dcrat | d546328a43690c42bc768a5a07588bb43eb0a0962f5994b50fb5108156bc89ad

Analysis

max time kernel
128s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/01/2025, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EC5FDACECCEEE343335D6A686CE75864.exe
Size

2.1MB
MD5

ec5fdacecceee343335d6a686ce75864
SHA1

965f210fa2eccd71a866908320cb92eb926b338d
SHA256

d546328a43690c42bc768a5a07588bb43eb0a0962f5994b50fb5108156bc89ad
SHA512

533713c84dfcd9d23ffb338d9dd5c237ef6151315037ed8477f91bd89bad02639ee9e936cfc2ea5098f2bbff9e565115b14f71e287297d11328cf9c030512a4c
SSDEEP

49152:IBJi/YtO8s26Kzc1OpFAuD86cmG96kZTRc:ycoxd6Yc1+rXG3Rc

Score

10^/10

dcrat discovery infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\", \"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\", \"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\csrss.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\", \"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\", \"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\csrss.exe\", \"C:\\WebWinBrokerDll\\BridgeServerruntime.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\", \"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\smss.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\", \"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\""	BridgeServerruntime.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	236	2680	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2680	schtasks.exe	35

Executes dropped EXE 2 IoCs

pid	Process
2856	BridgeServerruntime.exe
916	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2728	cmd.exe
2728	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\smss.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\conhost.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\BridgeServerruntime = "\"C:\\WebWinBrokerDll\\BridgeServerruntime.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\smss.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\cmd.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\csrss.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\1b8b1de2-69f6-11ef-9774-62cb582c238c\\csrss.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BridgeServerruntime = "\"C:\\WebWinBrokerDll\\BridgeServerruntime.exe\""	BridgeServerruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\fr\\WmiPrvSE.exe\""	BridgeServerruntime.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCEA255792B6AD4A048CBD50A01348FFF7.TMP	csc.exe
File created	\??\c:\Windows\System32\wa0wg5.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe	BridgeServerruntime.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\088424020bedd6	BridgeServerruntime.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WmiPrvSE.exe	BridgeServerruntime.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\24dbde2999530e	BridgeServerruntime.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Boot\Fonts\taskhost.exe	BridgeServerruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC5FDACECCEEE343335D6A686CE75864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1500	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1500	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2664	schtasks.exe
1952	schtasks.exe
1804	schtasks.exe
236	schtasks.exe
1604	schtasks.exe
2464	schtasks.exe
2216	schtasks.exe
2844	schtasks.exe
2952	schtasks.exe
1840	schtasks.exe
3012	schtasks.exe
788	schtasks.exe
448	schtasks.exe
2692	schtasks.exe
1896	schtasks.exe
2980	schtasks.exe
2360	schtasks.exe
1136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe
2856	BridgeServerruntime.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	BridgeServerruntime.exe
Token: SeDebugPrivilege	916	cmd.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2524	2308	EC5FDACECCEEE343335D6A686CE75864.exe	30
PID 2308 wrote to memory of 2524	2308	EC5FDACECCEEE343335D6A686CE75864.exe	30
PID 2308 wrote to memory of 2524	2308	EC5FDACECCEEE343335D6A686CE75864.exe	30
PID 2308 wrote to memory of 2524	2308	EC5FDACECCEEE343335D6A686CE75864.exe	30
PID 2524 wrote to memory of 2728	2524	WScript.exe	32
PID 2524 wrote to memory of 2728	2524	WScript.exe	32
PID 2524 wrote to memory of 2728	2524	WScript.exe	32
PID 2524 wrote to memory of 2728	2524	WScript.exe	32
PID 2728 wrote to memory of 2856	2728	cmd.exe	34
PID 2728 wrote to memory of 2856	2728	cmd.exe	34
PID 2728 wrote to memory of 2856	2728	cmd.exe	34
PID 2728 wrote to memory of 2856	2728	cmd.exe	34
PID 2856 wrote to memory of 2984	2856	BridgeServerruntime.exe	39
PID 2856 wrote to memory of 2984	2856	BridgeServerruntime.exe	39
PID 2856 wrote to memory of 2984	2856	BridgeServerruntime.exe	39
PID 2984 wrote to memory of 1640	2984	csc.exe	41
PID 2984 wrote to memory of 1640	2984	csc.exe	41
PID 2984 wrote to memory of 1640	2984	csc.exe	41
PID 2856 wrote to memory of 2888	2856	BridgeServerruntime.exe	57
PID 2856 wrote to memory of 2888	2856	BridgeServerruntime.exe	57
PID 2856 wrote to memory of 2888	2856	BridgeServerruntime.exe	57
PID 2888 wrote to memory of 1060	2888	cmd.exe	59
PID 2888 wrote to memory of 1060	2888	cmd.exe	59
PID 2888 wrote to memory of 1060	2888	cmd.exe	59
PID 2888 wrote to memory of 1500	2888	cmd.exe	60
PID 2888 wrote to memory of 1500	2888	cmd.exe	60
PID 2888 wrote to memory of 1500	2888	cmd.exe	60
PID 2888 wrote to memory of 916	2888	cmd.exe	61
PID 2888 wrote to memory of 916	2888	cmd.exe	61
PID 2888 wrote to memory of 916	2888	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EC5FDACECCEEE343335D6A686CE75864.exe
"C:\Users\Admin\AppData\Local\Temp\EC5FDACECCEEE343335D6A686CE75864.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WebWinBrokerDll\d7VV42fpHwMzBQMSzwM0QGomZi6nsu6X6fwca17SIFxI7SHNedkYCWqtFx6.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\WebWinBrokerDll\OH5MsEg2KeRkhqJt.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\WebWinBrokerDll\BridgeServerruntime.exe
      "C:\WebWinBrokerDll/BridgeServerruntime.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2sdsspeu\2sdsspeu.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2984
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1C28.tmp" "c:\Windows\System32\CSCEA255792B6AD4A048CBD50A01348FFF7.TMP"
        6⤵
        
        PID:1640
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RJjtEq8owq.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1060
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1500
      - C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe
        
        "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeServerruntimeB" /sc MINUTE /mo 7 /tr "'C:\WebWinBrokerDll\BridgeServerruntime.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeServerruntime" /sc ONLOGON /tr "'C:\WebWinBrokerDll\BridgeServerruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "BridgeServerruntimeB" /sc MINUTE /mo 14 /tr "'C:\WebWinBrokerDll\BridgeServerruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES1C28.tmp

Filesize
1KB

MD5
78b9523a1938a8848b66131be9225735

SHA1
25e6528bc97dcb2c60450d36ba5852c9428b0312

SHA256
3980ee6b2d27bfdd782b80017193e5daed77a7174f2cfe241ffed064b2e8d277

SHA512
87c415c0bfc5c49ce487d17efe8a5856dc637344629c9adee7f106fe03940ee99a52bc8b3db5b7b3f1357e404f72ddced6ff1c7f81f19e5021bfb9a403a75d20

Download Submit
C:\Users\Admin\AppData\Local\Temp\RJjtEq8owq.bat

Filesize
198B

MD5
30e28bbc3f4a60cd74474c677c2aff51

SHA1
4694f51283ddb53cb7634b2cab89d1e39ad075d2

SHA256
f684ac720afb1d611ae3fc1f7e0b29fb58f9101b3c36bfc20a1d9647c6f3c509

SHA512
75398a9b8f4833dfa879d95187b7928f1419bfd8a2a852f708cb4c17191b80e27d177b87f699794c802cd4d420a34658a3fa582a2fce22306902b87cdec0e2ce

Download Submit
C:\WebWinBrokerDll\OH5MsEg2KeRkhqJt.bat

Filesize
107B

MD5
41c6e0e5b5a7be33fd9e1f2c02adcc1e

SHA1
1fb52df44fb4a90bcc7311238dedfc1b9ccc6b4f

SHA256
f873310a27b36240c42e0d93c877096e7163d2de480caf83fdce2ef1168376e9

SHA512
a1ca006a8d9300f3743350243bf90629522bb2f71c80a8f3a6cc41759a5746a9bbe932b69e4ca46de7de3c555d66fe2f86c13a717806cc9acdbc80f02525c0be

Download Submit
C:\WebWinBrokerDll\d7VV42fpHwMzBQMSzwM0QGomZi6nsu6X6fwca17SIFxI7SHNedkYCWqtFx6.vbe

Filesize
210B

MD5
7f45c1ae3ffa088fd090281714ccd636

SHA1
e256ac2063feb5bbda9261ebd6941fe391fd5e62

SHA256
096a645b2d6d4d076b4ee48d1e88372c59f895ce7db2a31d8f8aa0132d7ea5bd

SHA512
cadcc93806689bf5b7c3679d160bc9000d6597fea1143f60fa98cc3bcc3107d0efeb2abf661d37ac80189d01fba1e43c533a0f0f31b006eda2175a2f558526b5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2sdsspeu\2sdsspeu.0.cs

Filesize
410B

MD5
5fc904b0971de57e5b22f4e42d869646

SHA1
042a445b762920f386c1ac10309c3e6bc99aa16d

SHA256
b1d02ca1e195ba84f468a4f2e6e5e00e43624f0f155ad901e448ac48f1e4fc08

SHA512
591ba82104e690dc9d26b0656aec76ae1b50e8bff700ce0ae8164d4382c3c8929f727668b327dab07a8ff2f3e3d3d252546f37e2d2c29f2705930d3fb7cb00f8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2sdsspeu\2sdsspeu.cmdline

Filesize
235B

MD5
843d6206df4788aa0b6eb3d736f861fe

SHA1
c113739dd09cead3bb9ae9aacb53c0f1a70b385d

SHA256
a5c8ba9ac5a280fc63699be24a840bf50233bd02a8a20d9cf67806bfbcbfe472

SHA512
3df86e8278f1fac6d776612284a40502cbcdde161423e69fffebd71cad010d3854fa7771f4337e2a9029788243a8396b0e4c64e8f5ec324353338a1b9142fd92

Download Submit
\??\c:\Windows\System32\CSCEA255792B6AD4A048CBD50A01348FFF7.TMP

Filesize
1KB

MD5
b74f131aab310dc6e37b43e729c24199

SHA1
bade4cf35d7e80e79880396c1fdd518d9ab78bdf

SHA256
5fdff2a34cc18e36619ff327b292a8255286dc102d85074b7fc625ccbdbe1858

SHA512
733cb12c94d0a8bedc9a38c073dff2fc46553854d7e835767aaa749b4754beef77fa3bc8232eab21c92bc808c08b150cafe5c035bb33d82292fbf76fec55d885

Download Submit
\WebWinBrokerDll\BridgeServerruntime.exe

Filesize
1.8MB

MD5
56554dd4e4fb40b0b5e23cbac2632fda

SHA1
639002e98be388ecb14d2b973388531a124f2311

SHA256
e93b10e93c375f1e7a2ad0df4c213a1630d64cac96e6467dd0926b2d44dac295

SHA512
8bc6fb271d6459dcf0c27794dc9f90b83d606c100bc762ada33df238011d0518c85da3c64b37f451706a67030cc99f6a1194d65e2bc5a30ed1e5e029a3bb7288

Download Submit
memory/916-50-0x0000000000160000-0x0000000000330000-memory.dmp

Filesize
1.8MB

Download
memory/2856-13-0x00000000001E0000-0x00000000003B0000-memory.dmp

Filesize
1.8MB

Download
memory/2856-19-0x0000000002170000-0x0000000002188000-memory.dmp

Filesize
96KB

Download
memory/2856-17-0x0000000002150000-0x000000000216C000-memory.dmp

Filesize
112KB

Download
memory/2856-15-0x0000000000770000-0x000000000077E000-memory.dmp

Filesize
56KB

Download