dcrat | 076c80010cb400aa03881eb5d88c6e2e4677c0d405255c48154bcf780e549533

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SAMP_CHEAT_ATVECHAU2.exe.bin.exe
Size

2.2MB
MD5

be4ae5e0b545e43608ae6a60ce297871
SHA1

ded512ee44ed38b7a6541b4e1d797387a27a5d93
SHA256

076c80010cb400aa03881eb5d88c6e2e4677c0d405255c48154bcf780e549533
SHA512

45aafc3ec5787b1bf143a1d6b9f8ce79447157879c684849486d87a3a7b357862688016809277ff2c9e57a6d06a0613e12009c5a279d07ced4ecc3b3bc9cd0c3
SSDEEP

24576:2TbBv5rUyXVoEmEVLqBMwOk+ADUZjmwMUuTEZ/iJJjhs4P/r+iHtxItZPFtOObx5:IBJvZ+qwOZFM+aJJbL+iNuuMxoyW29L

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\wininit.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Users\\Public\\Desktop\\System.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Users\\Public\\Desktop\\System.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Users\\Public\\Desktop\\System.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\es-ES\\smss.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Users\\Public\\Desktop\\System.exe\", \"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\es-ES\\smss.exe\", \"C:\\msportComWin\\BridgePortsurrogateserverref.exe\""	BridgePortsurrogateserverref.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	1716	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	1716	schtasks.exe	34

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1740	powershell.exe
2360	powershell.exe
408	powershell.exe
2980	powershell.exe
1480	powershell.exe
1688	powershell.exe
1684	powershell.exe
2080	powershell.exe
2468	powershell.exe
1732	powershell.exe
300	powershell.exe
1808	powershell.exe
1844	powershell.exe
1976	powershell.exe
1784	powershell.exe
1356	powershell.exe
988	powershell.exe
1300	powershell.exe
840	powershell.exe

Executes dropped EXE 13 IoCs

pid	Process
2884	BridgePortsurrogateserverref.exe
1904	services.exe
1976	services.exe
2928	services.exe
2496	services.exe
1292	services.exe
1692	services.exe
2244	services.exe
2792	services.exe
300	services.exe
2816	services.exe
2228	services.exe
2084	services.exe

Loads dropped DLL 2 IoCs

pid	Process
2812	cmd.exe
2812	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Desktop\\System.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Internet Explorer\\es-ES\\smss.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BridgePortsurrogateserverref = "\"C:\\msportComWin\\BridgePortsurrogateserverref.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default User\\wininit.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\services.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Desktop\\System.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1f4ba082-69f6-11ef-a143-62cb582c238c\\csrss.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Internet Explorer\\es-ES\\smss.exe\""	BridgePortsurrogateserverref.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgePortsurrogateserverref = "\"C:\\msportComWin\\BridgePortsurrogateserverref.exe\""	BridgePortsurrogateserverref.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCC87F0DDCBF9E4799AAA2A639447DD946.TMP	csc.exe
File created	\??\c:\Windows\System32\qmeprf.exe	csc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\es-ES\smss.exe	BridgePortsurrogateserverref.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\es-ES\smss.exe	BridgePortsurrogateserverref.exe
File created	C:\Program Files (x86)\Internet Explorer\es-ES\69ddcba757bf72	BridgePortsurrogateserverref.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SAMP_CHEAT_ATVECHAU2.exe.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1980	PING.EXE
536	PING.EXE
2140	PING.EXE
772	PING.EXE
2016	PING.EXE

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
772	PING.EXE
2016	PING.EXE
1980	PING.EXE
536	PING.EXE
2140	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2436	schtasks.exe
2772	schtasks.exe
1964	schtasks.exe
1956	schtasks.exe
1944	schtasks.exe
400	schtasks.exe
2820	schtasks.exe
2480	schtasks.exe
1996	schtasks.exe
2412	schtasks.exe
2568	schtasks.exe
1340	schtasks.exe
2324	schtasks.exe
2456	schtasks.exe
2240	schtasks.exe
1852	schtasks.exe
2784	schtasks.exe
1912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe
2884	BridgePortsurrogateserverref.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	BridgePortsurrogateserverref.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	2468	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1740	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	1904	services.exe
Token: SeDebugPrivilege	1976	services.exe
Token: SeDebugPrivilege	2928	services.exe
Token: SeDebugPrivilege	2496	services.exe
Token: SeDebugPrivilege	1292	services.exe
Token: SeDebugPrivilege	1692	services.exe
Token: SeDebugPrivilege	2244	services.exe
Token: SeDebugPrivilege	2792	services.exe
Token: SeDebugPrivilege	300	services.exe
Token: SeDebugPrivilege	2816	services.exe
Token: SeDebugPrivilege	2228	services.exe
Token: SeDebugPrivilege	2084	services.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2700	2860	SAMP_CHEAT_ATVECHAU2.exe.bin.exe	30
PID 2860 wrote to memory of 2700	2860	SAMP_CHEAT_ATVECHAU2.exe.bin.exe	30
PID 2860 wrote to memory of 2700	2860	SAMP_CHEAT_ATVECHAU2.exe.bin.exe	30
PID 2860 wrote to memory of 2700	2860	SAMP_CHEAT_ATVECHAU2.exe.bin.exe	30
PID 2700 wrote to memory of 2812	2700	WScript.exe	31
PID 2700 wrote to memory of 2812	2700	WScript.exe	31
PID 2700 wrote to memory of 2812	2700	WScript.exe	31
PID 2700 wrote to memory of 2812	2700	WScript.exe	31
PID 2812 wrote to memory of 2884	2812	cmd.exe	33
PID 2812 wrote to memory of 2884	2812	cmd.exe	33
PID 2812 wrote to memory of 2884	2812	cmd.exe	33
PID 2812 wrote to memory of 2884	2812	cmd.exe	33
PID 2884 wrote to memory of 2068	2884	BridgePortsurrogateserverref.exe	38
PID 2884 wrote to memory of 2068	2884	BridgePortsurrogateserverref.exe	38
PID 2884 wrote to memory of 2068	2884	BridgePortsurrogateserverref.exe	38
PID 2068 wrote to memory of 1548	2068	csc.exe	40
PID 2068 wrote to memory of 1548	2068	csc.exe	40
PID 2068 wrote to memory of 1548	2068	csc.exe	40
PID 2884 wrote to memory of 1684	2884	BridgePortsurrogateserverref.exe	56
PID 2884 wrote to memory of 1684	2884	BridgePortsurrogateserverref.exe	56
PID 2884 wrote to memory of 1684	2884	BridgePortsurrogateserverref.exe	56
PID 2884 wrote to memory of 1784	2884	BridgePortsurrogateserverref.exe	57
PID 2884 wrote to memory of 1784	2884	BridgePortsurrogateserverref.exe	57
PID 2884 wrote to memory of 1784	2884	BridgePortsurrogateserverref.exe	57
PID 2884 wrote to memory of 2360	2884	BridgePortsurrogateserverref.exe	58
PID 2884 wrote to memory of 2360	2884	BridgePortsurrogateserverref.exe	58
PID 2884 wrote to memory of 2360	2884	BridgePortsurrogateserverref.exe	58
PID 2884 wrote to memory of 408	2884	BridgePortsurrogateserverref.exe	59
PID 2884 wrote to memory of 408	2884	BridgePortsurrogateserverref.exe	59
PID 2884 wrote to memory of 408	2884	BridgePortsurrogateserverref.exe	59
PID 2884 wrote to memory of 300	2884	BridgePortsurrogateserverref.exe	60
PID 2884 wrote to memory of 300	2884	BridgePortsurrogateserverref.exe	60
PID 2884 wrote to memory of 300	2884	BridgePortsurrogateserverref.exe	60
PID 2884 wrote to memory of 1808	2884	BridgePortsurrogateserverref.exe	61
PID 2884 wrote to memory of 1808	2884	BridgePortsurrogateserverref.exe	61
PID 2884 wrote to memory of 1808	2884	BridgePortsurrogateserverref.exe	61
PID 2884 wrote to memory of 2980	2884	BridgePortsurrogateserverref.exe	62
PID 2884 wrote to memory of 2980	2884	BridgePortsurrogateserverref.exe	62
PID 2884 wrote to memory of 2980	2884	BridgePortsurrogateserverref.exe	62
PID 2884 wrote to memory of 2080	2884	BridgePortsurrogateserverref.exe	63
PID 2884 wrote to memory of 2080	2884	BridgePortsurrogateserverref.exe	63
PID 2884 wrote to memory of 2080	2884	BridgePortsurrogateserverref.exe	63
PID 2884 wrote to memory of 1480	2884	BridgePortsurrogateserverref.exe	64
PID 2884 wrote to memory of 1480	2884	BridgePortsurrogateserverref.exe	64
PID 2884 wrote to memory of 1480	2884	BridgePortsurrogateserverref.exe	64
PID 2884 wrote to memory of 1356	2884	BridgePortsurrogateserverref.exe	65
PID 2884 wrote to memory of 1356	2884	BridgePortsurrogateserverref.exe	65
PID 2884 wrote to memory of 1356	2884	BridgePortsurrogateserverref.exe	65
PID 2884 wrote to memory of 1844	2884	BridgePortsurrogateserverref.exe	66
PID 2884 wrote to memory of 1844	2884	BridgePortsurrogateserverref.exe	66
PID 2884 wrote to memory of 1844	2884	BridgePortsurrogateserverref.exe	66
PID 2884 wrote to memory of 1976	2884	BridgePortsurrogateserverref.exe	67
PID 2884 wrote to memory of 1976	2884	BridgePortsurrogateserverref.exe	67
PID 2884 wrote to memory of 1976	2884	BridgePortsurrogateserverref.exe	67
PID 2884 wrote to memory of 1688	2884	BridgePortsurrogateserverref.exe	68
PID 2884 wrote to memory of 1688	2884	BridgePortsurrogateserverref.exe	68
PID 2884 wrote to memory of 1688	2884	BridgePortsurrogateserverref.exe	68
PID 2884 wrote to memory of 988	2884	BridgePortsurrogateserverref.exe	69
PID 2884 wrote to memory of 988	2884	BridgePortsurrogateserverref.exe	69
PID 2884 wrote to memory of 988	2884	BridgePortsurrogateserverref.exe	69
PID 2884 wrote to memory of 1300	2884	BridgePortsurrogateserverref.exe	71
PID 2884 wrote to memory of 1300	2884	BridgePortsurrogateserverref.exe	71
PID 2884 wrote to memory of 1300	2884	BridgePortsurrogateserverref.exe	71
PID 2884 wrote to memory of 1740	2884	BridgePortsurrogateserverref.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SAMP_CHEAT_ATVECHAU2.exe.bin.exe
"C:\Users\Admin\AppData\Local\Temp\SAMP_CHEAT_ATVECHAU2.exe.bin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\msportComWin\xtUjCOEXV8hvxooNRYyHQv7v29HXxWwl.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\msportComWin\5Jq5kgQebZBPc8KIFjklSaK6KtfwfF1rpT92XeRglY4x6Z5YYulxiLU9VV.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\msportComWin\BridgePortsurrogateserverref.exe
      "C:\msportComWin/BridgePortsurrogateserverref.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fbqx23rp\fbqx23rp.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2068
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES781D.tmp" "c:\Windows\System32\CSCC87F0DDCBF9E4799AAA2A639447DD946.TMP"
        6⤵
        
        PID:1548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/msportComWin/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\msportComWin\BridgePortsurrogateserverref.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GGA3gcfYy4.bat"
        5⤵
        
        PID:844
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1600
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2520
      - C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OTvWQnNRQU.bat"
        7⤵
        
        PID:2660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1060
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7yfvayqnt7.bat"
        9⤵
        
        PID:2608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2204
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JQt66VEtJ1.bat"
        11⤵
        
        PID:2332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:772
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XJaDrOzS3U.bat"
        13⤵
        
        PID:2824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:484
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2016
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4wM4wqHWVF.bat"
        15⤵
        
        PID:3004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1980
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wh6Yr0oKcq.bat"
        17⤵
        
        PID:624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1644
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:764
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PfaLCNk3Y7.bat"
        19⤵
        
        PID:2128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2192
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m2M6WqyfOt.bat"
        21⤵
        
        PID:2708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:320
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1696
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9O9rrJCHDg.bat"
        23⤵
        
        PID:1200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:268
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:536
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1v3DIijE8M.bat"
        25⤵
        
        PID:1680
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1188
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:552
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7laNmMQDQm.bat"
        27⤵
        
        PID:836
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1908
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2140
        
        C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe
        
        "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZLKnXXaim4.bat"
        29⤵
        
        PID:2784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2796
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\wininit.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Desktop\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgePortsurrogateserverrefB" /sc MINUTE /mo 7 /tr "'C:\msportComWin\BridgePortsurrogateserverref.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgePortsurrogateserverref" /sc ONLOGON /tr "'C:\msportComWin\BridgePortsurrogateserverref.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgePortsurrogateserverrefB" /sc MINUTE /mo 14 /tr "'C:\msportComWin\BridgePortsurrogateserverref.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1v3DIijE8M.bat

Filesize
251B

MD5
07ff6c675bec6fa093aa982fb88cd0fa

SHA1
b750f7645d351c414ea8a3df9b9fdacef6d97250

SHA256
8018bbe697d623a6f3717310eff49ccf009116f78bd7b448653f0cc8049fc300

SHA512
bf4d03dde1b5051cfa0c2d1a0aaa9e3e14555dbb7947f3da8ec8494bcce121e84cef1f097c3f9b3d67dacab364defd8c43684d5d46ccacaaba3ed2be84562a06

Download Submit
C:\Users\Admin\AppData\Local\Temp\4wM4wqHWVF.bat

Filesize
203B

MD5
fd141b63b1a1a0f6f52937be88e439ab

SHA1
1d04b32eac1afe70328c9e6bfeeb6f1687638f9d

SHA256
7856d6c5fdce4b72a5e78228350f8ffb596ba645a86816c19770e7d1a180d0ad

SHA512
83a537ffa06be33539820c2926f164482eb5d198de8df21e2d901ae2222d1e510e715387df4cb518f11b6668f6971545d6bcc3d7c05bc4f78eb88dcfddbd6bce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7laNmMQDQm.bat

Filesize
203B

MD5
647cb06b3ba2f2dd2ce276c6d516d330

SHA1
9c13ef95c8243082933d23f88445bc117fda842e

SHA256
72e27f4f11f9123cd973d062647f8cad89cc912cb91e10731e024261253b8c84

SHA512
b4545fcfbe4aa407ef18e36a2ff25cfd5ad24bae8d5042dd3fd30029d8cc16209603f2767e0346794db99ad5f19b2d54717ab6868bf03b0cbc3fb2ef5693a932

Download Submit
C:\Users\Admin\AppData\Local\Temp\7yfvayqnt7.bat

Filesize
251B

MD5
8295adc3a0fef9130e5cb710b8498607

SHA1
608b6c4619cc08bcb218dc0d20228d9655f618a0

SHA256
ce6e3483a80cb68f2da19f60dd984fe58c69076c113ffa2f7ea655f5ace2de7f

SHA512
4293cc04450aedfbd8c3eb29cfff432fe89d49883226214ba13fb4ff0245f7854a93b52baef52cdc18a930b5fef405007f7efde7ecc80d16483685fd80b6a69f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9O9rrJCHDg.bat

Filesize
203B

MD5
166b1f9a45deb2d6531b085a055fe35a

SHA1
28d42e51f33a87f642378a774994eebd18fe4dd0

SHA256
34629caffd478917f1c8546caa7ab3a3474c09223e3dd81126d94d139251e66d

SHA512
a374b87a9cdd5b17651ae65b49e59eeecdb90487f3538428ed0d16c1082708fc931a2f2b028ac447276f2941a675b85b6b444631e235af12b63dd946ee5ef22f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GGA3gcfYy4.bat

Filesize
251B

MD5
0250ae5368962cba51205b2a7b98027e

SHA1
c150286d1bfad0645100096f1c880ceac1ad7232

SHA256
6456340719d767a567fd3a82006ade829ba9b6230e84e6711419c6f4fc7430fb

SHA512
e878598b1cb681de32bc04406c84c2a907aee7888fbbb740cf7a5f078b10b6b2bfe50293b8e14a745af879181391b83232cdea78441584ec4a4faa6d50253358

Download Submit
C:\Users\Admin\AppData\Local\Temp\JQt66VEtJ1.bat

Filesize
203B

MD5
97153454e25f42a565867089d1d86f45

SHA1
477cc2ac09fd860e3c32cae7e5620b0fe196ecee

SHA256
970aa14ab8d62aa305b7362ab56717816ed4990db259781d24b4e889e4f04842

SHA512
19b0dbe553f40da1476ef70e448020c7051cc2d1a8257b25cf605c4d3329a8766ab8a07c0e5fd6de3592ab3a36e32a397655ea9f07bff0d248998cdfb02d31f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\OTvWQnNRQU.bat

Filesize
251B

MD5
1ef69a09c2bed7e9c484da54223cdc28

SHA1
5c261bce82ad5d25e6383d60ef2fd0fd4ad9affa

SHA256
6d9a58a381ee75e64a154dd0bb1e70aad5ffc0b83588b404fe7a503a5406d38f

SHA512
bc40832672ab3a4bece6c10d2611416916a79c7c43ab23833948f99623380bacf967990679fdc020d933ded8afb1942a78475cefe497134f114eca514ed3c4a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\PfaLCNk3Y7.bat

Filesize
251B

MD5
bd1ffff5ebf9efbe47436d25494e585b

SHA1
e2f8e278f937d1943d0bed9492bf3662224642cd

SHA256
9f6d58c06ab2f9da4d4b2e58ca1fd16821f942c198017eed8ed4b83e88add5ea

SHA512
01bbb13e22c20a92338cc0ccb3f594f9007f0f9580c261ad888616a8c1d237e25922e00a29c14b04de17006b77c39bd454211c834bfe82700f111e92aece6f01

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES781D.tmp

Filesize
1KB

MD5
0d283d5b6fda79e048cd56d41d085545

SHA1
3eb7e951446d3abac0b7651e17472b6fc25cf310

SHA256
d2e475d5eab013800aeed6f9b5f58b87f546e97eb0d42fdfb9354fb238075be2

SHA512
f4d91070021217faea86bc3f6a353637e54ec85d970c96fe2f7503b5862e9a1b4559cdc04dc9e2f545ed5ddcf00718a6a20958bf8e4028591af5c29d384f1449

Download Submit
C:\Users\Admin\AppData\Local\Temp\XJaDrOzS3U.bat

Filesize
203B

MD5
4bb17fcf19c12ef4fd84afd54fd16ebd

SHA1
46b7dd0426aa8dbe956ddf0bcdd2cd457e8c4257

SHA256
ddcb78b68f675452a74068f949b41c56c8303007f4b9797d012a092b78de0459

SHA512
eb845a00a454567c4b3b739c527f1440eff12dfc5ca9d5ef08e043d1fcfd23b263e68f773d80c6e96baa9f615a096f443cd69cdde07bf7af7e9e20649dccc0c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZLKnXXaim4.bat

Filesize
251B

MD5
91dc03fccfdb96e120d9acf86f6a7b3f

SHA1
0cb9963803f65a1bea386ef154169456a0add477

SHA256
6cb5c19ccd24b44775bac7d741ae0b9c107d7588fcab3029a12b056254f04762

SHA512
fccf781061bc7e0a7e21c583265eda6159b3cb07bc22b55f0a479cbc2644942d8735c86509ae6bde03a4633f888071d9dd6520145b6296ccf4dd7443a8f48e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\m2M6WqyfOt.bat

Filesize
251B

MD5
70f063d86b2a07b91843742dd17dd367

SHA1
a3cb7a617bc2f5935d18acec7df535e13fed3b42

SHA256
5b967e9bbf18f918fa42dc2e47314f926e2eb35e9f895b773f6f5c724d020c7e

SHA512
e263048af0b36bb204bb3e159f9a09165906d9aaafd189de133d42071ae337533dc5a2a817b7261ef9f6a4e73a3e323386f60c277d1532a283ef58bff5018325

Download Submit
C:\Users\Admin\AppData\Local\Temp\wh6Yr0oKcq.bat

Filesize
251B

MD5
bc4a7a292908cffbe6cda158f67029c1

SHA1
3e092253ea4ec01e4491a123afa9204d27ff2d46

SHA256
1c1e062f3e8650cc1a556e8eab4fde0a58d643d2d4a90ef68313ce192e95869b

SHA512
465650241edde3173e6ac0c46755608001579d22a6eeb7d9bb4d41032def7d3c20be20355ff2d8877e4ba47842022e6af37af07f88355e99d20a32ea9c951ed7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LPU0K12LJY08348W5CPB.temp

Filesize
7KB

MD5
7853294d27d9946ab3e07fb259bcc084

SHA1
8fc5d8392b26cd56390445e89467d753a7cd438a

SHA256
5705032e0de06f88b5cf49c1093afcef0e61149c57b94d56376d4641c2ff6761

SHA512
6e334b2ce8f2af4c559f7914a13f022fe80ebbfa6c6db1601a718274a510e228165fa87d11d86779e0be953bc4cf1df8914417cd4ae8dcee7de778a8e08d2ec6

Download Submit
C:\Users\Public\Desktop\System.exe

Filesize
1.9MB

MD5
5f80a11e82cc7495cf5ad7df3d052721

SHA1
3a20eb31195a97cf5da7d3c20c1b8c4913b95a13

SHA256
851aa5f3636700f9bb71a4c0d040255f19871ba306f87d9f66b39f3b207ec15b

SHA512
7acdd2a4f5170212beabeba86dcb7a6be74c4c83815db3bb328d6541f6a259ec3c6ff469f103eb125163371f103ae3060404e1c34622f2d4d9cb34d2cc7b3c0d

Download Submit
C:\msportComWin\5Jq5kgQebZBPc8KIFjklSaK6KtfwfF1rpT92XeRglY4x6Z5YYulxiLU9VV.bat

Filesize
114B

MD5
ec4930435249e865ec0910b90ce34010

SHA1
e00242ba6b91abe0291ee6c003c7cda9f280a20c

SHA256
aecaccc8288e076efa186171eab1ce946b8c0438e607f00a442b04e1e080dfbb

SHA512
f1bb3a20bd279b62b94349d253b64a4bb9227fa214785e265b5f5457a552bddb141faea48109ed80a6d77f34c8ba68fd2911daa178893daee52259e89a6b80aa

Download Submit
C:\msportComWin\xtUjCOEXV8hvxooNRYyHQv7v29HXxWwl.vbe

Filesize
248B

MD5
528d2d62b3a0a43e28f6c5bc9e59fb49

SHA1
b8347b3f11fdb951bf4c930bef813180c42f98c1

SHA256
9d271ddb2a3de2347db1800f94865bab4758e8f89760f7f0fc6368eb14a9597b

SHA512
a208e41f97a080ab5550632daa10ac7d4d43ca603207406df14e749765662089f38ff52feced3083dbcb08daa2821e9fc6df511fa1a1f18b4b9e8e38f68fa171

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fbqx23rp\fbqx23rp.0.cs

Filesize
365B

MD5
3de860348a22784a349feccfdf126efb

SHA1
32448156de131a5ffa8d7cef483031fc1822d3c7

SHA256
fb68044bfe5b554c6d362a3d71fc34607781a2691762a15aa146635512c15c37

SHA512
3d7f4e3d3bb6f7df088bae45fc6b7576c98bc335e1dbd00825c645b478bca086c0c06eaa55244f295dc7baa0f6507e60bd3c57feae4e4b73e63faf011f74fac7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fbqx23rp\fbqx23rp.cmdline

Filesize
235B

MD5
c2c8ac960087318008ae82afaf747e6a

SHA1
154d6741a412d65bf5f0b9e263085d9480e6d24e

SHA256
812ce866501b2ed8419460ccf7b3664324517ab991abb8c9478fe72fdc2fb3ac

SHA512
cdae55475351edadc938a12e9e0a71bb1774b58be3bc3ad7ea2104f7e03a0920f2177669ce61c37f7bbcee9bfc4a85d4fec4e251830a4ed8e8468dc1b973f792

Download Submit
\??\c:\Windows\System32\CSCC87F0DDCBF9E4799AAA2A639447DD946.TMP

Filesize
1KB

MD5
167c870490dc33ec13a83ebb533b1bf6

SHA1
182378ebfa7c8372a988dee50a7dd6f8cda6a367

SHA256
3f742a374ad5a8da8fba9dfea27c7382dde145d46732cfc0002a53a1311df5e6

SHA512
1b48bb5f270f5d99d9dd98cd9da5866aed9377957d92bf1d686878522c438b38a444073c1a0ed4cc85f97315d2ef6abf05b74ab2265fecb20be5795b2ccef64e

Download Submit
memory/988-72-0x0000000001DB0000-0x0000000001DB8000-memory.dmp

Filesize
32KB

Download
memory/1684-62-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1904-147-0x0000000000B60000-0x0000000000D50000-memory.dmp

Filesize
1.9MB

Download
memory/1976-160-0x0000000001170000-0x0000000001360000-memory.dmp

Filesize
1.9MB

Download
memory/2228-273-0x0000000000E00000-0x0000000000FF0000-memory.dmp

Filesize
1.9MB

Download
memory/2244-222-0x0000000001390000-0x0000000001580000-memory.dmp

Filesize
1.9MB

Download
memory/2816-260-0x00000000002E0000-0x00000000004D0000-memory.dmp

Filesize
1.9MB

Download
memory/2884-13-0x0000000000340000-0x0000000000530000-memory.dmp

Filesize
1.9MB

Download
memory/2884-21-0x0000000000310000-0x000000000031E000-memory.dmp

Filesize
56KB

Download
memory/2884-23-0x0000000000320000-0x000000000032E000-memory.dmp

Filesize
56KB

Download
memory/2884-19-0x0000000000650000-0x0000000000668000-memory.dmp

Filesize
96KB

Download
memory/2884-25-0x0000000000330000-0x000000000033C000-memory.dmp

Filesize
48KB

Download
memory/2884-17-0x0000000000630000-0x000000000064C000-memory.dmp

Filesize
112KB

Download
memory/2884-15-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/2928-173-0x0000000001240000-0x0000000001430000-memory.dmp

Filesize
1.9MB

Download