dcrat | 75e9a0ab3a75f42cdae23e971e2f34f447aeed1bc9b0adf11d47cd2dc04a0835

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c76e7dcc8ae18ed5107083568de5c15.exe
Size

2.2MB
MD5

8c76e7dcc8ae18ed5107083568de5c15
SHA1

b229653c55b499475dc90fd7f517dad0ddf83afa
SHA256

75e9a0ab3a75f42cdae23e971e2f34f447aeed1bc9b0adf11d47cd2dc04a0835
SHA512

bb1d47f24fe11a598c85ad3204bf272be66763d20b880996f68f06b0623aa7d823af44a60722977e539f8a80fab1bd9fd8866da0ffc72251d91aa38603ed12bb
SSDEEP

49152:a31tZUmbFNH1wLJDPqTo9lIS/MXU2F4/1l5eQ7K6:altZUE6NDyTo9lv2F+VvK6

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\csrss.exe\""	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Media Player\\Skins\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	8c76e7dcc8ae18ed5107083568de5c15.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	2036	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	2036	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2036	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2036	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	2036	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	2036	schtasks.exe	83

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2068-1-0x0000000000270000-0x000000000049E000-memory.dmp	dcrat
behavioral2/files/0x0008000000023cb1-46.dat	dcrat
behavioral2/files/0x0008000000023cbd-62.dat	dcrat
behavioral2/memory/1544-126-0x0000000000740000-0x000000000096E000-memory.dmp	dcrat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	8c76e7dcc8ae18ed5107083568de5c15.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	8c76e7dcc8ae18ed5107083568de5c15.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 3 IoCs

pid	Process
1544	fontdrvhost.exe
1624	fontdrvhost.exe
4800	fontdrvhost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Media Player\\Skins\\csrss.exe\""	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files\\Windows Media Player\\Skins\\csrss.exe\""	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\""	8c76e7dcc8ae18ed5107083568de5c15.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c76e7dcc8ae18ed5107083568de5c15.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\Skins\csrss.exe	8c76e7dcc8ae18ed5107083568de5c15.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\csrss.exe	8c76e7dcc8ae18ed5107083568de5c15.exe
File created	C:\Program Files\Windows Media Player\Skins\886983d96e3d3e	8c76e7dcc8ae18ed5107083568de5c15.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\RCXB940.tmp	8c76e7dcc8ae18ed5107083568de5c15.exe
File opened for modification	C:\Program Files\Windows Media Player\Skins\RCXB950.tmp	8c76e7dcc8ae18ed5107083568de5c15.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	8c76e7dcc8ae18ed5107083568de5c15.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3948	schtasks.exe
5004	schtasks.exe
2392	schtasks.exe
3028	schtasks.exe
3608	schtasks.exe
5052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
2068	8c76e7dcc8ae18ed5107083568de5c15.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe
1544	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	8c76e7dcc8ae18ed5107083568de5c15.exe
Token: SeDebugPrivilege	1544	fontdrvhost.exe
Token: SeDebugPrivilege	1624	fontdrvhost.exe
Token: SeDebugPrivilege	4800	fontdrvhost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1544	2068	8c76e7dcc8ae18ed5107083568de5c15.exe	90
PID 2068 wrote to memory of 1544	2068	8c76e7dcc8ae18ed5107083568de5c15.exe	90
PID 1544 wrote to memory of 4220	1544	fontdrvhost.exe	92
PID 1544 wrote to memory of 4220	1544	fontdrvhost.exe	92
PID 1544 wrote to memory of 4112	1544	fontdrvhost.exe	93
PID 1544 wrote to memory of 4112	1544	fontdrvhost.exe	93
PID 4220 wrote to memory of 1624	4220	WScript.exe	110
PID 4220 wrote to memory of 1624	4220	WScript.exe	110
PID 1624 wrote to memory of 2948	1624	fontdrvhost.exe	112
PID 1624 wrote to memory of 2948	1624	fontdrvhost.exe	112
PID 1624 wrote to memory of 2812	1624	fontdrvhost.exe	113
PID 1624 wrote to memory of 2812	1624	fontdrvhost.exe	113
PID 2948 wrote to memory of 4800	2948	WScript.exe	116
PID 2948 wrote to memory of 4800	2948	WScript.exe	116
PID 4800 wrote to memory of 3916	4800	fontdrvhost.exe	118
PID 4800 wrote to memory of 3916	4800	fontdrvhost.exe	118
PID 4800 wrote to memory of 1836	4800	fontdrvhost.exe	119
PID 4800 wrote to memory of 1836	4800	fontdrvhost.exe	119

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c76e7dcc8ae18ed5107083568de5c15.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	8c76e7dcc8ae18ed5107083568de5c15.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c76e7dcc8ae18ed5107083568de5c15.exe
"C:\Users\Admin\AppData\Local\Temp\8c76e7dcc8ae18ed5107083568de5c15.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2068
- C:\Recovery\WindowsRE\fontdrvhost.exe
  "C:\Recovery\WindowsRE\fontdrvhost.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\461d9418-fc22-469b-b3bf-cf1d675ebcc5.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Recovery\WindowsRE\fontdrvhost.exe
      C:\Recovery\WindowsRE\fontdrvhost.exe
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1624
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c99ffd89-025b-4601-ad53-8438dbaaf5cb.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Recovery\WindowsRE\fontdrvhost.exe
        
        C:\Recovery\WindowsRE\fontdrvhost.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14797c6d-3dcf-4c9b-922e-d349f5dccbe5.vbs"
        7⤵
        
        PID:3916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\911f2729-4b9e-43a8-bcc6-569ebe1acd5c.vbs"
        7⤵
        
        PID:1836
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\331a95c9-6645-41a3-b9d7-37034e194c46.vbs"
        5⤵
        
        PID:2812
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38a2705c-3b88-4ed4-ad0a-4826633ce3e3.vbs"
    3⤵
    PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Skins\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Skins\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Media Player\Skins\csrss.exe

Filesize
2.2MB

MD5
8c76e7dcc8ae18ed5107083568de5c15

SHA1
b229653c55b499475dc90fd7f517dad0ddf83afa

SHA256
75e9a0ab3a75f42cdae23e971e2f34f447aeed1bc9b0adf11d47cd2dc04a0835

SHA512
bb1d47f24fe11a598c85ad3204bf272be66763d20b880996f68f06b0623aa7d823af44a60722977e539f8a80fab1bd9fd8866da0ffc72251d91aa38603ed12bb

Download Submit
C:\Recovery\WindowsRE\RCXBB66.tmp

Filesize
2.2MB

MD5
5d3af89d022a5254fb73160a9344c5cd

SHA1
29f80f28bc8a1f30f4377dbb9041605aff4fd484

SHA256
6342eadbd0350c42bc903b36487794cfc554a0e94ea389633942c1de23af862e

SHA512
740f213116b9fd1dac7193211bb370077cc0568fb944a3c80c050703ac0cf58064b7bc6acd1e5b34f9e5e27ee9b5a24403e000d76de2d89c1a2a6df88b7ebd80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
49b64127208271d8f797256057d0b006

SHA1
b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

SHA256
2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

SHA512
f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\14797c6d-3dcf-4c9b-922e-d349f5dccbe5.vbs

Filesize
713B

MD5
9c99f1e52de9e1aa519a736570246698

SHA1
eeb6ec986c2faba2c29a2c5052ddebc955b7bdbe

SHA256
9ac65f925aa7910c9019a94678e2619da8fb3edc18e7af6705d0c570f012631c

SHA512
f5a0589908fb909cf280c39f1d659967dbca0f972084e61161bfc6d8f973939d538375b42ccae38a3be86e690d65717f2d8a8686b248d68e7bffe2ff3398d2b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\15b9a34cfa2b5bc62b364baa451689cb4d5a0ef5.exe

Filesize
2.2MB

MD5
7417c9c6e8452047bda137edbccf352c

SHA1
d735aa0b76988b998c889a3c3d44274931677ca7

SHA256
298abec084a8ac0e200108ceea946e456791c6d6fcbed642cb9c3a18227ba04f

SHA512
f208e443bd53fbaec502465dcbe4feeaa4377434d980558868ec8fc1028d92889ca621bdc7d9261d70a5cbbfc87b76981419494c37dfef40d56e2c5b8f336db1

Download Submit
C:\Users\Admin\AppData\Local\Temp\38a2705c-3b88-4ed4-ad0a-4826633ce3e3.vbs

Filesize
489B

MD5
ec61995df511003b2f75d6c30a853b09

SHA1
38c54c90a336723905a3ea7f7e61fe962fbca44d

SHA256
5a1e553059ee49723f22e06fcb081aa2561cbd048e03915d81c129d2a67e8e48

SHA512
465fa24bab6d4b50e76f9205f4238be171a0999388bed4f677146e99a5e97321a0424f2dd43734234b2a6bbaeb7a4a8711dcdb636f51c2bbd103a858082567f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\461d9418-fc22-469b-b3bf-cf1d675ebcc5.vbs

Filesize
713B

MD5
a5b7bfe45e9345aa62aca46cff7f9edc

SHA1
a1cbe563e5c42c5cf2a4eba24383dd6524313075

SHA256
2d9937b18b5013b4c314c3e0d0d775c483cc90053ddca51e12449be04b1a8b87

SHA512
64e64b93ce991831887350040356ee475d4af167f11986629cd469e19160f494f7f6549aabb2791adb081692f0ae6209b11ce58859e348fd7862635d431ee2d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\c99ffd89-025b-4601-ad53-8438dbaaf5cb.vbs

Filesize
713B

MD5
0ee69384c2351e29e75886675a268ae3

SHA1
c1ec40cead237daea3e37d46417adddb6ddd295e

SHA256
87cd430128e7d83c3bae3e5d04fe5bf79732f9f131c2f711c53a2a3c9f4b8b6a

SHA512
2b4180b8d61f2693e4c48cdc838d03abaa2dbc03fee56e5baeaa85e2c4328a969a7bfb85a044b1302d71d4d999f29d2f3118932cd191a223fc5c01b86f61bc45

Download Submit
memory/1544-126-0x0000000000740000-0x000000000096E000-memory.dmp

Filesize
2.2MB

Download
memory/2068-21-0x000000001B820000-0x000000001B82C000-memory.dmp

Filesize
48KB

Download
memory/2068-29-0x000000001BAF0000-0x000000001BAF8000-memory.dmp

Filesize
32KB

Download
memory/2068-11-0x000000001B130000-0x000000001B138000-memory.dmp

Filesize
32KB

Download
memory/2068-12-0x000000001B8D0000-0x000000001B8E0000-memory.dmp

Filesize
64KB

Download
memory/2068-13-0x000000001B140000-0x000000001B14A000-memory.dmp

Filesize
40KB

Download
memory/2068-14-0x000000001B7B0000-0x000000001B7BC000-memory.dmp

Filesize
48KB

Download
memory/2068-15-0x000000001B7C0000-0x000000001B7C8000-memory.dmp

Filesize
32KB

Download
memory/2068-16-0x000000001B7D0000-0x000000001B7DC000-memory.dmp

Filesize
48KB

Download
memory/2068-17-0x000000001B7E0000-0x000000001B7E8000-memory.dmp

Filesize
32KB

Download
memory/2068-19-0x000000001B7F0000-0x000000001B802000-memory.dmp

Filesize
72KB

Download
memory/2068-20-0x000000001BE10000-0x000000001C338000-memory.dmp

Filesize
5.2MB

Download
memory/2068-0-0x00007FFDC0733000-0x00007FFDC0735000-memory.dmp

Filesize
8KB

Download
memory/2068-22-0x000000001B830000-0x000000001B83C000-memory.dmp

Filesize
48KB

Download
memory/2068-23-0x000000001B840000-0x000000001B84C000-memory.dmp

Filesize
48KB

Download
memory/2068-25-0x000000001BAE0000-0x000000001BAEE000-memory.dmp

Filesize
56KB

Download
memory/2068-24-0x000000001B8C0000-0x000000001B8CA000-memory.dmp

Filesize
40KB

Download
memory/2068-27-0x000000001B860000-0x000000001B86E000-memory.dmp

Filesize
56KB

Download
memory/2068-10-0x000000001B120000-0x000000001B12C000-memory.dmp

Filesize
48KB

Download
memory/2068-26-0x000000001B850000-0x000000001B858000-memory.dmp

Filesize
32KB

Download
memory/2068-28-0x000000001B870000-0x000000001B87C000-memory.dmp

Filesize
48KB

Download
memory/2068-31-0x00007FFDC0730000-0x00007FFDC11F1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-30-0x000000001BB00000-0x000000001BB0C000-memory.dmp

Filesize
48KB

Download
memory/2068-34-0x00007FFDC0730000-0x00007FFDC11F1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-9-0x000000001B100000-0x000000001B116000-memory.dmp

Filesize
88KB

Download
memory/2068-7-0x000000001B0E0000-0x000000001B0E8000-memory.dmp

Filesize
32KB

Download
memory/2068-125-0x00007FFDC0730000-0x00007FFDC11F1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-8-0x000000001B0F0000-0x000000001B100000-memory.dmp

Filesize
64KB

Download
memory/2068-6-0x000000001B760000-0x000000001B7B0000-memory.dmp

Filesize
320KB

Download
memory/2068-5-0x00000000025A0000-0x00000000025BC000-memory.dmp

Filesize
112KB

Download
memory/2068-4-0x0000000002530000-0x000000000253E000-memory.dmp

Filesize
56KB

Download
memory/2068-3-0x0000000002520000-0x000000000252E000-memory.dmp

Filesize
56KB

Download
memory/2068-2-0x00007FFDC0730000-0x00007FFDC11F1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-1-0x0000000000270000-0x000000000049E000-memory.dmp

Filesize
2.2MB

Download
memory/4800-160-0x000000001C090000-0x000000001C192000-memory.dmp

Filesize
1.0MB

Download