dcrat | 3e5248f104ad4f61a08be2095ad66b15b70eb71eadae6069f3934b2e8015662e

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	Comdriver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
1384	Comdriver.exe
464	sysmon.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comdriver = "\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\Comdriver.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comdriver = "\"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\Comdriver.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\hyperRuntimesvc\\lsass.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\hyperRuntimesvc\\csrss.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\hyperRuntimesvc\\csrss.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comdriver = "\"C:\\hyperRuntimesvc\\Comdriver.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\hyperRuntimesvc\\sysmon.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\hyperRuntimesvc\\sysmon.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\hyperRuntimesvc\\lsass.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Defender Advanced Threat Protection\\RuntimeBroker.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Defender Advanced Threat Protection\\RuntimeBroker.exe\""	Comdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Comdriver = "\"C:\\hyperRuntimesvc\\Comdriver.exe\""	Comdriver.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
62	ipinfo.io
63	ipinfo.io

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\sppsvc.exe	Comdriver.exe
File created	\??\c:\Windows\System32\CSC94D97F21DC5F464FA4F6DE87BC245422.TMP	csc.exe
File created	\??\c:\Windows\System32\ecx3z2.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe	Comdriver.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\9e8d7a4ca61bd9	Comdriver.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rescache\wininit.exe	Comdriver.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\Comdriver.exe	Comdriver.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\8ef6d02403e084	Comdriver.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2060	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133808221044507517"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000_Classes\Local Settings	Comdriver.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2060	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3212	schtasks.exe
1760	schtasks.exe
1376	schtasks.exe
4772	schtasks.exe
3348	schtasks.exe
2044	schtasks.exe
4640	schtasks.exe
4456	schtasks.exe
4888	schtasks.exe
1504	schtasks.exe
1732	schtasks.exe
572	schtasks.exe
972	schtasks.exe
2436	schtasks.exe
2024	schtasks.exe
840	schtasks.exe
4864	schtasks.exe
3824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe
1384	Comdriver.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
464	sysmon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	Comdriver.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeIncreaseQuotaPrivilege	1060	powershell.exe
Token: SeSecurityPrivilege	1060	powershell.exe
Token: SeTakeOwnershipPrivilege	1060	powershell.exe
Token: SeLoadDriverPrivilege	1060	powershell.exe
Token: SeSystemProfilePrivilege	1060	powershell.exe
Token: SeSystemtimePrivilege	1060	powershell.exe
Token: SeProfSingleProcessPrivilege	1060	powershell.exe
Token: SeIncBasePriorityPrivilege	1060	powershell.exe
Token: SeCreatePagefilePrivilege	1060	powershell.exe
Token: SeBackupPrivilege	1060	powershell.exe
Token: SeRestorePrivilege	1060	powershell.exe
Token: SeShutdownPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeSystemEnvironmentPrivilege	1060	powershell.exe
Token: SeRemoteShutdownPrivilege	1060	powershell.exe
Token: SeUndockPrivilege	1060	powershell.exe
Token: SeManageVolumePrivilege	1060	powershell.exe
Token: 33	1060	powershell.exe
Token: 34	1060	powershell.exe
Token: 35	1060	powershell.exe
Token: 36	1060	powershell.exe
Token: SeIncreaseQuotaPrivilege	1776	powershell.exe
Token: SeSecurityPrivilege	1776	powershell.exe
Token: SeTakeOwnershipPrivilege	1776	powershell.exe
Token: SeLoadDriverPrivilege	1776	powershell.exe
Token: SeSystemProfilePrivilege	1776	powershell.exe
Token: SeSystemtimePrivilege	1776	powershell.exe
Token: SeProfSingleProcessPrivilege	1776	powershell.exe
Token: SeIncBasePriorityPrivilege	1776	powershell.exe
Token: SeCreatePagefilePrivilege	1776	powershell.exe
Token: SeBackupPrivilege	1776	powershell.exe
Token: SeRestorePrivilege	1776	powershell.exe
Token: SeShutdownPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeSystemEnvironmentPrivilege	1776	powershell.exe
Token: SeRemoteShutdownPrivilege	1776	powershell.exe
Token: SeUndockPrivilege	1776	powershell.exe
Token: SeManageVolumePrivilege	1776	powershell.exe
Token: 33	1776	powershell.exe
Token: 34	1776	powershell.exe
Token: 35	1776	powershell.exe
Token: 36	1776	powershell.exe
Token: SeIncreaseQuotaPrivilege	3884	powershell.exe
Token: SeSecurityPrivilege	3884	powershell.exe
Token: SeTakeOwnershipPrivilege	3884	powershell.exe
Token: SeLoadDriverPrivilege	3884	powershell.exe
Token: SeSystemProfilePrivilege	3884	powershell.exe
Token: SeSystemtimePrivilege	3884	powershell.exe
Token: SeProfSingleProcessPrivilege	3884	powershell.exe
Token: SeIncBasePriorityPrivilege	3884	powershell.exe
Token: SeCreatePagefilePrivilege	3884	powershell.exe
Token: SeBackupPrivilege	3884	powershell.exe
Token: SeRestorePrivilege	3884	powershell.exe
Token: SeShutdownPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeSystemEnvironmentPrivilege	3884	powershell.exe
Token: SeRemoteShutdownPrivilege	3884	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
1152	chrome.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe
68	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 644	1684	DCRatBuild.exe	81
PID 1684 wrote to memory of 644	1684	DCRatBuild.exe	81
PID 1684 wrote to memory of 644	1684	DCRatBuild.exe	81
PID 644 wrote to memory of 3948	644	WScript.exe	83
PID 644 wrote to memory of 3948	644	WScript.exe	83
PID 644 wrote to memory of 3948	644	WScript.exe	83
PID 3948 wrote to memory of 1384	3948	cmd.exe	85
PID 3948 wrote to memory of 1384	3948	cmd.exe	85
PID 1384 wrote to memory of 1484	1384	Comdriver.exe	93
PID 1384 wrote to memory of 1484	1384	Comdriver.exe	93
PID 1484 wrote to memory of 1008	1484	csc.exe	95
PID 1484 wrote to memory of 1008	1484	csc.exe	95
PID 1384 wrote to memory of 1060	1384	Comdriver.exe	111
PID 1384 wrote to memory of 1060	1384	Comdriver.exe	111
PID 1384 wrote to memory of 1156	1384	Comdriver.exe	112
PID 1384 wrote to memory of 1156	1384	Comdriver.exe	112
PID 1384 wrote to memory of 1776	1384	Comdriver.exe	113
PID 1384 wrote to memory of 1776	1384	Comdriver.exe	113
PID 1384 wrote to memory of 976	1384	Comdriver.exe	114
PID 1384 wrote to memory of 976	1384	Comdriver.exe	114
PID 1384 wrote to memory of 2492	1384	Comdriver.exe	115
PID 1384 wrote to memory of 2492	1384	Comdriver.exe	115
PID 1384 wrote to memory of 3884	1384	Comdriver.exe	116
PID 1384 wrote to memory of 3884	1384	Comdriver.exe	116
PID 1384 wrote to memory of 2460	1384	Comdriver.exe	123
PID 1384 wrote to memory of 2460	1384	Comdriver.exe	123
PID 2460 wrote to memory of 3504	2460	cmd.exe	125
PID 2460 wrote to memory of 3504	2460	cmd.exe	125
PID 2460 wrote to memory of 2060	2460	cmd.exe	126
PID 2460 wrote to memory of 2060	2460	cmd.exe	126
PID 1152 wrote to memory of 4240	1152	chrome.exe	134
PID 1152 wrote to memory of 4240	1152	chrome.exe	134
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 4076	1152	chrome.exe	135
PID 1152 wrote to memory of 852	1152	chrome.exe	136
PID 1152 wrote to memory of 852	1152	chrome.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\hyperRuntimesvc\q9VsWbbXcPBkOcbGNH4WlDaW8.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\hyperRuntimesvc\2rM9PAG8U3HexeXFmUkMVgQvRWYnToD4m5.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\hyperRuntimesvc\Comdriver.exe
      "C:\hyperRuntimesvc/Comdriver.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j3ymganw\j3ymganw.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1484
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BE9.tmp" "c:\Windows\System32\CSC94D97F21DC5F464FA4F6DE87BC245422.TMP"
        6⤵
        
        PID:1008
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\Comdriver.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\hyperRuntimesvc\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\hyperRuntimesvc\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\hyperRuntimesvc\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\hyperRuntimesvc\Comdriver.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3884
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KQETegpUve.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2460
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3504
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2060
      - C:\hyperRuntimesvc\sysmon.exe
        
        "C:\hyperRuntimesvc\sysmon.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:464
        
        C:\Windows\System32\shutdown.exe
        
        "C:\Windows\System32\shutdown.exe"
        7⤵
        
        PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComdriverC" /sc MINUTE /mo 14 /tr "'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\Comdriver.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Comdriver" /sc ONLOGON /tr "'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\Comdriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComdriverC" /sc MINUTE /mo 5 /tr "'C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\Comdriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\hyperRuntimesvc\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\hyperRuntimesvc\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\hyperRuntimesvc\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\hyperRuntimesvc\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\hyperRuntimesvc\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\hyperRuntimesvc\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\hyperRuntimesvc\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\hyperRuntimesvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\hyperRuntimesvc\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender Advanced Threat Protection\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComdriverC" /sc MINUTE /mo 9 /tr "'C:\hyperRuntimesvc\Comdriver.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Comdriver" /sc ONLOGON /tr "'C:\hyperRuntimesvc\Comdriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ComdriverC" /sc MINUTE /mo 9 /tr "'C:\hyperRuntimesvc\Comdriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa143bcc40,0x7ffa143bcc4c,0x7ffa143bcc58
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2256 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4488,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4676,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4004 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4824,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5008,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5288,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5344,i,11526087272309804579,269375229012417414,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  PID:2060

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3184

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:68

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery