dcrat | ee930b7c7d01783de8fb24c9f40924a4e9da49033951a450c63d046f2a2ce3ee

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2025, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCRatBuild.exe
Size

1.2MB
MD5

1c4d40bb27938ee8ccbe1b09a8a76ba6
SHA1

dc2266dc5b7b265221c7c9315267067c8fe76d92
SHA256

ee930b7c7d01783de8fb24c9f40924a4e9da49033951a450c63d046f2a2ce3ee
SHA512

7cb63784b5eeaf73941c2f425d3bcdea4200510929f2e9ba4ff4e6c3983e61fc4514d3a66a5405b8b1c052d07a8cd9784693a4ed26a0656c7d6b7b80121d1daa
SSDEEP

24576:GTbBv5rU8/38TnIPZKN9OJMA+53iE0n3g6s:4BtMTnIPkNomA+53KO

Score

10^/10

dcrat discovery evasion infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\PortSession\\upfc.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\Registration\\CRMLog\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\smss.exe\", \"C:\\PortSession\\MshyperwinSaves.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\PortSession\\upfc.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\PortSession\\upfc.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\PortSession\\upfc.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\PortSession\\upfc.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\Registration\\CRMLog\\WaaSMedicAgent.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\PortSession\\upfc.exe\", \"C:\\Users\\Public\\Pictures\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Windows\\Registration\\CRMLog\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\smss.exe\""	MshyperwinSaves.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4056	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	1620	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	1620	schtasks.exe	88

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e000000023b49-10.dat	family_dcrat_v2
behavioral2/memory/3876-12-0x00000000001A0000-0x0000000000266000-memory.dmp	family_dcrat_v2

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	MshyperwinSaves.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	DCRatBuild.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3876	MshyperwinSaves.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\PortSession\\upfc.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Public\\Pictures\\wininit.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\Registration\\CRMLog\\WaaSMedicAgent.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\smss.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\smss.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MshyperwinSaves = "\"C:\\PortSession\\MshyperwinSaves.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MshyperwinSaves = "\"C:\\PortSession\\MshyperwinSaves.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\PortSession\\upfc.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Public\\Pictures\\wininit.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	MshyperwinSaves.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Windows\\Registration\\CRMLog\\WaaSMedicAgent.exe\""	MshyperwinSaves.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCD0E1C3709A864F4AB41821BAC275A788.TMP	csc.exe
File created	\??\c:\Windows\System32\-63gkj.exe	csc.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Oracle\Java\smss.exe	MshyperwinSaves.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\smss.exe	MshyperwinSaves.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\69ddcba757bf72	MshyperwinSaves.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\schemas\EAPMethods\taskhostw.exe	MshyperwinSaves.exe
File created	C:\Windows\Registration\CRMLog\WaaSMedicAgent.exe	MshyperwinSaves.exe
File created	C:\Windows\Registration\CRMLog\c82b8037eab33d	MshyperwinSaves.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCRatBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
892	PING.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	DCRatBuild.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings	MshyperwinSaves.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4852	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
892	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4304	schtasks.exe
1564	schtasks.exe
4556	schtasks.exe
4432	schtasks.exe
760	schtasks.exe
1516	schtasks.exe
3172	schtasks.exe
3900	schtasks.exe
636	schtasks.exe
3856	schtasks.exe
4088	schtasks.exe
2632	schtasks.exe
4764	schtasks.exe
4056	schtasks.exe
1312	schtasks.exe
4024	schtasks.exe
3624	schtasks.exe
1636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe
3876	MshyperwinSaves.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3876	MshyperwinSaves.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2656	2968	DCRatBuild.exe	83
PID 2968 wrote to memory of 2656	2968	DCRatBuild.exe	83
PID 2968 wrote to memory of 2656	2968	DCRatBuild.exe	83
PID 2656 wrote to memory of 3268	2656	WScript.exe	90
PID 2656 wrote to memory of 3268	2656	WScript.exe	90
PID 2656 wrote to memory of 3268	2656	WScript.exe	90
PID 3268 wrote to memory of 4852	3268	cmd.exe	92
PID 3268 wrote to memory of 4852	3268	cmd.exe	92
PID 3268 wrote to memory of 4852	3268	cmd.exe	92
PID 3268 wrote to memory of 3876	3268	cmd.exe	93
PID 3268 wrote to memory of 3876	3268	cmd.exe	93
PID 3876 wrote to memory of 1272	3876	MshyperwinSaves.exe	99
PID 3876 wrote to memory of 1272	3876	MshyperwinSaves.exe	99
PID 1272 wrote to memory of 4112	1272	csc.exe	101
PID 1272 wrote to memory of 4112	1272	csc.exe	101
PID 3876 wrote to memory of 5080	3876	MshyperwinSaves.exe	117
PID 3876 wrote to memory of 5080	3876	MshyperwinSaves.exe	117
PID 5080 wrote to memory of 2508	5080	cmd.exe	119
PID 5080 wrote to memory of 2508	5080	cmd.exe	119
PID 5080 wrote to memory of 892	5080	cmd.exe	120
PID 5080 wrote to memory of 892	5080	cmd.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\PortSession\xqpjHHWRGdTYQyx20.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\PortSession\XDYOLPKRHAKuDwHqW0UccJnByucTvFaFH95cpSWEjfuEIuyo.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4852
  - - C:\PortSession\MshyperwinSaves.exe
      "C:\PortSession/MshyperwinSaves.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rnhq0gbq\rnhq0gbq.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1272
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE290.tmp" "c:\Windows\System32\CSCD0E1C3709A864F4AB41821BAC275A788.TMP"
        6⤵
        
        PID:4112
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Jq77Y2cx20.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5080
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2508
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\PortSession\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\PortSession\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\PortSession\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\WaaSMedicAgent.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Windows\Registration\CRMLog\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwinSavesM" /sc MINUTE /mo 8 /tr "'C:\PortSession\MshyperwinSaves.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwinSaves" /sc ONLOGON /tr "'C:\PortSession\MshyperwinSaves.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MshyperwinSavesM" /sc MINUTE /mo 11 /tr "'C:\PortSession\MshyperwinSaves.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortSession\MshyperwinSaves.exe

Filesize
769KB

MD5
48c98103b76113d37315de842cc11bdf

SHA1
5959ea78e7ea2a9dcff50b432e3686a4d92661d9

SHA256
71b5e69d1ab4582171d652798fba517dd42fac91d468307df032ca34a1b2bf9d

SHA512
b839a914a29d0b7494c95ef114bb755cf9d3c78a07b83a754203b8d1a3cd40bfa98b6d7b4306a74c75d9c3e52ff2ab9efa4048938b0635109650cd7cebd06ab9

Download Submit
C:\PortSession\XDYOLPKRHAKuDwHqW0UccJnByucTvFaFH95cpSWEjfuEIuyo.bat

Filesize
185B

MD5
40eeacbd45b33b136564acdeef820b82

SHA1
88310d13eec561a6520301af8898d2ba2f48037e

SHA256
d823cda4ea7894f7826a6a35448d3595d62af25dcd29617cc9c1c34d6b7a2417

SHA512
b00458f55e952c0342d48fb9381fd59d652ce3314c65ac1472c93fc0c71c1b58231192d73b8df71b29aa947695529a75ffc2bdef74b15f42065ed5dcf9c4cf96

Download Submit
C:\PortSession\xqpjHHWRGdTYQyx20.vbe

Filesize
238B

MD5
7f993365424b1bdc372346ab3492e407

SHA1
c558488f2d0a827390c503611f7e780bd8f16847

SHA256
3552a0f16d69b1cd44fb195a06e8f3dd6a5677dd0ddb1b2417d41fce95065835

SHA512
43ea73d8d4224a7fd86735cf8a19c24ee5c167fadfe93ff3da4af20754d49ce9f7eca35f7286ffc1d821118c10891691769fc6da252b94808214462bc4e7c882

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jq77Y2cx20.bat

Filesize
177B

MD5
6915d1cd459e96ca11218a311f6bcc92

SHA1
51045fb1acdacaef6d59bfbb78f19cf7aadec638

SHA256
038b3cf2e2458caacfccc2dcf65f2bbfe727afeb26fd29f036d6cede1001c68c

SHA512
7b023e478e9517afb5ab2da874825c79a90191218a8d55d26db72051d1b7d41fbb939a39739a06969d30419fb1ad606674099a42da26e374e4e54fe0301e0ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE290.tmp

Filesize
1KB

MD5
50bdd1e1b97ca4c597f50c2d0c06726e

SHA1
fc212ff7c54e6f3d1143380d3f9b74fae0f6c1d0

SHA256
8d967ececf0d8d4f5417f62e51c9a7c7c0e5e491f5ddab587626f7f50b559671

SHA512
8b76c28b9ac85a6d2965b4f608d84c35c3565743d38501bd8effdc698103e6da5e96a7e60e19817880ecb6c6aa97ce41c211128a70be87c3b678f6fd9697bba6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rnhq0gbq\rnhq0gbq.0.cs

Filesize
355B

MD5
77bf519ad3015b3ae6ee4dc7c2aa6cf1

SHA1
cbe90c54a38ad16836f99e7acbf664fb6ad61dab

SHA256
ac966000e284ca930f475a2fe76b6786cef9ff29f9d7909724e995dea8d2433a

SHA512
3d0eb95422931d174741499b81b3a6d91e918bf679b29e8a1de0039c62206b8c7d67f30a4ee99f36257c5fbd9f5906f9cfa61f75bdaf7dbe11aeaab069e5b22b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rnhq0gbq\rnhq0gbq.cmdline

Filesize
235B

MD5
5e3f96c25381d835c80e8a22a0862526

SHA1
383aeee6301e8014093b614535b85a0757e0310c

SHA256
0f75d899045a6a769d6d059f8ebc2002bbf9ef70032b084a4bf9f742a5d56990

SHA512
0fefc32bb0a6fa491367c113ef7cf04fe8043c5b0a76b2216312e8d0ee08008ace00cd98a460367466111bc9af7208fbc9f38e1f588cdb04e21049f5d26cc42f

Download Submit
\??\c:\Windows\System32\CSCD0E1C3709A864F4AB41821BAC275A788.TMP

Filesize
1KB

MD5
82a7b8ef3bc275711e3b27c6df93c7ff

SHA1
bdac909f26475c94c74145576bcf22adb0f8203c

SHA256
582921e5e6617cb736006c46c9c8576d8fdefb8763469bdbf305d52d298f6124

SHA512
f2100bca60280f6ad93f40254d6fe69bd9917a44973516874aa54c28042796503daac5c51869924f5ecd17615f461dda6441f479e1201c44ad07f5a7728af248

Download Submit
memory/3876-12-0x00000000001A0000-0x0000000000266000-memory.dmp

Filesize
792KB

Download
memory/3876-21-0x0000000000A30000-0x0000000000A3C000-memory.dmp

Filesize
48KB

Download
memory/3876-19-0x0000000002330000-0x0000000002348000-memory.dmp

Filesize
96KB

Download
memory/3876-17-0x0000000002380000-0x00000000023D0000-memory.dmp

Filesize
320KB

Download
memory/3876-16-0x0000000000A50000-0x0000000000A6C000-memory.dmp

Filesize
112KB

Download
memory/3876-50-0x000000001BE80000-0x000000001BF4D000-memory.dmp

Filesize
820KB

Download
memory/3876-14-0x0000000000A20000-0x0000000000A2E000-memory.dmp

Filesize
56KB

Download