dcrat | 718a63953d979b9d1be2f15d9583ed752123d1b90f35f8e01e200c15253c03f7

General

Target

JIGSAW.WARE.exe
Size

3.1MB
MD5

494ef5660c6fc673bbafde349727b9b1
SHA1

af5bc1d64d1447bd41124d3d5efc620cf76b590f
SHA256

718a63953d979b9d1be2f15d9583ed752123d1b90f35f8e01e200c15253c03f7
SHA512

989f9508921c79409f2ef9818e6754699f8d96ab6cfc1752a39e3187eb0fabc8597d25b65cff4a72abc0da2c8763ae47b244000bb186295637be3759355a3361
SSDEEP

49152:ObA3XkdBu+dK3GaaTUukCTXO2s2f1sKfmFRd0MdOa5k1kpm/Ufn6sCC:ObU2uyjAi+j2aK+F54/U/6sN

Score

10^/10

dcrat discovery evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2960	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2960	schtasks.exe	34

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	runtime.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	runtime.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	runtime.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0008000000016e1d-10.dat	dcrat
behavioral1/memory/2176-13-0x0000000000B30000-0x0000000000DE4000-memory.dmp	dcrat
behavioral1/files/0x000600000001a05a-73.dat	dcrat
behavioral1/files/0x00080000000173a3-87.dat	dcrat
behavioral1/files/0x00080000000195c8-110.dat	dcrat
behavioral1/files/0x0007000000019624-144.dat	dcrat
behavioral1/memory/1000-151-0x0000000000250000-0x0000000000504000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2176	runtime.exe
1000	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2432	cmd.exe
2432	cmd.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	runtime.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	runtime.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe	runtime.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\56085415360792	runtime.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\sppsvc.exe	runtime.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\0a1fd5f707cd16	runtime.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe	runtime.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX8774.tmp	runtime.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX87A4.tmp	runtime.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX7DBC.tmp	runtime.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX7DBD.tmp	runtime.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\sppsvc.exe	runtime.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\CSC\v2.0.6\cmd.exe	runtime.exe
File created	C:\Windows\Resources\Ease of Access Themes\winlogon.exe	runtime.exe
File created	C:\Windows\fr-FR\1610b97d3ab4a7	runtime.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\RCX8551.tmp	runtime.exe
File opened for modification	C:\Windows\fr-FR\RCX8C1A.tmp	runtime.exe
File opened for modification	C:\Windows\fr-FR\RCX8C88.tmp	runtime.exe
File opened for modification	C:\Windows\fr-FR\OSPPSVC.exe	runtime.exe
File created	C:\Windows\Resources\Ease of Access Themes\cc11b995f2a76d	runtime.exe
File created	C:\Windows\fr-FR\OSPPSVC.exe	runtime.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\RCX84C4.tmp	runtime.exe
File opened for modification	C:\Windows\Resources\Ease of Access Themes\winlogon.exe	runtime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JIGSAW.WARE.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1352	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2732	schtasks.exe
1708	schtasks.exe
700	schtasks.exe
2008	schtasks.exe
532	schtasks.exe
2192	schtasks.exe
548	schtasks.exe
2908	schtasks.exe
2888	schtasks.exe
1864	schtasks.exe
1868	schtasks.exe
1768	schtasks.exe
2436	schtasks.exe
2188	schtasks.exe
1368	schtasks.exe
2376	schtasks.exe
444	schtasks.exe
2400	schtasks.exe
616	schtasks.exe
2932	schtasks.exe
2328	schtasks.exe
540	schtasks.exe
1492	schtasks.exe
2440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2176	runtime.exe
1000	conhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	runtime.exe
Token: SeDebugPrivilege	1000	conhost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2768	2160	JIGSAW.WARE.exe	30
PID 2160 wrote to memory of 2768	2160	JIGSAW.WARE.exe	30
PID 2160 wrote to memory of 2768	2160	JIGSAW.WARE.exe	30
PID 2160 wrote to memory of 2768	2160	JIGSAW.WARE.exe	30
PID 2768 wrote to memory of 2432	2768	WScript.exe	31
PID 2768 wrote to memory of 2432	2768	WScript.exe	31
PID 2768 wrote to memory of 2432	2768	WScript.exe	31
PID 2768 wrote to memory of 2432	2768	WScript.exe	31
PID 2432 wrote to memory of 2176	2432	cmd.exe	33
PID 2432 wrote to memory of 2176	2432	cmd.exe	33
PID 2432 wrote to memory of 2176	2432	cmd.exe	33
PID 2432 wrote to memory of 2176	2432	cmd.exe	33
PID 2176 wrote to memory of 1000	2176	runtime.exe	59
PID 2176 wrote to memory of 1000	2176	runtime.exe	59
PID 2176 wrote to memory of 1000	2176	runtime.exe	59
PID 2432 wrote to memory of 1352	2432	cmd.exe	60
PID 2432 wrote to memory of 1352	2432	cmd.exe	60
PID 2432 wrote to memory of 1352	2432	cmd.exe	60
PID 2432 wrote to memory of 1352	2432	cmd.exe	60

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	runtime.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	runtime.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	runtime.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JIGSAW.WARE.exe
"C:\Users\Admin\AppData\Local\Temp\JIGSAW.WARE.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\BlockMonitor\7aswJoix9AJ.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\BlockMonitor\tJKDiBxtiU8G.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\BlockMonitor\runtime.exe
      "C:\BlockMonitor\runtime.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2176
    - - C:\MSOCache\All Users\conhost.exe
        
        "C:\MSOCache\All Users\conhost.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1000
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\BlockMonitor\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\BlockMonitor\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\BlockMonitor\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\Resources\Ease of Access Themes\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\Resources\Ease of Access Themes\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Windows\fr-FR\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\fr-FR\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Windows\fr-FR\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\BlockMonitor\7aswJoix9AJ.vbe

Filesize
212B

MD5
a283bf973f472c70d8eb57cc14a1a239

SHA1
a193da72de4b7d6bff7e359bd6fb14d3cd4f79e8

SHA256
ac895cb08a28f23164755bd8fa5d2466f3800a5f610094ed6c0c0682df8c9d1b

SHA512
da6041b2baa32df36e4fb95f96b30368c3b4682d197d9c175e961c5b0658e7ce258bc193a36576ae9872d4bec951708d248cb9d131dbfd098ff53b33500e742b

Download Submit
C:\BlockMonitor\runtime.exe

Filesize
2.7MB

MD5
5c2272c93d7a94da1f16903cadea1dc3

SHA1
db971f5c95322011467fdf48ea4cfd40f64574a2

SHA256
a32ab455ce53828273a46ed9d6d4bc808c4443f8f14278782ce3daaae869b805

SHA512
53e06a34a2d2a4dadcf728dc508a78ba581c1a0435ef265a09ab7804ec1702d97beb691dec5423501dd6a4e17311459f19b50d95e11789be70ddb1923de435eb

Download Submit
C:\BlockMonitor\tJKDiBxtiU8G.bat

Filesize
152B

MD5
2beb511f292072fc563d74d4a1c4da10

SHA1
6420cafec14a01469cc518be72d97f2cfbfbef37

SHA256
aa58b208d024217ef80f4eeef9de9383b237f22d63652a3c1d656ead3342efae

SHA512
8c9acd904817db8e80aa4ddf2b93abd54fbac36e6b2ef671dc0a8657f6cab551d6d1edf6f8f5871880924774e26e112d26f6fb4cd01079e1eb36de6799fcafbb

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX7DBD.tmp

Filesize
2.7MB

MD5
e6b7a4c87f685afac706450dcbbf4d40

SHA1
81311cc919c691640ba32a733b7eaad0322e8732

SHA256
a6ca2a17e915c0294ed7670234c9be9f9b7760a47bed8588c33f93e7ec9fe9eb

SHA512
011b6d7ed89ea8cdc4fec958d4b6ee0686c4adf729860a29f40b4588c969d5855829c5c472ebb80314b03dc43f528e187a596240bcd145a1b579c59cb95b9582

Download Submit
C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\audiodg.exe

Filesize
2.7MB

MD5
7172b0712e7cca9af8a08c880cc4a679

SHA1
1a0dc9fe916a203ac61f9aea24eee8da167e1491

SHA256
b72c52088238b577a016e8e7f70f41f0cb4f29d56a08bfaa2c4debbe3e0bb66c

SHA512
555916f9106c3c9d934018299d90d3e26e07fa1958e067de4af26456fe1875403d65761a216365d7b4e18000053978486d8e88c98a650869d6894511c97c378c

Download Submit
C:\Windows\Resources\Ease of Access Themes\winlogon.exe

Filesize
2.7MB

MD5
8c370d4fbe255d164791e4faaa49a61e

SHA1
03095416d16229090fade27d37fe4b84de973434

SHA256
a737430697aa6099318aae97fbcab79b51f7d6db607cf48ce0b1c006b5f7c29c

SHA512
46bc38fbb84ac5dcb35698797a48b5f2c87ff4bad6abc32822e0e63391990eae80e4c17774f7d5de91230609416acfeee413231fe4cd64de89a1c8dc618ec4bb

Download Submit
C:\Windows\fr-FR\OSPPSVC.exe

Filesize
2.7MB

MD5
a1ec481b4230f37389b4ce3f12c368bf

SHA1
e4647e5e65cb7571d947addf98029a7fcf351a84

SHA256
c09e1213455b15a0e5d51464c81a805f9d226542d6b075896f8658d7d1ecc603

SHA512
d1b09c4a6e66122a8841c235ecbd8ade9028477a1ace274267ad23c642f23b870b2f6b0ca039dc743321e229b3e473da0ff44bf13449bb105b0d900f376c614b

Download Submit
memory/1000-151-0x0000000000250000-0x0000000000504000-memory.dmp

Filesize
2.7MB

Download
memory/1352-152-0x0000000077410000-0x000000007752F000-memory.dmp

Filesize
1.1MB

Download
memory/1352-153-0x0000000077310000-0x000000007740A000-memory.dmp

Filesize
1000KB

Download
memory/2176-23-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download
memory/2176-29-0x0000000002400000-0x000000000240C000-memory.dmp

Filesize
48KB

Download
memory/2176-22-0x00000000022F0000-0x0000000002346000-memory.dmp

Filesize
344KB

Download
memory/2176-24-0x0000000000880000-0x0000000000892000-memory.dmp

Filesize
72KB

Download
memory/2176-20-0x0000000000850000-0x0000000000858000-memory.dmp

Filesize
32KB

Download
memory/2176-25-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2176-26-0x0000000002350000-0x0000000002358000-memory.dmp

Filesize
32KB

Download
memory/2176-27-0x0000000002360000-0x000000000236C000-memory.dmp

Filesize
48KB

Download
memory/2176-28-0x0000000002370000-0x000000000237E000-memory.dmp

Filesize
56KB

Download
memory/2176-21-0x0000000000860000-0x000000000086A000-memory.dmp

Filesize
40KB

Download
memory/2176-30-0x0000000002410000-0x000000000241A000-memory.dmp

Filesize
40KB

Download
memory/2176-31-0x0000000002420000-0x000000000242C000-memory.dmp

Filesize
48KB

Download
memory/2176-18-0x0000000000410000-0x0000000000426000-memory.dmp

Filesize
88KB

Download
memory/2176-19-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/2176-17-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2176-16-0x00000000001E0000-0x00000000001E8000-memory.dmp

Filesize
32KB

Download
memory/2176-15-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2176-14-0x00000000001D0000-0x00000000001DE000-memory.dmp

Filesize
56KB

Download
memory/2176-13-0x0000000000B30000-0x0000000000DE4000-memory.dmp

Filesize
2.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads