dcrat | 046bf975b725c82f7bb4b76cca785b0fb740b9d006c660cd96bc6ce7b70287d1

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Size

2.3MB
MD5

e15640ee50e585dc2d22e8034af222cb
SHA1

ae603bf050d70b779414bf2860ed6874fadecdeb
SHA256

046bf975b725c82f7bb4b76cca785b0fb740b9d006c660cd96bc6ce7b70287d1
SHA512

cac1d6eee85eebce728be7038cfffb2fc020013b425bd1413924ebe712b51ab02faa6be2d077a35b106a563bf9b1aecbd53b60604d2c6bb614b089399cb4ce38
SSDEEP

12288:5qnODPqBVA4VzeVeMvmw2b2iaNn0f7IF45i5ZwMr+FngnRtyS37WfGSindZTJiC6:5+O4GJvx75OgnRUSLHdFNz5kfe5f

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 9 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\hcproviders\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\hcproviders\\wininit.exe\", \"C:\\Windows\\System32\\XInput9_1_0\\spoolsv.exe\", \"C:\\Windows\\System32\\quser\\csrss.exe\", \"C:\\Windows\\System32\\perfh007\\lsass.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\hcproviders\\wininit.exe\", \"C:\\Windows\\System32\\XInput9_1_0\\spoolsv.exe\", \"C:\\Windows\\System32\\quser\\csrss.exe\", \"C:\\Windows\\System32\\perfh007\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\audiodg.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\hcproviders\\wininit.exe\", \"C:\\Windows\\System32\\XInput9_1_0\\spoolsv.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\hcproviders\\wininit.exe\", \"C:\\Windows\\System32\\XInput9_1_0\\spoolsv.exe\", \"C:\\Windows\\System32\\quser\\csrss.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\", \"C:\\Windows\\System32\\hidphone\\sppsvc.exe\", \"C:\\Documents and Settings\\wininit.exe\", \"C:\\Windows\\System32\\hcproviders\\wininit.exe\", \"C:\\Windows\\System32\\XInput9_1_0\\spoolsv.exe\", \"C:\\Windows\\System32\\quser\\csrss.exe\", \"C:\\Windows\\System32\\perfh007\\lsass.exe\", \"C:\\PerfLogs\\Admin\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2840	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	2840	schtasks.exe	30

Executes dropped EXE 1 IoCs

pid	Process
236	csrss.exe

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\hcproviders\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\audiodg.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Documents and Settings\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\PerfLogs\\Admin\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\audiodg.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\hcproviders\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\perfh007\\lsass.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\perfh007\\lsass.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\hidphone\\sppsvc.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\XInput9_1_0\\spoolsv.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Documents and Settings\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\XInput9_1_0\\spoolsv.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\quser\\csrss.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\quser\\csrss.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\PerfLogs\\Admin\\wininit.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Windows\\AppCompat\\Programs\\taskhost.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\System32\\hidphone\\sppsvc.exe\""	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\System32\hcproviders\wininit.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\hcproviders\560854153607923c4c5f107085a7db67be01f252	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File opened for modification	C:\Windows\System32\XInput9_1_0\spoolsv.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\XInput9_1_0\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\quser\csrss.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\quser\886983d96e3d3e31032c679b2d4ea91b6c05afef	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\hidphone\sppsvc.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\hidphone\0a1fd5f707cd16ea89afd3d6db52b2da58214a6c	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\XInput9_1_0\spoolsv.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\perfh007\lsass.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\System32\perfh007\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\audiodg.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\42af1c969fbb7b2ae36b0e06bea61fc9a154b4af	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\taskhost.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File opened for modification	C:\Windows\AppCompat\Programs\taskhost.exe	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
File created	C:\Windows\AppCompat\Programs\b75386f1303e64d8139363b71e44ac16341adf4e	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2764	schtasks.exe
1300	schtasks.exe
1652	schtasks.exe
1740	schtasks.exe
1720	schtasks.exe
2124	schtasks.exe
2888	schtasks.exe
2404	schtasks.exe
2228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1664	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
2724	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
2724	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
2724	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe
236	csrss.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Token: SeDebugPrivilege	2724	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
Token: SeDebugPrivilege	236	csrss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2724	1664	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe	35
PID 1664 wrote to memory of 2724	1664	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe	35
PID 1664 wrote to memory of 2724	1664	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe	35
PID 2724 wrote to memory of 1048	2724	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe	41
PID 2724 wrote to memory of 1048	2724	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe	41
PID 2724 wrote to memory of 1048	2724	JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe	41
PID 1048 wrote to memory of 944	1048	cmd.exe	43
PID 1048 wrote to memory of 944	1048	cmd.exe	43
PID 1048 wrote to memory of 944	1048	cmd.exe	43
PID 1048 wrote to memory of 236	1048	cmd.exe	44
PID 1048 wrote to memory of 236	1048	cmd.exe	44
PID 1048 wrote to memory of 236	1048	cmd.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e15640ee50e585dc2d22e8034af222cb.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\txN4VO9PZe.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:944
  - - C:\Windows\System32\quser\csrss.exe
      "C:\Windows\System32\quser\csrss.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\AppCompat\Programs\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\hidphone\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Documents and Settings\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\hcproviders\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\XInput9_1_0\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\quser\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\perfh007\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\PerfLogs\Admin\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\txN4VO9PZe.bat

Filesize
199B

MD5
6192d61bf0da59b94a6c53aa064f476f

SHA1
62a1b041ac2e0ec1d49d1e605a53e80a99462ebb

SHA256
e9fc9d1edd929f50e15fa012d42ec78fb50233688d457f560af6d6fe6f257a1c

SHA512
33dca49d4725421301aa810becc295c4766ce063a71a57f139a299921d639f817eeed758b62163852fb3afd02c61d3729f25168c1f9229b78cd4bf8c7bcf62d9

Download Submit
C:\Windows\System32\XInput9_1_0\spoolsv.exe

Filesize
2.3MB

MD5
e15640ee50e585dc2d22e8034af222cb

SHA1
ae603bf050d70b779414bf2860ed6874fadecdeb

SHA256
046bf975b725c82f7bb4b76cca785b0fb740b9d006c660cd96bc6ce7b70287d1

SHA512
cac1d6eee85eebce728be7038cfffb2fc020013b425bd1413924ebe712b51ab02faa6be2d077a35b106a563bf9b1aecbd53b60604d2c6bb614b089399cb4ce38

Download Submit
memory/236-29-0x0000000001310000-0x0000000001564000-memory.dmp

Filesize
2.3MB

Download
memory/236-30-0x00000000003D0000-0x00000000003DC000-memory.dmp

Filesize
48KB

Download
memory/236-31-0x00000000003E0000-0x00000000003EC000-memory.dmp

Filesize
48KB

Download
memory/236-32-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/236-33-0x0000000000480000-0x0000000000488000-memory.dmp

Filesize
32KB

Download
memory/236-34-0x00000000004E0000-0x00000000004EA000-memory.dmp

Filesize
40KB

Download
memory/1664-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/1664-1-0x0000000000130000-0x0000000000384000-memory.dmp

Filesize
2.3MB

Download
memory/1664-2-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/1664-11-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download