dcrat | 595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2025, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SPISOK_DENEG.exe
Size

1.1MB
MD5

490aa1e56fab47858d780a9fdbafb5bf
SHA1

337d8c93caf41a62f0720ae1f0c02d262ac0a274
SHA256

595fab3363e5c90ecf3f7375a0b82d996c96b6a0307ad31e6d79dde07eeb8595
SHA512

7ff8f6983c789f78f67063745fef92040bb5cb88463e82f6a9f05ba0b48021bd2c541cec6e06726748547f0800abd14dd52fe798feddcb1427a46b87619a4f00
SSDEEP

24576:2TbBv5rUyXV0VTney9cyQJMA+b3iE0nHA6E:IBJgTney9clmA+b3KHe

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\spoolsv.exe\", \"C:\\Users\\Admin\\OneDrive\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\spoolsv.exe\", \"C:\\Users\\Admin\\OneDrive\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\ProviderserverruntimeperfSvc\\SppExtComObj.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\spoolsv.exe\", \"C:\\Users\\Admin\\OneDrive\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\ProviderserverruntimeperfSvc\\SppExtComObj.exe\", \"C:\\ProviderserverruntimeperfSvc\\RuntimeBroker.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\spoolsv.exe\", \"C:\\Users\\Admin\\OneDrive\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\ProviderserverruntimeperfSvc\\SppExtComObj.exe\", \"C:\\ProviderserverruntimeperfSvc\\RuntimeBroker.exe\", \"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\spoolsv.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Application Data\\spoolsv.exe\", \"C:\\Users\\Admin\\OneDrive\\explorer.exe\""	ChainPortsurrogate.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3180	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3552	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	1352	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	1352	schtasks.exe	86

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x000b000000023b6c-10.dat	family_dcrat_v2
behavioral2/memory/2096-13-0x0000000000A80000-0x0000000000B54000-memory.dmp	family_dcrat_v2

Checks computer location settings 2 TTPs 18 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	SPISOK_DENEG.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	ChainPortsurrogate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 16 IoCs

pid	Process
2096	ChainPortsurrogate.exe
1928	explorer.exe
1060	explorer.exe
3132	explorer.exe
1392	explorer.exe
4988	explorer.exe
516	explorer.exe
4964	explorer.exe
3368	explorer.exe
2364	explorer.exe
3708	explorer.exe
2648	explorer.exe
228	explorer.exe
1616	explorer.exe
2284	explorer.exe
1836	explorer.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\All Users\\Application Data\\spoolsv.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\ProviderserverruntimeperfSvc\\SppExtComObj.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ProviderserverruntimeperfSvc\\RuntimeBroker.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChainPortsurrogate = "\"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\All Users\\Application Data\\spoolsv.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\OneDrive\\explorer.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\OneDrive\\explorer.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\ProviderserverruntimeperfSvc\\SppExtComObj.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ProviderserverruntimeperfSvc\\RuntimeBroker.exe\""	ChainPortsurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChainPortsurrogate = "\"C:\\ProviderserverruntimeperfSvc\\ChainPortsurrogate.exe\""	ChainPortsurrogate.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC45D45EF54C374CE48E15E965983ED4CA.TMP	csc.exe
File created	\??\c:\Windows\System32\lhkpi-.exe	csc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SPISOK_DENEG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4080	PING.EXE
936	PING.EXE
5052	PING.EXE
828	PING.EXE
3716	PING.EXE
1084	PING.EXE
4536	PING.EXE

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	ChainPortsurrogate.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	SPISOK_DENEG.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	explorer.exe

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
936	PING.EXE
5052	PING.EXE
828	PING.EXE
3716	PING.EXE
1084	PING.EXE
4536	PING.EXE
4080	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe
5104	schtasks.exe
1152	schtasks.exe
3552	schtasks.exe
3636	schtasks.exe
3224	schtasks.exe
2592	schtasks.exe
2352	schtasks.exe
4584	schtasks.exe
2288	schtasks.exe
1240	schtasks.exe
2664	schtasks.exe
1356	schtasks.exe
376	schtasks.exe
3132	schtasks.exe
2228	schtasks.exe
3180	schtasks.exe
4432	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe
2096	ChainPortsurrogate.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	ChainPortsurrogate.exe
Token: SeDebugPrivilege	1928	explorer.exe
Token: SeDebugPrivilege	1060	explorer.exe
Token: SeDebugPrivilege	3132	explorer.exe
Token: SeDebugPrivilege	1392	explorer.exe
Token: SeDebugPrivilege	4988	explorer.exe
Token: SeDebugPrivilege	516	explorer.exe
Token: SeDebugPrivilege	4964	explorer.exe
Token: SeDebugPrivilege	3368	explorer.exe
Token: SeDebugPrivilege	2364	explorer.exe
Token: SeDebugPrivilege	3708	explorer.exe
Token: SeDebugPrivilege	2648	explorer.exe
Token: SeDebugPrivilege	228	explorer.exe
Token: SeDebugPrivilege	1616	explorer.exe
Token: SeDebugPrivilege	2284	explorer.exe
Token: SeDebugPrivilege	1836	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2360	2108	SPISOK_DENEG.exe	82
PID 2108 wrote to memory of 2360	2108	SPISOK_DENEG.exe	82
PID 2108 wrote to memory of 2360	2108	SPISOK_DENEG.exe	82
PID 2360 wrote to memory of 2636	2360	WScript.exe	83
PID 2360 wrote to memory of 2636	2360	WScript.exe	83
PID 2360 wrote to memory of 2636	2360	WScript.exe	83
PID 2636 wrote to memory of 2096	2636	cmd.exe	85
PID 2636 wrote to memory of 2096	2636	cmd.exe	85
PID 2096 wrote to memory of 4848	2096	ChainPortsurrogate.exe	90
PID 2096 wrote to memory of 4848	2096	ChainPortsurrogate.exe	90
PID 4848 wrote to memory of 1984	4848	csc.exe	92
PID 4848 wrote to memory of 1984	4848	csc.exe	92
PID 2096 wrote to memory of 2544	2096	ChainPortsurrogate.exe	108
PID 2096 wrote to memory of 2544	2096	ChainPortsurrogate.exe	108
PID 2544 wrote to memory of 2600	2544	cmd.exe	110
PID 2544 wrote to memory of 2600	2544	cmd.exe	110
PID 2544 wrote to memory of 4844	2544	cmd.exe	111
PID 2544 wrote to memory of 4844	2544	cmd.exe	111
PID 2544 wrote to memory of 1928	2544	cmd.exe	116
PID 2544 wrote to memory of 1928	2544	cmd.exe	116
PID 1928 wrote to memory of 4648	1928	explorer.exe	117
PID 1928 wrote to memory of 4648	1928	explorer.exe	117
PID 4648 wrote to memory of 876	4648	cmd.exe	119
PID 4648 wrote to memory of 876	4648	cmd.exe	119
PID 4648 wrote to memory of 936	4648	cmd.exe	120
PID 4648 wrote to memory of 936	4648	cmd.exe	120
PID 4648 wrote to memory of 1060	4648	cmd.exe	123
PID 4648 wrote to memory of 1060	4648	cmd.exe	123
PID 1060 wrote to memory of 2396	1060	explorer.exe	124
PID 1060 wrote to memory of 2396	1060	explorer.exe	124
PID 2396 wrote to memory of 3696	2396	cmd.exe	126
PID 2396 wrote to memory of 3696	2396	cmd.exe	126
PID 2396 wrote to memory of 2692	2396	cmd.exe	127
PID 2396 wrote to memory of 2692	2396	cmd.exe	127
PID 2396 wrote to memory of 3132	2396	cmd.exe	129
PID 2396 wrote to memory of 3132	2396	cmd.exe	129
PID 3132 wrote to memory of 3180	3132	explorer.exe	131
PID 3132 wrote to memory of 3180	3132	explorer.exe	131
PID 3180 wrote to memory of 4140	3180	cmd.exe	133
PID 3180 wrote to memory of 4140	3180	cmd.exe	133
PID 3180 wrote to memory of 3916	3180	cmd.exe	134
PID 3180 wrote to memory of 3916	3180	cmd.exe	134
PID 3180 wrote to memory of 1392	3180	cmd.exe	135
PID 3180 wrote to memory of 1392	3180	cmd.exe	135
PID 1392 wrote to memory of 4608	1392	explorer.exe	136
PID 1392 wrote to memory of 4608	1392	explorer.exe	136
PID 4608 wrote to memory of 3476	4608	cmd.exe	138
PID 4608 wrote to memory of 3476	4608	cmd.exe	138
PID 4608 wrote to memory of 5052	4608	cmd.exe	139
PID 4608 wrote to memory of 5052	4608	cmd.exe	139
PID 4608 wrote to memory of 4988	4608	cmd.exe	140
PID 4608 wrote to memory of 4988	4608	cmd.exe	140
PID 4988 wrote to memory of 4660	4988	explorer.exe	141
PID 4988 wrote to memory of 4660	4988	explorer.exe	141
PID 4660 wrote to memory of 2544	4660	cmd.exe	143
PID 4660 wrote to memory of 2544	4660	cmd.exe	143
PID 4660 wrote to memory of 828	4660	cmd.exe	144
PID 4660 wrote to memory of 828	4660	cmd.exe	144
PID 4660 wrote to memory of 516	4660	cmd.exe	145
PID 4660 wrote to memory of 516	4660	cmd.exe	145
PID 516 wrote to memory of 2532	516	explorer.exe	146
PID 516 wrote to memory of 2532	516	explorer.exe	146
PID 2532 wrote to memory of 3676	2532	cmd.exe	148
PID 2532 wrote to memory of 3676	2532	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SPISOK_DENEG.exe
"C:\Users\Admin\AppData\Local\Temp\SPISOK_DENEG.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProviderserverruntimeperfSvc\4oe8qKx4BC4jNir9oLrOplwqP.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProviderserverruntimeperfSvc\wnVkTofZircZrFhWJh5AKDNhgeSRpsYNieNXBbC85wZu.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe
      "C:\ProviderserverruntimeperfSvc/ChainPortsurrogate.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\srtjzmif\srtjzmif.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4848
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9904.tmp" "c:\Windows\System32\CSC45D45EF54C374CE48E15E965983ED4CA.TMP"
        6⤵
        
        PID:1984
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqUuVuZV5A.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2544
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2600
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4844
      - C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OmY81XgjJ.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:936
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1060
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3696
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2692
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ArRo6YWO69.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3916
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yi26nrh1VM.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5052
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x3fbj0yJ9Y.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:828
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B5GxaJWFI4.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3676
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:116
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat"
        19⤵
        
        PID:4344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3716
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MeHUYFCmAF.bat"
        21⤵
        
        PID:3124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4800
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1084
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1QWUF8ga47.bat"
        23⤵
        
        PID:3548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4584
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3264
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3708
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0BhMlNgjsC.bat"
        25⤵
        
        PID:5076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:5068
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ca5Tx9SGrV.bat"
        27⤵
        
        PID:3412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2176
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:3864
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DzTa8uEoqo.bat"
        29⤵
        
        PID:3448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4560
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U5BoPe2aCH.bat"
        31⤵
        
        PID:2624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:3068
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4536
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1QWUF8ga47.bat"
        33⤵
        
        PID:912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        34⤵
        
        PID:2028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:4832
        
        C:\Users\Admin\OneDrive\explorer.exe
        
        "C:\Users\Admin\OneDrive\explorer.exe"
        34⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zxsEHcgshH.bat"
        35⤵
        
        PID:1248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        36⤵
        
        PID:3420
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        36⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\OneDrive\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\ProviderserverruntimeperfSvc\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\ProviderserverruntimeperfSvc\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\ProviderserverruntimeperfSvc\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\ProviderserverruntimeperfSvc\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProviderserverruntimeperfSvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\ProviderserverruntimeperfSvc\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogateC" /sc MINUTE /mo 7 /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogate" /sc ONLOGON /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ChainPortsurrogateC" /sc MINUTE /mo 12 /tr "'C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProviderserverruntimeperfSvc\4oe8qKx4BC4jNir9oLrOplwqP.vbe

Filesize
250B

MD5
d8776d21a414703fcf32711bb7ecdfb4

SHA1
1c6820ca5097513a2be072a3b43eff1fc8403184

SHA256
bb5a09775dcaeb1c3c4d3cdd4c207c96f1a153aa23fed7512367eca6a3a0c22d

SHA512
ad33ca536cc149301ba111280388a9a6295ddd7c2be76fa3eefba8cab1f2727a4effc57b24adbf0be8f10c2d13872c215f9512dd470990541b39e2d2681595a9

Download Submit
C:\ProviderserverruntimeperfSvc\ChainPortsurrogate.exe

Filesize
825KB

MD5
ce09db6adeeca051ff01abd8cf2e400d

SHA1
14e60e202c180152757a89d13d9989ec35e1f5a2

SHA256
ad372edd698062a90f4744da16f88cc5bb45ca9b1cb70fc7350673d293f2bc16

SHA512
e80449cde93d19790e64c1fe24af1aeb00a3c392b4d57a529205a2339bbaa675b6ee21d2d068d65ef21c37d23d2f1b8b458706068ffe850410dc290c4d5c0ce3

Download Submit
C:\ProviderserverruntimeperfSvc\wnVkTofZircZrFhWJh5AKDNhgeSRpsYNieNXBbC85wZu.bat

Filesize
110B

MD5
9c91fe8e1765ddf30eda4052cbecbf48

SHA1
8acec401bdec034d55ead6804c69505c1d680e67

SHA256
9420d7930ae9f2040d5b46bc120da24e920fccf6882e69b74269f71e75cc0718

SHA512
e72ec080ae8fc66a5f712e3a525f0013d406b587523b3b6ff8dc80f12f12af183fc77b578293808f07e916a8b6f2252206b3c899200d0f70540cb70de467ea87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
7800fca2323a4130444c572374a030f4

SHA1
40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa

SHA256
29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e

SHA512
c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554

Download Submit
C:\Users\Admin\AppData\Local\Temp\0BhMlNgjsC.bat

Filesize
212B

MD5
7c7a04b1af827489ac556f99ccb7afe9

SHA1
ac5ebe242d6146f0181fa8eccdbec094cddae719

SHA256
6f9ea904a6c6d365093e09135af47f645636723b64f1536d92b4f1d1629053f3

SHA512
cd9a3ed1acc7785d4b63a65bfcbf97258a3696b0cec406c80be99b43d4de150e1b90fd92c32e2060cf575e556852a98b6a0ca9b7e2c15476fdbcb306d404485e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1QWUF8ga47.bat

Filesize
212B

MD5
0ef111d80206f5ff8d8130b7c8d83937

SHA1
3631c685d47cdd88ed0c067280b4f07e9dd9cb0d

SHA256
01f8fdfd6ea27598db31be8e028c31c0cca10a5deedddb6c85ca38f47c5a547c

SHA512
c1b1c846e535283ae46bb14e053a4d2086ee68e5d1ea02501effe5ba05b6aff8a57c5f19feb46c0714b52400c8abb48f4ecb3f61fdbd27bb16b86499a2b0e29a

Download Submit
C:\Users\Admin\AppData\Local\Temp\8OmY81XgjJ.bat

Filesize
164B

MD5
690ef14eb6e75bc6e3d422636ef894ca

SHA1
8c177042efbc36311a1c41c05c50d353af582074

SHA256
974bb6d60e4f1ec22392a78a43f211e2a9cf985df276490b8f78826e07bfdca7

SHA512
cea7bf7322f98a879abdf1b822aa674222bad75530fe97e61717cf542fbd50396d1c7b19b5d8b0c08cb0f90af29392923b12cd68f8ac97a7ad36682a8ca0aef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\9cbgcnWXuE.bat

Filesize
164B

MD5
42802928b5955e2403b8ab5e7539e819

SHA1
83a07d044cf39eac3c96129319fb7b6c33e2e564

SHA256
08f1c63d58a945e3773680dbfb0dcfe34d078c4c14c280894eb02c3c4e825330

SHA512
85bd806c298f2375f241b8bf150da36f5f2858c7626c2742735186707eb62c15488a0e150c09f3312c9f684e6abe3548eddab9b3a6aa365ab6cfdc664dd12407

Download Submit
C:\Users\Admin\AppData\Local\Temp\ArRo6YWO69.bat

Filesize
212B

MD5
907322a2cf94c03f41cab6f26443f852

SHA1
1c76733bf770323508996c1a743a34c84e7519bb

SHA256
fec0b972367cfcebb5d00dc9f878736f6912daa517c88498cd55409c6407bec5

SHA512
3011e844616c3d1dfce627d33d361e8149d85f62841c264f00c0becf32168c7e4de01b7537febf16f60caa63a9cb4bc1f46ca5f7e1421d0e4a698509309a65db

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5GxaJWFI4.bat

Filesize
212B

MD5
b0e9509babc7cf69c131555ae4786eb6

SHA1
73f74b7ee6ad5d1223f2d35a10a023ac25a7e443

SHA256
c4117728911c2a1c679a0e27926a66d5f4bfbb22ea4b122176b7f533577b81a9

SHA512
bb3126c35287753a1e22ce096b3268fa8dc46612d4352ccf7236848940f4a46abf820bf4e2172fc2b28efd6f4ff6dbd8090ca1a325e3a821a5d3f1dce3c38e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\DzTa8uEoqo.bat

Filesize
212B

MD5
462c14900de4b3539cf7085a5d0cf52c

SHA1
74eb802c84f484e46cbe1fef7241ed132495a786

SHA256
8ae95eff42fe137be161ed340aba6c63ca7a3c6249963ebe5ebd55a2e2159c87

SHA512
cd9e8518da17e5ea1e54b0d8c9743e7852392c6e31f2938cedc64564b798e994189360089d6a6b4a826deb593655fc28ee067a7852ccd8688759a9632500c74e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MeHUYFCmAF.bat

Filesize
164B

MD5
ea3812b146dc33841b088ecd166338b8

SHA1
0a4d947edc181d271edf6c40e1fd107f01694ce9

SHA256
a54c5a7b9d3b3b8de6c22fe251bd336b68353c16698b82efa88e27f9516e68f5

SHA512
0024957143a538db0137282e4b3e9571cb6fd782c8f9e8100061414f8c2e098c4bda865373e686b55430c1ebbeded279440f78886bd7c5ef17b7c867e3d281c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9904.tmp

Filesize
1KB

MD5
9bb7d4af0ffe49a3e3e474ff242d8551

SHA1
aafaf692a06b1467cf9b4495cfcadcad0aad7f94

SHA256
48f0117070887d2af31d94344a3dbddf3f30067b8e80c1230a6b6bba0e7113e3

SHA512
dbb3eba1f015f97a20eb69b1cb02e69481c9a5cd931141e0cc73339283ab639008d5a6c02f1f39d8e2f468ebc7c18c90b584d574a98cdeb0523934f6570bcbd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\U5BoPe2aCH.bat

Filesize
164B

MD5
154fdbd4b0bf25313214f1400f239bf0

SHA1
4730f7961c6ccba8bc72137791e76d9db6984110

SHA256
b16687f3fc4015a2be55bc86390ef2ab0f043e07b30f146e9bf0660bb0bbb288

SHA512
c536810c9aa349bcbfcc4d871df0995b7ed74954073a477ed442812fb0827d77c8eeeede9ad38c7444fd9cf4471e97d059a81c5e28dde2a4fdd284c546a97fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat

Filesize
212B

MD5
129e291399cb3dd63b556c05f62890c4

SHA1
5d26ee8fa6debbd3573f956984e7c35762c5a9b1

SHA256
0f0bcbbf5956a2d4a7ccd7a5ac076a82ba5fac5f5cd983038ead5a2c600ed02c

SHA512
696fb34ee68c9618e40568320feb1c4159802e6161e3b0b2da9d84c381b14634040f82e60a5821bfc169dfc68fa633a99bb82791dd6d0296b780d2cf11b41b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\ca5Tx9SGrV.bat

Filesize
212B

MD5
05df83225795d1387dda4f7b1bce6d63

SHA1
31b8d1a44397853c32ed36841bf16bef8d54192d

SHA256
d46f3155348ee7d989a66caf60c5807665a449b7ebad19d61cf2314b11c4a382

SHA512
ac4b66cbc182b01873e4207619054c0fba92d3f5319ab77c03f05714c758689c91215097ddb9625b3f9526cd95dfa9657aaaca0b525d59446f8a7f2be23d376f

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqUuVuZV5A.bat

Filesize
212B

MD5
63d7557dcd6699be1830e70c6f0ecb45

SHA1
43d21ed768d3621a388a753c215ce225d802a664

SHA256
1e9227af8d240e20440e710f9ee5a8edb5919eb0cb9952408b4949405c6178b0

SHA512
1a86692788ea47ae5aa2837206dfa56fe57a27f97f0c068f32963d1f07e558cb373a46b70daa3c88bc3b97f296ecd8f3b22433d22a045d83f7cfd3027704d52a

Download Submit
C:\Users\Admin\AppData\Local\Temp\x3fbj0yJ9Y.bat

Filesize
164B

MD5
34c646560c88fabf32a5e25c19213722

SHA1
c9bafe48edc1f870dbd20fd1b2b42946086f4a92

SHA256
6abf54b2cdda2aa653e46a08fb18b197f37033b1bd868a0396d12b6d672e50ff

SHA512
89f1f1b04c35e0dfc2d6ead9e9fc2e4914d7061b80782fa938bd22defa63c5b69c2ebcb1fa603d5be9b1b3e57a084b6b008265eeedaf24ccae92b056da48965b

Download Submit
C:\Users\Admin\AppData\Local\Temp\yi26nrh1VM.bat

Filesize
164B

MD5
bbbe6f50884744a59a1ce1c2fd2e03df

SHA1
9403a7eb6f845dbe63942f49fec68fc87827b944

SHA256
5d1b893a1613c352ddeee14c199eb47f1b9b38d83c4d58fdb640c88dd5e6fe5b

SHA512
1d2a68bf879299ebb5761f6abdb3c0f119b7dab094e7f8ec4e5abb8ccc93507679f9ebc58ebdd391fece6d63be83d1f0b85d900e67329560270d1ee511a737e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zxsEHcgshH.bat

Filesize
164B

MD5
3c09759e99c470b1eebb2fdd5403a9ba

SHA1
dc141e65b453c536478aa19ce6c87d51880bf10d

SHA256
0b0ccc77acdbfa8ef8177697002af1b7985b2a8943c415398585cef691ccaacb

SHA512
951e90b9660e428dad9660407414f45c253280c87470bb5e55bbff811c51eefae796818d80934e96fe27ae8ac9d0e0c789dfe040111d89ae18c7147f9e70a006

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\srtjzmif\srtjzmif.0.cs

Filesize
379B

MD5
e7fa5519cb4126b74dcdfad090436b19

SHA1
047410eda15d6cf9dab049ab5968a04d8a555add

SHA256
c4c3d1bd3bc0c93a04db5517b5f30b386e9e3cef18aaf4831e1283c2833daf12

SHA512
65e002203a0d8fff4d668ad32f993b6c344d452d841dde1ddadf1eb99035dca3233238c71c6422f3ac5b3398d706a7b8af1840327ebc1fad16eac8a83184e67e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\srtjzmif\srtjzmif.cmdline

Filesize
235B

MD5
2b35b6ee7523ffe01ce323a3b8c37e6c

SHA1
864ac1260043883d38cd418334bde26269273432

SHA256
12a466f533ced27d62b8a6be93413d221852cfcc09d117c7d78d96511ccf0e3c

SHA512
6a13c6b2985dce93fb2a0b62cfab147bf90193916a3959b59e6d47608df026022e0607ca837390736d2ad81e54f7f465c242c6af4039dc42067af66daf65c04a

Download Submit
\??\c:\Windows\System32\CSC45D45EF54C374CE48E15E965983ED4CA.TMP

Filesize
1KB

MD5
75e32610d8ef6143201c7c28465fcda9

SHA1
b2bae99fade2dda07aecbe1659d184be0fc4e7a6

SHA256
97ee1cac3965d9cc55a60f20206f384719431f19ac96bdc52b93a98de51a639b

SHA512
b303fb99586efd19a08223ba93472fa6d33fcf9198bbf42fb16ba61001db59e5fd5835ea7696ed34e4004d23fa60697e724e6085d1269d788204bf95dfe46abc

Download Submit
memory/2096-20-0x0000000002C20000-0x0000000002C38000-memory.dmp

Filesize
96KB

Download
memory/2096-22-0x0000000001320000-0x000000000132E000-memory.dmp

Filesize
56KB

Download
memory/2096-18-0x0000000002C70000-0x0000000002CC0000-memory.dmp

Filesize
320KB

Download
memory/2096-17-0x0000000001340000-0x000000000135C000-memory.dmp

Filesize
112KB

Download
memory/2096-15-0x0000000001310000-0x000000000131E000-memory.dmp

Filesize
56KB

Download
memory/2096-13-0x0000000000A80000-0x0000000000B54000-memory.dmp

Filesize
848KB

Download
memory/2096-12-0x00007FF9165B3000-0x00007FF9165B5000-memory.dmp

Filesize
8KB

Download
memory/2096-24-0x0000000001330000-0x000000000133E000-memory.dmp

Filesize
56KB

Download