dcrat | 79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TANOMIlauncher.exe.bin.exe
Size

1.6MB
MD5

e4d5bf96ef8643dcfd7a7f54e572cf59
SHA1

b80bc4046716b909a2f0692faef8d037a61cb9ee
SHA256

79dd01cce6f984152a8e07f6bbc447387a355794bc717a1348644f8b57565a98
SHA512

6704a1d6da446ab58717dc154180d817d4d3561a4e369d7f066421302c514950a51dd6104ec1e1b180488f7262c2bff00c02438aabc5e74e00e554e2290e1822
SSDEEP

24576:yTbBv5rUTxMWorF6OswaKn31LdWnriW26/kSBn3vwof0XcpDAFsGo5kCfBC2MRy:UBaM3ZdjV4nri+FT0XPQLCBRy

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Internet Explorer\\uk-UA\\wininit.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Internet Explorer\\uk-UA\\wininit.exe\", \"C:\\Program Files (x86)\\Windows Mail\\winlogon.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\System.exe\", \"C:\\Program Files\\Internet Explorer\\uk-UA\\wininit.exe\", \"C:\\Program Files (x86)\\Windows Mail\\winlogon.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\bridgeChainBlockreviewWin\\DrivermonitorNetdhcp.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\Registry.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Offline Web Pages\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\", \"C:\\Users\\Default User\\System.exe\""	DrivermonitorNetdhcp.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4668	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	1568	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	1568	schtasks.exe	88

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	TANOMIlauncher.exe.bin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DrivermonitorNetdhcp.exe

Executes dropped EXE 2 IoCs

pid	Process
1020	DrivermonitorNetdhcp.exe
1328	winlogon.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Mail\\winlogon.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows Mail\\winlogon.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DrivermonitorNetdhcp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bridgeChainBlockreviewWin\\DrivermonitorNetdhcp.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Offline Web Pages\\Registry.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Internet Explorer\\uk-UA\\wininit.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Internet Explorer\\uk-UA\\wininit.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DrivermonitorNetdhcp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\bridgeChainBlockreviewWin\\DrivermonitorNetdhcp.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Offline Web Pages\\Registry.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\RuntimeBroker.exe\""	DrivermonitorNetdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Default User\\System.exe\""	DrivermonitorNetdhcp.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCF89FC4F1BF534C10BB7ECA9919F9F11A.TMP	csc.exe
File created	\??\c:\Windows\System32\xqt5sk.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\winlogon.exe	DrivermonitorNetdhcp.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\winlogon.exe	DrivermonitorNetdhcp.exe
File created	C:\Program Files (x86)\Windows Mail\cc11b995f2a76d	DrivermonitorNetdhcp.exe
File created	C:\Program Files\Internet Explorer\uk-UA\wininit.exe	DrivermonitorNetdhcp.exe
File created	C:\Program Files\Internet Explorer\uk-UA\56085415360792	DrivermonitorNetdhcp.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe	DrivermonitorNetdhcp.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\9e8d7a4ca61bd9	DrivermonitorNetdhcp.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\Registry.exe	DrivermonitorNetdhcp.exe
File created	C:\Windows\Offline Web Pages\ee2ad38f3d4382	DrivermonitorNetdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TANOMIlauncher.exe.bin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2420	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	TANOMIlauncher.exe.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	DrivermonitorNetdhcp.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2420	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1904	schtasks.exe
3744	schtasks.exe
3932	schtasks.exe
4196	schtasks.exe
640	schtasks.exe
1604	schtasks.exe
868	schtasks.exe
3056	schtasks.exe
2788	schtasks.exe
4572	schtasks.exe
4924	schtasks.exe
4668	schtasks.exe
4184	schtasks.exe
4996	schtasks.exe
4360	schtasks.exe
4564	schtasks.exe
3164	schtasks.exe
1716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1020	DrivermonitorNetdhcp.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe
1328	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	DrivermonitorNetdhcp.exe
Token: SeDebugPrivilege	1328	winlogon.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3532	3100	TANOMIlauncher.exe.bin.exe	83
PID 3100 wrote to memory of 3532	3100	TANOMIlauncher.exe.bin.exe	83
PID 3100 wrote to memory of 3532	3100	TANOMIlauncher.exe.bin.exe	83
PID 3532 wrote to memory of 4108	3532	WScript.exe	85
PID 3532 wrote to memory of 4108	3532	WScript.exe	85
PID 3532 wrote to memory of 4108	3532	WScript.exe	85
PID 4108 wrote to memory of 1020	4108	cmd.exe	87
PID 4108 wrote to memory of 1020	4108	cmd.exe	87
PID 1020 wrote to memory of 4300	1020	DrivermonitorNetdhcp.exe	93
PID 1020 wrote to memory of 4300	1020	DrivermonitorNetdhcp.exe	93
PID 4300 wrote to memory of 3204	4300	csc.exe	95
PID 4300 wrote to memory of 3204	4300	csc.exe	95
PID 1020 wrote to memory of 2484	1020	DrivermonitorNetdhcp.exe	111
PID 1020 wrote to memory of 2484	1020	DrivermonitorNetdhcp.exe	111
PID 2484 wrote to memory of 3064	2484	cmd.exe	113
PID 2484 wrote to memory of 3064	2484	cmd.exe	113
PID 2484 wrote to memory of 2420	2484	cmd.exe	114
PID 2484 wrote to memory of 2420	2484	cmd.exe	114
PID 2484 wrote to memory of 1328	2484	cmd.exe	116
PID 2484 wrote to memory of 1328	2484	cmd.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TANOMIlauncher.exe.bin.exe
"C:\Users\Admin\AppData\Local\Temp\TANOMIlauncher.exe.bin.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\3gKZAXCAg1FGbpHNytlddzV22hguHiZY84812G8yGhM.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\KfNj92OB2q89BQqYS4KdyWp300Lk8au5.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe
      "C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin/DrivermonitorNetdhcp.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zilbglq5\zilbglq5.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF656.tmp" "c:\Windows\System32\CSCF89FC4F1BF534C10BB7ECA9919F9F11A.TMP"
        6⤵
        
        PID:3204
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6E4XmGcYNX.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3064
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2420
      - C:\Program Files (x86)\Windows Mail\winlogon.exe
        
        "C:\Program Files (x86)\Windows Mail\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\uk-UA\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\uk-UA\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\uk-UA\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DrivermonitorNetdhcpD" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DrivermonitorNetdhcp" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DrivermonitorNetdhcpD" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6E4XmGcYNX.bat

Filesize
176B

MD5
16603c72169233e7be132c5222fa42e4

SHA1
ce5472ade4dc206b13b0ee066b70488ac63f9ce3

SHA256
fa0559ae5688661a9df9b2cbf6118f6d200835a253b15fa6df8cf8730a61cbd7

SHA512
0fca7def6afa05983a7837d4fdbc95594583aa311c5c9746c305ec45b98c4feb99ef6218e35cdf00f1ac49414e9d9e59e2dad8dde9a2c6312bd886ef674ba19e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF656.tmp

Filesize
1KB

MD5
533fc53fac806911fdba599da87e490a

SHA1
7b781141b9af209deffde9359e1d5b775144ca38

SHA256
fabe24f8e128f47c68771f6ab39447b3ace497eb1e354a0a3d5e01edca180467

SHA512
5ede1dec05b9812679f25bbcb21e2b54998eda5d3a539ba8402c5ccb50dff45a09a52b6625aabd844870817d87c30b686129b88722dba5e56c49a4263536d507

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\3gKZAXCAg1FGbpHNytlddzV22hguHiZY84812G8yGhM.vbe

Filesize
239B

MD5
bfa798b1e505fdf4c3d5935690d520c1

SHA1
c0f49114a795b2475d0b8b22b0a55455a50d29e5

SHA256
dbf18fbdbc65ebf9ef0fe14d2241f00c03dd2a1666e49ddb47c4871c67db2e8d

SHA512
cf512995697de828d6bdb198d0e38c3173ea486e266744eded48541a128cfafb690324c7ff21c921854c78ea43a471bd286625af0307f4974ef24b875daf0460

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\DrivermonitorNetdhcp.exe

Filesize
1.3MB

MD5
f7ed452b6b36fe1a6ad40017405f95a2

SHA1
de073fdf34b56af4f03d0ec8a2d221cbf4d0c5d4

SHA256
509a80dd4d58739d863b7fefbbfce44c3588119e9b5a258e0cbf58ac4bc8fb04

SHA512
a51f7e2028ff8016ab9dddfd0f5a320e9b3516ea32476a7bc82f9d3f33339fe2aa104bb48b630f3081deda2146a58164705af150519eb5ec1b6ecb3b8e0e6635

Download Submit
C:\Users\Admin\AppData\Local\Temp\bridgeChainBlockreviewWin\KfNj92OB2q89BQqYS4KdyWp300Lk8au5.bat

Filesize
90B

MD5
ca4c23f79ee470ef660f3c2c7fa64e86

SHA1
b7de68c9d60b668a1d92d32b61c676f99c605f8d

SHA256
6af8a46b462cb8d14dbd4d0fd0cb753341bbf1bd4eee84c97a87a6ef9e5ed739

SHA512
46a2eef31a505e43fb2f42b7901169ee04213da51a0e51b9004743cf04171d0727279ace095bf0e256a65c8ed27ff1438722079216a9b8f46ee95edaab78056c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zilbglq5\zilbglq5.0.cs

Filesize
373B

MD5
d6124e137991a21d83d35709cdd454cf

SHA1
e3b41b59075de9e54c5b4f8a45b4063ed1c73126

SHA256
c96a00a8b4ef5e2be7b5aace137f0c631b7f851eef507073c5c0a2d46ae776d0

SHA512
e14dc5a7e92a9940e058486f3a253ef77e6c09c4a91c728ed836477a6ba6062835d9f65cad98fb31cee788f18ddfe7281f22e2fde04fc00dc18132c54c540607

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\zilbglq5\zilbglq5.cmdline

Filesize
235B

MD5
64ab4e1c7fc409018b61ab3a498f3175

SHA1
b6d56c2627316643835ea78b67df06c900463b47

SHA256
2bda3e1da8ff6da0f363201d500be8595cfdaf529742bfe11884d6d9379eb5fe

SHA512
c2f208f64c8b50712ba798e4ef1d79bf35dc70a3b9246a3def4f01c9c807070587c75b1ad21947a017366c7b23af66109d5386e9138c336ca001c24bd047aa6f

Download Submit
\??\c:\Windows\System32\CSCF89FC4F1BF534C10BB7ECA9919F9F11A.TMP

Filesize
1KB

MD5
ad61927912f86c7c9f1e72720f4ef0ef

SHA1
dbb61d9d5c7310c85716fe9f445fee2151cef437

SHA256
bf2696fc2183af293d74c988add5772c1c7257c2e85ae754e43cbe0e1d105a1e

SHA512
33b6f9f93672bd0ecb68e553de0ce92dd6b773c62da7721c9544171df7de8b8588e9ba42e13836db5d5ffc078ca656993f8d06a857dda5a27e1d639d5a6fb3ee

Download Submit
memory/1020-48-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-30-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-76-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-74-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-72-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-68-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-66-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-64-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-62-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-60-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-58-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-56-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-54-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-50-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-70-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-46-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-42-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-34-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-32-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-78-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-28-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-26-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-24-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-22-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-21-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-18-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-16-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-52-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-44-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-40-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-38-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-3572-0x0000000002550000-0x000000000255E000-memory.dmp

Filesize
56KB

Download
memory/1020-3574-0x000000001AFF0000-0x000000001AFFC000-memory.dmp

Filesize
48KB

Download
memory/1020-36-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-15-0x000000001AE40000-0x000000001AFE5000-memory.dmp

Filesize
1.6MB

Download
memory/1020-14-0x000000001AE40000-0x000000001AFEA000-memory.dmp

Filesize
1.7MB

Download
memory/1020-13-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/1020-3598-0x00007FF8DEFC3000-0x00007FF8DEFC5000-memory.dmp

Filesize
8KB

Download
memory/1020-12-0x00007FF8DEFC3000-0x00007FF8DEFC5000-memory.dmp

Filesize
8KB

Download