dcrat | 3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Size

1.9MB
MD5

6b9554367a439d39a00a0dff9a08b123
SHA1

e1d22cde90c297c10f4fcba5b3980e5d551eb0b3
SHA256

3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9
SHA512

72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720
SSDEEP

49152:xh0kcmcdp/caMMlawkBXRInaKYRouPbWGQ2:xhbcmcfM/N1RSavoujWH

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\My Documents\\lsass.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\WmiPrvSE.exe\", \"C:\\Windows\\PLA\\Reports\\de-DE\\services.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\My Documents\\lsass.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\WmiPrvSE.exe\", \"C:\\Windows\\PLA\\Reports\\de-DE\\services.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\My Documents\\lsass.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\My Documents\\lsass.exe\", \"C:\\Users\\Default User\\lsm.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\My Documents\\lsass.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Users\\Default User\\taskhost.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\My Documents\\lsass.exe\", \"C:\\Users\\Default User\\lsm.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\WmiPrvSE.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	588	2600	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	2600	schtasks.exe	30

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2172	powershell.exe
576	powershell.exe
2180	powershell.exe
1812	powershell.exe
1768	powershell.exe
2312	powershell.exe

Executes dropped EXE 12 IoCs

pid	Process
1420	taskhost.exe
2564	taskhost.exe
2364	taskhost.exe
2712	taskhost.exe
1368	taskhost.exe
2780	taskhost.exe
1240	taskhost.exe
1772	taskhost.exe
2516	taskhost.exe
832	taskhost.exe
1644	taskhost.exe
2768	taskhost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default User\\lsm.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Portable Devices\\WmiPrvSE.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\PLA\\Reports\\de-DE\\services.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\PLA\\Reports\\de-DE\\services.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\My Documents\\lsass.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Default\\My Documents\\lsass.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Default User\\lsm.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files (x86)\\Windows Portable Devices\\WmiPrvSE.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCF260ED584ADA4ACFA5137ACE8046D3DC.TMP	csc.exe
File created	\??\c:\Windows\System32\byyuy-.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
File created	C:\Program Files (x86)\Windows Portable Devices\24dbde2999530e	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PLA\Reports\de-DE\services.exe	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
File created	C:\Windows\PLA\Reports\de-DE\c5b4cb5e9653cc	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
File created	C:\Windows\PLA\Reports\de-DE\services.exe	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3028	PING.EXE
2924	PING.EXE
1108	PING.EXE
1152	PING.EXE
2180	PING.EXE
2248	PING.EXE
2756	PING.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
1108	PING.EXE
1152	PING.EXE
2180	PING.EXE
2248	PING.EXE
2756	PING.EXE
3028	PING.EXE
2924	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
404	schtasks.exe
2968	schtasks.exe
2916	schtasks.exe
2596	schtasks.exe
2620	schtasks.exe
2160	schtasks.exe
588	schtasks.exe
2564	schtasks.exe
1176	schtasks.exe
2864	schtasks.exe
2748	schtasks.exe
2136	schtasks.exe
480	schtasks.exe
2320	schtasks.exe
2364	schtasks.exe
2380	schtasks.exe
796	schtasks.exe
1664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	1420	taskhost.exe
Token: SeDebugPrivilege	2564	taskhost.exe
Token: SeDebugPrivilege	2364	taskhost.exe
Token: SeDebugPrivilege	2712	taskhost.exe
Token: SeDebugPrivilege	1368	taskhost.exe
Token: SeDebugPrivilege	2780	taskhost.exe
Token: SeDebugPrivilege	1240	taskhost.exe
Token: SeDebugPrivilege	1772	taskhost.exe
Token: SeDebugPrivilege	2516	taskhost.exe
Token: SeDebugPrivilege	832	taskhost.exe
Token: SeDebugPrivilege	1644	taskhost.exe
Token: SeDebugPrivilege	2768	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3020	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	34
PID 2092 wrote to memory of 3020	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	34
PID 2092 wrote to memory of 3020	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	34
PID 3020 wrote to memory of 2900	3020	csc.exe	36
PID 3020 wrote to memory of 2900	3020	csc.exe	36
PID 3020 wrote to memory of 2900	3020	csc.exe	36
PID 2092 wrote to memory of 576	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	52
PID 2092 wrote to memory of 576	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	52
PID 2092 wrote to memory of 576	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	52
PID 2092 wrote to memory of 2180	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	53
PID 2092 wrote to memory of 2180	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	53
PID 2092 wrote to memory of 2180	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	53
PID 2092 wrote to memory of 1812	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	54
PID 2092 wrote to memory of 1812	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	54
PID 2092 wrote to memory of 1812	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	54
PID 2092 wrote to memory of 1768	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	55
PID 2092 wrote to memory of 1768	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	55
PID 2092 wrote to memory of 1768	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	55
PID 2092 wrote to memory of 2312	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	56
PID 2092 wrote to memory of 2312	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	56
PID 2092 wrote to memory of 2312	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	56
PID 2092 wrote to memory of 2172	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	57
PID 2092 wrote to memory of 2172	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	57
PID 2092 wrote to memory of 2172	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	57
PID 2092 wrote to memory of 2980	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	64
PID 2092 wrote to memory of 2980	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	64
PID 2092 wrote to memory of 2980	2092	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	64
PID 2980 wrote to memory of 1932	2980	cmd.exe	66
PID 2980 wrote to memory of 1932	2980	cmd.exe	66
PID 2980 wrote to memory of 1932	2980	cmd.exe	66
PID 2980 wrote to memory of 1152	2980	cmd.exe	67
PID 2980 wrote to memory of 1152	2980	cmd.exe	67
PID 2980 wrote to memory of 1152	2980	cmd.exe	67
PID 2980 wrote to memory of 1420	2980	cmd.exe	68
PID 2980 wrote to memory of 1420	2980	cmd.exe	68
PID 2980 wrote to memory of 1420	2980	cmd.exe	68
PID 1420 wrote to memory of 2648	1420	taskhost.exe	69
PID 1420 wrote to memory of 2648	1420	taskhost.exe	69
PID 1420 wrote to memory of 2648	1420	taskhost.exe	69
PID 2648 wrote to memory of 3036	2648	cmd.exe	71
PID 2648 wrote to memory of 3036	2648	cmd.exe	71
PID 2648 wrote to memory of 3036	2648	cmd.exe	71
PID 2648 wrote to memory of 3028	2648	cmd.exe	72
PID 2648 wrote to memory of 3028	2648	cmd.exe	72
PID 2648 wrote to memory of 3028	2648	cmd.exe	72
PID 2648 wrote to memory of 2564	2648	cmd.exe	73
PID 2648 wrote to memory of 2564	2648	cmd.exe	73
PID 2648 wrote to memory of 2564	2648	cmd.exe	73
PID 2564 wrote to memory of 2224	2564	taskhost.exe	74
PID 2564 wrote to memory of 2224	2564	taskhost.exe	74
PID 2564 wrote to memory of 2224	2564	taskhost.exe	74
PID 2224 wrote to memory of 2112	2224	cmd.exe	76
PID 2224 wrote to memory of 2112	2224	cmd.exe	76
PID 2224 wrote to memory of 2112	2224	cmd.exe	76
PID 2224 wrote to memory of 2924	2224	cmd.exe	77
PID 2224 wrote to memory of 2924	2224	cmd.exe	77
PID 2224 wrote to memory of 2924	2224	cmd.exe	77
PID 2224 wrote to memory of 2364	2224	cmd.exe	78
PID 2224 wrote to memory of 2364	2224	cmd.exe	78
PID 2224 wrote to memory of 2364	2224	cmd.exe	78
PID 2364 wrote to memory of 2392	2364	taskhost.exe	79
PID 2364 wrote to memory of 2392	2364	taskhost.exe	79
PID 2364 wrote to memory of 2392	2364	taskhost.exe	79
PID 2392 wrote to memory of 2108	2392	cmd.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
"C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\voifkq2x\voifkq2x.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54F3.tmp" "c:\Windows\System32\CSCF260ED584ADA4ACFA5137ACE8046D3DC.TMP"
    3⤵
    PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Reports\de-DE\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VSMTUpgh7N.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1932
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:1152
- - C:\Users\Default User\taskhost.exe
    "C:\Users\Default User\taskhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DDMAhpLx8D.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3036
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3028
    - - C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2564
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9LyY97a2AO.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2112
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2924
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wV103PPj9V.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1108
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A9s0LWASh3.bat"
        10⤵
        
        PID:1540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:596
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:2168
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Styje6hwPL.bat"
        12⤵
        
        PID:1580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:884
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1152
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2780
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Y182dPLPTa.bat"
        14⤵
        
        PID:2940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2588
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UCvjmtCiY3.bat"
        16⤵
        
        PID:924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2732
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mw0T6TjCGL.bat"
        18⤵
        
        PID:1040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:1032
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yPEeb07IgF.bat"
        20⤵
        
        PID:2328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:1516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2180
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NxeDi3jWef.bat"
        22⤵
        
        PID:3052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:2416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2248
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat"
        24⤵
        
        PID:3016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:2672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2756
        
        C:\Users\Default User\taskhost.exe
        
        "C:\Users\Default User\taskhost.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\My Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Default\My Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\Reports\de-DE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\PLA\Reports\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\Reports\de-DE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a93" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a93" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9LyY97a2AO.bat

Filesize
162B

MD5
6bdd06bb840f0e89284a79cbbf33aa7d

SHA1
145a43fd5645072a508b4402911f4776aef3b299

SHA256
c544a2058ae65724247b503e79c06dd513054a51081217816ba2c891a5bcd43c

SHA512
521bff0e8302e997aa1f45735afea7991b55b38ba1df184e4d21dd1ed07fc8ad31a8f3f44b77160ea446dcc48838538e8850b993469ca531d02d2057523bc3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\A9s0LWASh3.bat

Filesize
210B

MD5
b447d42efd4435c41256a2372eb52801

SHA1
45007cc7fbf4ce02261d84dc092e903fbcdd7116

SHA256
8307971d9084f3062fc8e763ff203d213fa09fc315610ac8c1cd25fe245f0d9e

SHA512
cd4aac7fdcd4bc2e29cda123e2d565549d67922ba3c748afd65810d8d110f68bbaca6eefc088fdc4ea89593f8a30fbc593489d94987c11a5e82469d3b79defd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat

Filesize
162B

MD5
ac5f725b5694d9768d3525145512d5ad

SHA1
91a8b6ddfa25a244c64de1af6bb012c33d56f99d

SHA256
7d188c1861fbc00f5feffc44e90b279282dd85cb51760b76c4e7bf95344f8695

SHA512
b0f947de09cce11ae9150cb1abba23ffa0b0c5b575534d405d137e060b4b960a8bfdd73b880205196991ae198d4ad64ce9edc380e0142ec00dc61b3a8506df24

Download Submit
C:\Users\Admin\AppData\Local\Temp\DDMAhpLx8D.bat

Filesize
162B

MD5
83fc62ab421b7cdf2d5f47a1e891fc47

SHA1
46c2b80d1227828a8474b9c1c463169791f82b27

SHA256
1549da7d0ff415e68106e165e175bdd83aea7399858fe09ba24f1f45abfd68ec

SHA512
e72794ab11882d4d06a80ce0a805b051ca63888c06115b7f5d30794136579c9e1a89cb2a796f879800a15eba97541c0b12b9d3c372381ec17f30bc8001ae7fb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\NxeDi3jWef.bat

Filesize
162B

MD5
eaca46c41cb705a6fe7d59202a0606b9

SHA1
6f459a25ba8cca162931750927f7b8dec18b705f

SHA256
0aa6be63881b668d78f4ba5650aa48fe93bb794644bae4f1299727143438ed43

SHA512
bf0e384d9d64cb9003bf4f8ce58bd6b048498a4d7a7ea177c9bc1c951a5d684db89983cd428338a6248e4822a157ffee3bbf8a9c382e4920594dac70c7fc1f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES54F3.tmp

Filesize
1KB

MD5
f3b1458b9b4dd68fdc360a9cf087f55f

SHA1
c2efa60722f30f2ae50c86196882bba9806c3d47

SHA256
b3b93fdbc632fcbb930e6fc820a7ae6057dae515adbe20e4ea3f49bab1abf4b6

SHA512
48fa0771317a79db0b437eca37c4b6c0d1f4dcc9229af5ffe1c9beaf552b7028b9a8b2395c94b25530a0e530a3042d8c7776db3c940f09d1383a1aaaee226755

Download Submit
C:\Users\Admin\AppData\Local\Temp\Styje6hwPL.bat

Filesize
162B

MD5
821be9640bdc0f1979a3107d66c4ecc0

SHA1
1b53fcc774dfc862fb18e60b1da4559a13ffe5b6

SHA256
725dfa416cf2106241abd24faead415f050ffcfe47591e53d8c0a951b1bc3b82

SHA512
a4f14fe8ed2f0c55940434f4935ba7458988f99a5bde0ab325bc2cbb9693187678ee3fd82a4f98a21927e22526547dc98ba9c62d5951c300a0c5bb6282ee4090

Download Submit
C:\Users\Admin\AppData\Local\Temp\UCvjmtCiY3.bat

Filesize
210B

MD5
8abccc0566567ab28024dcb235e4e2d9

SHA1
df78f7cacf527a026ee832f26c84816e571878f8

SHA256
94c2e6bbdb2b34ebacf39d9dbad32d415ae35602a233ed405c8aa3ece2869208

SHA512
2e3c00ec786db6d30b0ff189829b37c0d6ef78b824bcd46a41cc6a0f261ea51a8a53779b58c9fad65ae5deac12b5181affddee015b718e7f5a949b1623b3010f

Download Submit
C:\Users\Admin\AppData\Local\Temp\VSMTUpgh7N.bat

Filesize
210B

MD5
70fd8960dc23c61b5fe473c9baf781b2

SHA1
bb01ca5cf5983268b07b38162bd190c20f21d843

SHA256
0eafc4e0cc2f6b7aa28c6b77660dd57f882162d966defcd8f71c796ab4b9bdb8

SHA512
11402a65354b55e2be093387fc5cbae3d71c0fee0fa2f879a8aa88850cba81b5efd28be56c1ae82dd4fd6861a7cb4e653e55161253706333e348aa87c55319cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y182dPLPTa.bat

Filesize
210B

MD5
0881f9eb6a67e3342c715af057858796

SHA1
c0ce37797445fbc034e354364ad021ae75a8870c

SHA256
ea0db1113b3c2ba3116cfb377deef8c01e05c1c84fc18f5783c897f0b4c63fe6

SHA512
c2e9edef8494bc73193e8ee13c7d9474d16c01a9bc362670bb8c7631f5c15052610d340eacf286814b877d4b32c50cbd638962a3b1b29ffec2b8bf0f741ffe86

Download Submit
C:\Users\Admin\AppData\Local\Temp\mw0T6TjCGL.bat

Filesize
210B

MD5
1599839f2f34ae8a5361039e270c45e7

SHA1
2e29aa440feb0e28c491866b9f7a997acfcf4af9

SHA256
d93bf6dfa7cdaebfd4d210015bfc42aa8e1d9f30312d7c28f42dc02e51c388c8

SHA512
9a514f13cd111f005c057d80adba352cd7d337346f67f075738d21eb06a119d202e7399de4f25bd0bdaf60817f3081e12f124c7aa835a4b81c61d99de7d13565

Download Submit
C:\Users\Admin\AppData\Local\Temp\wV103PPj9V.bat

Filesize
162B

MD5
dc22c79a510dbfdc2e21ef17193b3a64

SHA1
6afaebd24bb7e69065b81f34d2e20974798799de

SHA256
edc67589ade99e56cd82a1b8d29e9013529dfbee40bcebbae7ea444f159b3d7c

SHA512
0826cc56f3e2332f0fdd2f151b6598acae89b7f58f49164923f4a8c5a2ad7a7c002d6d444f9e0b1748298b5c587f36021d5efa5d2f9dda084a72f6b9b5b0f37e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yPEeb07IgF.bat

Filesize
162B

MD5
ce858940cc2d0c9392e304d6034c7c30

SHA1
01891df9696498e41317fefc6317e008c94fb855

SHA256
fe3012a968898162e9f7b51b5ac3583e53ea3fda1554ab694e83863a24eda3ce

SHA512
b4ca5a78fa16457834800768b8b86a20102f85a77ba84c8b580798efc86638e2d5f32f8e9772d98ff91fc43526fb327d424134727297a75bd1f59aad5f78e0c1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0IKF1M3JKUIG59VIPO9Y.temp

Filesize
7KB

MD5
ee1dcdc88cb65d65b77eef1733db9df5

SHA1
e1262a98ee4960a3dff8727d6dff81ff6d73715e

SHA256
29e34c405ddbd6749f3c5423e748fa3fc494a9db4eeaf6cee5dc9a1969e9e616

SHA512
fb3d0fa0ce1d513c18c19021a16d2bfd5a392f0fd2dfa2e6ab66f33d7b895a9df5f6328b8ac5902f84ae88f416687087fd8a631d45e53b51cd922ca2c0981080

Download Submit
C:\Users\Default\Documents\lsass.exe

Filesize
1.9MB

MD5
6b9554367a439d39a00a0dff9a08b123

SHA1
e1d22cde90c297c10f4fcba5b3980e5d551eb0b3

SHA256
3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

SHA512
72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\voifkq2x\voifkq2x.0.cs

Filesize
371B

MD5
aa1c575bf60d4e7a61d35a15a23bd0a0

SHA1
8b6e7d9e54365e0ab21a5755fb065acc87240ba2

SHA256
dda805a62f70bf673bc3a2c2b2832a9cf60ff8c5ff4dad627b74372cfe2d01b9

SHA512
b17f1a248c684944acc2f9b677ea41457162fa3f00bfc6e6cc482cac6d63ab37643a9456f9ff45a4a695da26659c8ea0713a829f1288826c1d8ea35391f1d5ed

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\voifkq2x\voifkq2x.cmdline

Filesize
235B

MD5
fe4b6038adce4e028faa6d84423c448c

SHA1
83f828e698740d7715c8f89d681a68186cdcd2b0

SHA256
56db6850e59057d9b1a0723f5cf84dc26e7a0437023f82411af03ec32f1541e4

SHA512
6771701bc7267ae71b28f6be89799afc9c246eca8bb9c89bf7a8133829b1a65b9c9a1e6525bf1f123977acbea2adfdef043a50f8580c2be9763096907dae55db

Download Submit
\??\c:\Windows\System32\CSCF260ED584ADA4ACFA5137ACE8046D3DC.TMP

Filesize
1KB

MD5
078586b266e519b5c113064d7a0bf45c

SHA1
a9395c0ef35add5c75591ebb94c85c1f33f408bf

SHA256
ccf292ff9f142b204ad4f4481a044ba8f9ab274305dcb604bf0b8ae91819ab1e

SHA512
5b8eb6aad62657309088c4668d633c2aa6324d4824ec32c3c5e133df0a5493a4342c980e077ba565f3aab29c58f95c8db7195415a1e554384405c1457730f959

Download Submit
memory/1240-171-0x0000000001230000-0x0000000001424000-memory.dmp

Filesize
2.0MB

Download
memory/1420-87-0x0000000000FD0000-0x00000000011C4000-memory.dmp

Filesize
2.0MB

Download
memory/1812-63-0x0000000002780000-0x0000000002788000-memory.dmp

Filesize
32KB

Download
memory/1812-62-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/2092-34-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-12-0x0000000000A10000-0x0000000000A28000-memory.dmp

Filesize
96KB

Download
memory/2092-61-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-18-0x0000000000AB0000-0x0000000000ABE000-memory.dmp

Filesize
56KB

Download
memory/2092-20-0x0000000000AC0000-0x0000000000ACC000-memory.dmp

Filesize
48KB

Download
memory/2092-3-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-16-0x00000000009E0000-0x00000000009EC000-memory.dmp

Filesize
48KB

Download
memory/2092-21-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-35-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-14-0x00000000009D0000-0x00000000009DC000-memory.dmp

Filesize
48KB

Download
memory/2092-4-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-0-0x000007FEF5DF3000-0x000007FEF5DF4000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x0000000001280000-0x0000000001474000-memory.dmp

Filesize
2.0MB

Download
memory/2092-10-0x00000000009F0000-0x0000000000A0C000-memory.dmp

Filesize
112KB

Download
memory/2092-8-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/2092-2-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-6-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-22-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-5-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-116-0x00000000009B0000-0x0000000000BA4000-memory.dmp

Filesize
2.0MB

Download
memory/2516-198-0x0000000001360000-0x0000000001554000-memory.dmp

Filesize
2.0MB

Download
memory/2564-101-0x00000000000B0000-0x00000000002A4000-memory.dmp

Filesize
2.0MB

Download
memory/2712-130-0x0000000000FC0000-0x00000000011B4000-memory.dmp

Filesize
2.0MB

Download
memory/2768-238-0x0000000000050000-0x0000000000244000-memory.dmp

Filesize
2.0MB

Download
memory/2780-157-0x0000000001000000-0x00000000011F4000-memory.dmp

Filesize
2.0MB

Download