dcrat | 18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Size

827KB
MD5

c847a23633e81d799fba45bde7cc9951
SHA1

090035126cabb2fb574175c271097042025202de
SHA256

18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c
SHA512

6b057e15133fe58bc1d105a90b761d2f3558e8a8d3a901d9892905dd75f6be569a4bff4a02d919623305c4d524d96b7f902ef3dded6782cc237b1a47807f34bb
SSDEEP

12288:EP4wqKCH1Hq0nAwv+j49dkrI58NAyZixuj8zXcdFjfpdpoyqQ6Tz:ENdgHqBj49dkrIscuQwbrqQ6Tz

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 9 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\", \"C:\\Users\\Default\\dllhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\", \"C:\\Users\\Default\\dllhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\", \"C:\\Users\\Default\\dllhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\wininit.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\", \"C:\\Users\\Default\\dllhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\wininit.exe\", \"C:\\Users\\Admin\\RuntimeBroker.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\", \"C:\\Users\\Default\\dllhost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	3508	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	3508	schtasks.exe	84

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2060-1-0x0000000000520000-0x00000000005F6000-memory.dmp	dcrat
behavioral2/files/0x0007000000023c95-11.dat	dcrat

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 12 IoCs

pid	Process
2872	dllhost.exe
5064	dllhost.exe
1640	dllhost.exe
936	dllhost.exe
1496	dllhost.exe
1192	dllhost.exe
2432	dllhost.exe
4116	dllhost.exe
636	dllhost.exe
4308	dllhost.exe
2764	dllhost.exe
1036	dllhost.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153 = "\"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default\\dllhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\wininit.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\RuntimeBroker.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MusNotification = "\"C:\\Windows\\apppatch\\CustomSDB\\MusNotification.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153 = "\"C:\\Windows\\twain_32\\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default\\dllhost.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\wininit.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\RuntimeBroker.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
14	pastebin.com
15	pastebin.com
39	pastebin.com
41	pastebin.com
45	pastebin.com
53	pastebin.com
54	pastebin.com
26	pastebin.com
42	pastebin.com
46	pastebin.com
49	pastebin.com
55	pastebin.com
56	pastebin.com

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\56085415360792	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\6cb0b6c459d5d3	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6203df4a6bafc7	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\CustomSDB\MusNotification.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Windows\apppatch\CustomSDB\aa97147c4c782d	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Windows\twain_32\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
File created	C:\Windows\twain_32\9338bf98b9dae9	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3904	schtasks.exe
4852	schtasks.exe
2640	schtasks.exe
1640	schtasks.exe
3352	schtasks.exe
764	schtasks.exe
4656	schtasks.exe
2040	schtasks.exe
1636	schtasks.exe
2400	schtasks.exe
2860	schtasks.exe
3012	schtasks.exe
2996	schtasks.exe
3636	schtasks.exe
3716	schtasks.exe
1380	schtasks.exe
2140	schtasks.exe
2184	schtasks.exe
3640	schtasks.exe
2688	schtasks.exe
2360	schtasks.exe
2560	schtasks.exe
1084	schtasks.exe
3224	schtasks.exe
4988	schtasks.exe
2500	schtasks.exe
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2060	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
2060	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
2060	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
2872	dllhost.exe
5064	dllhost.exe
1640	dllhost.exe
936	dllhost.exe
1496	dllhost.exe
1192	dllhost.exe
2432	dllhost.exe
4116	dllhost.exe
636	dllhost.exe
4308	dllhost.exe
2764	dllhost.exe
1036	dllhost.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
Token: SeDebugPrivilege	2872	dllhost.exe
Token: SeDebugPrivilege	5064	dllhost.exe
Token: SeDebugPrivilege	1640	dllhost.exe
Token: SeDebugPrivilege	936	dllhost.exe
Token: SeDebugPrivilege	1496	dllhost.exe
Token: SeDebugPrivilege	1192	dllhost.exe
Token: SeDebugPrivilege	2432	dllhost.exe
Token: SeDebugPrivilege	4116	dllhost.exe
Token: SeDebugPrivilege	636	dllhost.exe
Token: SeDebugPrivilege	4308	dllhost.exe
Token: SeDebugPrivilege	2764	dllhost.exe
Token: SeDebugPrivilege	1036	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1352	2060	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe	112
PID 2060 wrote to memory of 1352	2060	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe	112
PID 1352 wrote to memory of 2284	1352	cmd.exe	114
PID 1352 wrote to memory of 2284	1352	cmd.exe	114
PID 1352 wrote to memory of 2872	1352	cmd.exe	116
PID 1352 wrote to memory of 2872	1352	cmd.exe	116
PID 2872 wrote to memory of 1192	2872	dllhost.exe	118
PID 2872 wrote to memory of 1192	2872	dllhost.exe	118
PID 1192 wrote to memory of 2856	1192	cmd.exe	120
PID 1192 wrote to memory of 2856	1192	cmd.exe	120
PID 1192 wrote to memory of 5064	1192	cmd.exe	127
PID 1192 wrote to memory of 5064	1192	cmd.exe	127
PID 5064 wrote to memory of 1148	5064	dllhost.exe	135
PID 5064 wrote to memory of 1148	5064	dllhost.exe	135
PID 1148 wrote to memory of 4468	1148	cmd.exe	137
PID 1148 wrote to memory of 4468	1148	cmd.exe	137
PID 1148 wrote to memory of 1640	1148	cmd.exe	141
PID 1148 wrote to memory of 1640	1148	cmd.exe	141
PID 1640 wrote to memory of 2988	1640	dllhost.exe	144
PID 1640 wrote to memory of 2988	1640	dllhost.exe	144
PID 2988 wrote to memory of 640	2988	cmd.exe	146
PID 2988 wrote to memory of 640	2988	cmd.exe	146
PID 2988 wrote to memory of 936	2988	cmd.exe	148
PID 2988 wrote to memory of 936	2988	cmd.exe	148
PID 936 wrote to memory of 4596	936	dllhost.exe	150
PID 936 wrote to memory of 4596	936	dllhost.exe	150
PID 4596 wrote to memory of 3416	4596	cmd.exe	152
PID 4596 wrote to memory of 3416	4596	cmd.exe	152
PID 4596 wrote to memory of 1496	4596	cmd.exe	154
PID 4596 wrote to memory of 1496	4596	cmd.exe	154
PID 1496 wrote to memory of 2068	1496	dllhost.exe	156
PID 1496 wrote to memory of 2068	1496	dllhost.exe	156
PID 2068 wrote to memory of 1644	2068	cmd.exe	158
PID 2068 wrote to memory of 1644	2068	cmd.exe	158
PID 2068 wrote to memory of 1192	2068	cmd.exe	160
PID 2068 wrote to memory of 1192	2068	cmd.exe	160
PID 1192 wrote to memory of 2144	1192	dllhost.exe	163
PID 1192 wrote to memory of 2144	1192	dllhost.exe	163
PID 2144 wrote to memory of 1088	2144	cmd.exe	165
PID 2144 wrote to memory of 1088	2144	cmd.exe	165
PID 2144 wrote to memory of 2432	2144	cmd.exe	167
PID 2144 wrote to memory of 2432	2144	cmd.exe	167
PID 2432 wrote to memory of 544	2432	dllhost.exe	169
PID 2432 wrote to memory of 544	2432	dllhost.exe	169
PID 544 wrote to memory of 4648	544	cmd.exe	171
PID 544 wrote to memory of 4648	544	cmd.exe	171
PID 544 wrote to memory of 4116	544	cmd.exe	173
PID 544 wrote to memory of 4116	544	cmd.exe	173
PID 4116 wrote to memory of 2096	4116	dllhost.exe	175
PID 4116 wrote to memory of 2096	4116	dllhost.exe	175
PID 2096 wrote to memory of 2380	2096	cmd.exe	177
PID 2096 wrote to memory of 2380	2096	cmd.exe	177
PID 2096 wrote to memory of 636	2096	cmd.exe	179
PID 2096 wrote to memory of 636	2096	cmd.exe	179
PID 636 wrote to memory of 3360	636	dllhost.exe	181
PID 636 wrote to memory of 3360	636	dllhost.exe	181
PID 3360 wrote to memory of 2592	3360	cmd.exe	183
PID 3360 wrote to memory of 2592	3360	cmd.exe	183
PID 3360 wrote to memory of 4308	3360	cmd.exe	185
PID 3360 wrote to memory of 4308	3360	cmd.exe	185
PID 4308 wrote to memory of 4336	4308	dllhost.exe	187
PID 4308 wrote to memory of 4336	4308	dllhost.exe	187
PID 4336 wrote to memory of 3336	4336	cmd.exe	189
PID 4336 wrote to memory of 3336	4336	cmd.exe	189

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe
"C:\Users\Admin\AppData\Local\Temp\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PtRiCkG3U7.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2284
- - C:\Users\Default\dllhost.exe
    "C:\Users\Default\dllhost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:2856
    - - C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4468
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:640
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3416
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1644
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1088
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4648
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2380
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:2592
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhzsSyDvNE.bat"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3336
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat"
        24⤵
        
        PID:4844
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2140
        
        C:\Users\Default\dllhost.exe
        
        "C:\Users\Default\dllhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat"
        26⤵
        
        PID:2712
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Windows\apppatch\CustomSDB\MusNotification.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Windows\apppatch\CustomSDB\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Windows\apppatch\CustomSDB\MusNotification.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d1531" /sc MINUTE /mo 10 /tr "'C:\Windows\twain_32\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153" /sc ONLOGON /tr "'C:\Windows\twain_32\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d1531" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Users\Default\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Default\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\0PvuKmrV6l.bat

Filesize
193B

MD5
2a386ec370f92c702422cae9a88d87e8

SHA1
dbacc2d17c28b6f37721dd9b84eeb161a122f7d2

SHA256
b018019eac9576b1ea180564ee2a25600d9c0179150dacea9589e7517691ba7c

SHA512
60cac69bd40689b080b3d7c2885a6e3d032838949a93287c9dc7bce83fe165f17acc459990a689f5a7f8df0158252884a7f044c0997eb3a1b1052a7cedb875ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat

Filesize
193B

MD5
ca04c1054831f03390b126f6ed460b57

SHA1
43f30e034cedf13225df2bc74e442481171a5b5a

SHA256
74a4c39520c02368c3099c3b02e3ca1239c7feb2d23f4f178fd20800f56848b7

SHA512
67eb2d0b75180f8107f0083be93d9f0cfc7599e12bbde3598018611e7ca691d2b375eb5b28dc679ca3b2806625d9e1d1ccef8036e0722b07f1ddfe50c9e404fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\5bc4V3lt5Q.bat

Filesize
193B

MD5
a6146b6e8b0785bec142486339c495c8

SHA1
b30dc72dbd0df5dbc1bf4b9a3d4b8ba85cbdce58

SHA256
07988e4427278b6ec1dcf674f1674ec5691c2cedeabfc397a71af81a52afc873

SHA512
ce148570cdf6f7cb82f1ec3010034020f1c846ffcb3614262594369dd855e130fa5964f8104cca1b56327c9bb2491c694e317902b6d10e18c712775e8ad8f178

Download Submit
C:\Users\Admin\AppData\Local\Temp\NADK710Kqv.bat

Filesize
193B

MD5
5f1b4c4db2835215a395ae3907b36eae

SHA1
a3f631a9932ed76af68c0fa8677337edc7b57218

SHA256
2fede38766fefa9091b64a8a2f3daac48a8529248568b62b26419ecc7009ccca

SHA512
83548d4117f4fce59cde9afe867c9c3408bf13180262a1e831ff2c6f57c843eeb80afd8ea9c5c35f7aa07dca6fadb4b126908625e9dac1bdaf17e3dcea560fab

Download Submit
C:\Users\Admin\AppData\Local\Temp\PtRiCkG3U7.bat

Filesize
193B

MD5
dd3c375f780a57c8ecffbc50ea113045

SHA1
d8456fc9c15ac7fcbba7cc37d7b6bcb7760c60c1

SHA256
9b0572d297d0a5fb2f51314591869492775f319e16d6e596321e3dda9ff9d141

SHA512
c5923d0366e9d967039f8db69c84de1fbe02f6a3517b6e5540e89db98bcd7f019c435b7ca881d562e4a37061d28eacbc6c11346fcc58363bdef673035dbc2fce

Download Submit
C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat

Filesize
193B

MD5
7eba4ba23c07d6ad5d38cd276475f047

SHA1
d133501fd43c5cb26ad06d3f5090bdad99fa1869

SHA256
745bbf60ba972bfa51fd65f3ab69642779259bf9f0b1481bbbb128f15d56056b

SHA512
41b4028a3522f3260a002b8543dfec50da55a691a65c943351b42e4ba6e9d4a0fc3de57b981ed86891399c98c0ec1512d6dd864e51572b496bcb76fb571cf97a

Download Submit
C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat

Filesize
193B

MD5
1678ca2601700e13a9afc11be5734125

SHA1
1f792d154e8c83663f2dcdc8cdf07172660e612a

SHA256
40663a7c36f13720eed9cf37bd7d4a584dd7367881ca91bac979c089539709d1

SHA512
8373c95e123b9e41ea22cc4c497ce884834827a8b5517aa8153c5ec3ea9efa8eb536f373b43de54f8ab366eaf718095d8cde1261e51ba62be9dacfe95cd4bd98

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3FUfZROOv.bat

Filesize
193B

MD5
0d5cd3d89fc8dd19d02d0af5305956af

SHA1
beb87538bddd59660eb9f2de7b13b34eddb265c8

SHA256
00cdc85029b233e7f0a694d5fe391073614a57681c5e4741aaedcf6a03ef1950

SHA512
e67d642aafb8d57ddd425c83cd9efacb9959f5dca76add4959d7242d856e61a0fdd6edab067e482ae1995c7b42461f5a48c1e64b63f7440bea45263113cb0015

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat

Filesize
193B

MD5
47953f48b8cb53120c16c20b5721050a

SHA1
b795c6bfacb8dddf473245319e1017d34d8481ca

SHA256
a590652acd9825a0869b7ce4c71a1e522cf04964b573053c6a5e11411e3b76cb

SHA512
f0a46516e3f7b6463d9e54094e65c90af97ed7793187572fe0abf4a436ca3e0d0e656c576c5adcb96b88bdf3bb29f5995ab4a7180bc7920313a1e430cd1c2bed

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat

Filesize
193B

MD5
caaed34b4add015b8e05aa4874360149

SHA1
2d547fd87fb0516e0a0796b1481eaaf7bc391de9

SHA256
96152d577e4a63c2991c8874db7e9efb933772eaf5b22f20a26e73c4ae6c350a

SHA512
49b8401dfde47d0103a7123fbfedeb9767874081a0cbf21540e3fcd025af752580e52bb5904065b1b91c01bbc80f347c7a6dbb4892397a988800b805c46d1ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhzsSyDvNE.bat

Filesize
193B

MD5
b50a32984854f00adb6240a944ddd4f7

SHA1
81d55ed10ee65f9e8941bac1557e620933a864e4

SHA256
ddce7e507b78d1ced30476017bb680fb29e745453dd1047ed067e7ba3d173b3b

SHA512
e8eda85d79ab19379b617a8cf9055d5eb85252bc21142fdbefc193df7d39f77a9e05a7b659d80caaa7f8bfee4b4a87d339cccc3a53f1ac3df6ff1d1191bccdb3

Download Submit
C:\Users\Default\dllhost.exe

Filesize
827KB

MD5
c847a23633e81d799fba45bde7cc9951

SHA1
090035126cabb2fb574175c271097042025202de

SHA256
18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d15367377a7b942c259319c

SHA512
6b057e15133fe58bc1d105a90b761d2f3558e8a8d3a901d9892905dd75f6be569a4bff4a02d919623305c4d524d96b7f902ef3dded6782cc237b1a47807f34bb

Download Submit
memory/2060-0-0x00007FF909AE3000-0x00007FF909AE5000-memory.dmp

Filesize
8KB

Download
memory/2060-26-0x00007FF909AE0000-0x00007FF90A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/2060-2-0x00007FF909AE0000-0x00007FF90A5A1000-memory.dmp

Filesize
10.8MB

Download
memory/2060-1-0x0000000000520000-0x00000000005F6000-memory.dmp

Filesize
856KB

Download