
2432	powershell.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
2600	smss.exe
1540	smss.exe
1540	smss.exe
1540	smss.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
Token: SeDebugPrivilege	2072	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	2600	smss.exe
Token: SeDebugPrivilege	1540	smss.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2072	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	55
PID 1964 wrote to memory of 2072	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	55
PID 1964 wrote to memory of 2072	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	55
PID 1964 wrote to memory of 1984	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	56
PID 1964 wrote to memory of 1984	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	56
PID 1964 wrote to memory of 1984	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	56
PID 1964 wrote to memory of 2416	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	58
PID 1964 wrote to memory of 2416	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	58
PID 1964 wrote to memory of 2416	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	58
PID 1964 wrote to memory of 1236	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	59
PID 1964 wrote to memory of 1236	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	59
PID 1964 wrote to memory of 1236	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	59
PID 1964 wrote to memory of 2464	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	60
PID 1964 wrote to memory of 2464	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	60
PID 1964 wrote to memory of 2464	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	60
PID 1964 wrote to memory of 2188	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	61
PID 1964 wrote to memory of 2188	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	61
PID 1964 wrote to memory of 2188	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	61
PID 1964 wrote to memory of 552	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	62
PID 1964 wrote to memory of 552	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	62
PID 1964 wrote to memory of 552	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	62
PID 1964 wrote to memory of 2440	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	63
PID 1964 wrote to memory of 2440	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	63
PID 1964 wrote to memory of 2440	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	63
PID 1964 wrote to memory of 2432	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	64
PID 1964 wrote to memory of 2432	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	64
PID 1964 wrote to memory of 2432	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	64
PID 1964 wrote to memory of 1792	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	65
PID 1964 wrote to memory of 1792	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	65
PID 1964 wrote to memory of 1792	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	65
PID 1964 wrote to memory of 3032	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	66
PID 1964 wrote to memory of 3032	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	66
PID 1964 wrote to memory of 3032	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	66
PID 1964 wrote to memory of 2184	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	67
PID 1964 wrote to memory of 2184	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	67
PID 1964 wrote to memory of 2184	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	67
PID 1964 wrote to memory of 2600	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	79
PID 1964 wrote to memory of 2600	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	79
PID 1964 wrote to memory of 2600	1964	91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe	79
PID 2600 wrote to memory of 1404	2600	smss.exe	80
PID 2600 wrote to memory of 1404	2600	smss.exe	80
PID 2600 wrote to memory of 1404	2600	smss.exe	80
PID 2600 wrote to memory of 1760	2600	smss.exe	81
PID 2600 wrote to memory of 1760	2600	smss.exe	81
PID 2600 wrote to memory of 1760	2600	smss.exe	81
PID 1404 wrote to memory of 1540	1404	WScript.exe	82
PID 1404 wrote to memory of 1540	1404	WScript.exe	82
PID 1404 wrote to memory of 1540	1404	WScript.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe
"C:\Users\Admin\AppData\Local\Temp\91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe
  "C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ea745bd-44e2-4cdf-854f-aa9f725189c6.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe
      C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1540
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b678f9cc-7828-4e7d-8561-950f335cb36e.vbs"
    3⤵
    PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Saved Games\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Downloads\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Downloads\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\Offline Web Pages\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsm.exe

Path C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe
Size 1.7MB
SHA256 91034df30d1ef00ed5f689e3d8cd041fb9a36caf97af9c430eede4c3e047567d
MD5 2526937c096baa22a3af4104efd8466c
SHA1 7b3459bc0bef82889b96baef0d10c6f8853f5647
SHA512 2a1f7482680c435617ff0de3efb99f738c820dd336d5cc1fe6d055d0c2c41e5aa8f3b7f25b5039b0b43f7b9e081575c7e2d72d6a9573a1c6817a1506d72b4418
SSDEEP 24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ0:NgwuuEpdDLNwVMeXDL0fdSzAGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsm.exe

Path C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsm.exe
Size 1.7MB
SHA256 ad40bd70c33f4ecc9219a63c193ed2b720657a074b25e6155e087d011ac34293
MD5 baa7b9a3200b649e52ea448375a2d132
SHA1 1772814cde0da9abd0e2ee79df062f49a17d72e6
SHA512 c584927a824e194d160d0dc28394068521ddc7645b60010b5cecc9a7c57d6deef3bf617348104c91d74a95ccc2e417f7f2a94056eafa649e1001a33b030bad59
SSDEEP 24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSPPSVC.exe

Path C:\Program Files (x86)\Windows Defender\es-ES\OSPPSVC.exe
Size 1.7MB
SHA256 28e7d377e72abeefd39cd2a0ad4415682fef66663333cab704a206333253d701
MD5 dbdb98063f3334e808a3953c702eba46
SHA1 374725bc9252c59b5fc7b91f3e1b3f43384ab7ed
SHA512 bca9bee1ed7a5a22ebd30109fdb6bf1da630847b0d73924c2bee7860cafbe83e28cd5c0c16180f25b3cac1b84fe000d1621e796c5616f2ed3275863ce5f30040
SSDEEP 24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Recovery\18fc4542-69f6-11ef-a46c-62cb582c238c\smss.exe
Size 1.7MB
SHA256 cd2e49374e65ed89f778f98a0248b6bb5aed869dfaef5f47ac9e75a6c98375d3
MD5 e134258a05b91a6cc139147df634d386
SHA1 07dba7330bf5483a4157f78c3ede41b06da46e08
SHA512 d197e7557cc4f4391214d18c9073ea96b3327cdd3c68a7a0f61d45945c377774d413c88a71c6260a3bb218227ddb5b42b349dfc8caa4b01031e4caa05432fffb
SSDEEP 24576:t3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:tgwuuEpdDLNwVMeXDL0fdSzAG
MD5 SHA1 SHA512 SSDEEP

Submit Download

1ea745bd-44e2-4cdf-854f-aa9f725189c6.vbs

Path C:\Users\Admin\AppData\Local\Temp\1ea745bd-44e2-4cdf-854f-aa9f725189c6.vbs
Size 733B
SHA256 4fdf9c455f9eaed21f4d98e90faaa9870309c147840d3e5f0f352920ddfe7675
MD5 c6f0f68cc200b1d1754568c620a81c8a
SHA1 362ad8ef4f288e5e59594293ae06756adef1a175
SHA512 7721a7def43a4215a27cd221f61b339d5f7f7e25a472f31d0ba940a024032a3116cb055a5703516aee71131a224b3858c77b2ec8458d956b5d34b63234f96dd3
MD5 SHA1 SHA512

Submit Download

b678f9cc-7828-4e7d-8561-950f335cb36e.vbs

Path C:\Users\Admin\AppData\Local\Temp\b678f9cc-7828-4e7d-8561-950f335cb36e.vbs
Size 509B
SHA256 076e93784a9d1b485dfc11ce3855c3ab6dd2c8d21a5dd2a91fc5e0f2cd5d9f93
MD5 cfb5aec98e54c4576f167c3e02a53cb1
SHA1 63d66de52c7c38009c28ee1f862555475857de8d
SHA512 19a0c5d9fddaac5b150c44976edee73425c26647219baf2b5f9032f1e19a7c8e3e9c4b0f69f1893e482cd6f57e353c07c9db440941afad6bb408a0b55e9a46ad
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c7d2aaa4d0f854ab886d4e605051fba3a8d41b52a78bc7ec81aa6b4723ff963e
MD5 b42ed99f3e701c8edce834054796746b
SHA1 e2ee9de4e072c85c9fac527db71e87973948b59c
SHA512 b65ee84831b55afca071117b1dc2f2a82b99c99b20f37ff3f3de02b1953f4ebdc6cfcb457ea0fc05940cfe0f4a1a77cd5fccedf8a8fb22a9f08ba82f082c1dbd
SSDEEP 96:cRb6Cx3M8xnqvsqvJCwol2Rb6Cx3M8xnqvsEHyqvJCwor3q6yLQHQhU2U7B0XlUl:kn3FUolan3FAHnor3qzhhU2U7B0KP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1540-213-0x00000000009E0000-0x00000000009F2000-memory.dmp

Download

memory/1540-212-0x0000000000DC0000-0x0000000000F76000-memory.dmp

Download

memory/1964-18-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Download

memory/1964-7-0x0000000000290000-0x00000000002A2000-memory.dmp

Download

memory/1964-12-0x00000000003F0000-0x00000000003FC000-memory.dmp

Download

memory/1964-13-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1964-16-0x0000000000640000-0x000000000064C000-memory.dmp

Download

memory/1964-15-0x0000000000630000-0x0000000000638000-memory.dmp

Download

memory/1964-14-0x0000000000620000-0x000000000062A000-memory.dmp

Download

memory/1964-0-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

Download

memory/1964-17-0x0000000000650000-0x000000000065C000-memory.dmp

Download

memory/1964-9-0x0000000000320000-0x000000000032C000-memory.dmp

Download

memory/1964-8-0x00000000003D0000-0x00000000003E0000-memory.dmp

Download

memory/1964-10-0x00000000003E0000-0x00000000003E8000-memory.dmp

Download

memory/1964-6-0x00000000003B0000-0x00000000003C6000-memory.dmp

Download

memory/1964-5-0x0000000000280000-0x0000000000290000-memory.dmp

Download

memory/1964-1-0x0000000000C60000-0x0000000000E16000-memory.dmp

Download

memory/1964-2-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Download

memory/1964-3-0x0000000000250000-0x000000000026C000-memory.dmp

Download

memory/1964-200-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Download

memory/1964-4-0x0000000000270000-0x0000000000278000-memory.dmp

Download

memory/2072-139-0x0000000001D70000-0x0000000001D78000-memory.dmp

Download

memory/2072-138-0x000000001B730000-0x000000001BA12000-memory.dmp

Download

memory/2600-201-0x00000000005B0000-0x00000000005C2000-memory.dmp

Download

memory/2600-145-0x00000000009D0000-0x0000000000B86000-memory.dmp

Download