dcrat | 5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617

Analysis

max time kernel
25s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
Size

1.7MB
MD5

53c51f410e619914de7f9dda8c18da66
SHA1

5da42c476ccf634dc842e68c6af360f0831e472a
SHA256

5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617
SHA512

3a93a35a781a17dcd45dd74b79cb52c0bc15d9320ac44c47d1e1a97e644aa4bb1f9977b32d8de6a070bd8753646b1889f04f9a5b95fc6829be1b6c43247beb1c
SSDEEP

24576:t3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJg:tgwuuEpdDLNwVMeXDL0fdSzAGD

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2732	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2732	schtasks.exe	30

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2516-1-0x00000000009C0000-0x0000000000B76000-memory.dmp	dcrat
behavioral1/files/0x000b000000012029-29.dat	dcrat
behavioral1/memory/1892-78-0x0000000001220000-0x00000000013D6000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2928	powershell.exe
476	powershell.exe
1648	powershell.exe
1592	powershell.exe
812	powershell.exe
572	powershell.exe
1444	powershell.exe
2624	powershell.exe
632	powershell.exe
1556	powershell.exe
2824	powershell.exe
2964	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe

Executes dropped EXE 2 IoCs

pid	Process
1892	Idle.exe
1432	Idle.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\ja-JP\spoolsv.exe	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
File created	C:\Program Files\Windows Journal\ja-JP\f3b6ecef712a24	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\RCXB011.tmp	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\RCXB012.tmp	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
File opened for modification	C:\Program Files\Windows Journal\ja-JP\spoolsv.exe	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2876	schtasks.exe
2904	schtasks.exe
2852	schtasks.exe
2748	schtasks.exe
2784	schtasks.exe
2648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
1592	powershell.exe
476	powershell.exe
2624	powershell.exe
1444	powershell.exe
2964	powershell.exe
1648	powershell.exe
572	powershell.exe
632	powershell.exe
812	powershell.exe
2824	powershell.exe
1556	powershell.exe
2928	powershell.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe
1892	Idle.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	476	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	572	powershell.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	1892	Idle.exe
Token: SeDebugPrivilege	1432	Idle.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2624	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	37
PID 2516 wrote to memory of 2624	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	37
PID 2516 wrote to memory of 2624	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	37
PID 2516 wrote to memory of 476	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	38
PID 2516 wrote to memory of 476	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	38
PID 2516 wrote to memory of 476	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	38
PID 2516 wrote to memory of 1648	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	39
PID 2516 wrote to memory of 1648	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	39
PID 2516 wrote to memory of 1648	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	39
PID 2516 wrote to memory of 1592	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	40
PID 2516 wrote to memory of 1592	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	40
PID 2516 wrote to memory of 1592	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	40
PID 2516 wrote to memory of 632	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	41
PID 2516 wrote to memory of 632	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	41
PID 2516 wrote to memory of 632	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	41
PID 2516 wrote to memory of 1556	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	42
PID 2516 wrote to memory of 1556	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	42
PID 2516 wrote to memory of 1556	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	42
PID 2516 wrote to memory of 812	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	43
PID 2516 wrote to memory of 812	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	43
PID 2516 wrote to memory of 812	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	43
PID 2516 wrote to memory of 572	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	44
PID 2516 wrote to memory of 572	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	44
PID 2516 wrote to memory of 572	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	44
PID 2516 wrote to memory of 1444	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	45
PID 2516 wrote to memory of 1444	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	45
PID 2516 wrote to memory of 1444	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	45
PID 2516 wrote to memory of 2824	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	46
PID 2516 wrote to memory of 2824	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	46
PID 2516 wrote to memory of 2824	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	46
PID 2516 wrote to memory of 2964	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	47
PID 2516 wrote to memory of 2964	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	47
PID 2516 wrote to memory of 2964	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	47
PID 2516 wrote to memory of 2928	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	48
PID 2516 wrote to memory of 2928	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	48
PID 2516 wrote to memory of 2928	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	48
PID 2516 wrote to memory of 1892	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	60
PID 2516 wrote to memory of 1892	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	60
PID 2516 wrote to memory of 1892	2516	5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe	60
PID 1892 wrote to memory of 2956	1892	Idle.exe	62
PID 1892 wrote to memory of 2956	1892	Idle.exe	62
PID 1892 wrote to memory of 2956	1892	Idle.exe	62
PID 1892 wrote to memory of 2796	1892	Idle.exe	63
PID 1892 wrote to memory of 2796	1892	Idle.exe	63
PID 1892 wrote to memory of 2796	1892	Idle.exe	63
PID 2956 wrote to memory of 1432	2956	WScript.exe	65
PID 2956 wrote to memory of 1432	2956	WScript.exe	65
PID 2956 wrote to memory of 1432	2956	WScript.exe	65

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe
"C:\Users\Admin\AppData\Local\Temp\5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617.exe"
1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe
  "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7033cb8e-b5de-4ab8-bddb-0759a09fb9d8.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe
      "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52b46dee-e825-4233-a7ce-7c1f4dc2b6ce.vbs"
    3⤵
    PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Journal\ja-JP\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\ja-JP\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Idle.exe

Filesize
1.7MB

MD5
53c51f410e619914de7f9dda8c18da66

SHA1
5da42c476ccf634dc842e68c6af360f0831e472a

SHA256
5a0a10f6b1fdbfa50ad78bc71702a21275cedc7c7da7171e4ca86b01314e0617

SHA512
3a93a35a781a17dcd45dd74b79cb52c0bc15d9320ac44c47d1e1a97e644aa4bb1f9977b32d8de6a070bd8753646b1889f04f9a5b95fc6829be1b6c43247beb1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\52b46dee-e825-4233-a7ce-7c1f4dc2b6ce.vbs

Filesize
523B

MD5
fbca60256d1b94c8ea41b1702ea466a6

SHA1
d88fca11ff319b5e9daf7924f1de50a63372309d

SHA256
8d78e3d0cdac9e7c234af4ef8eb7f91a093d6d5be21246b28a0371e89de099d9

SHA512
285333ef3a824cf8ba62509b64a098b5a2eab0b4d70f3e33ac877f99bb7ff450460b62ef486863c3ba3bd6158deabb1f6fa237e483f1d03a6ca992a935cb23d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7033cb8e-b5de-4ab8-bddb-0759a09fb9d8.vbs

Filesize
747B

MD5
6df24137ebb0d5718acdcfd4a91fcce7

SHA1
2d07f07484c303c47c0c4ffe655e28ca7b8890e1

SHA256
b1654ee08d4c607e142518359a376c2a5b57fd6feb7ae6b0dde98ec02de82a2d

SHA512
1a29df280071212167cdfe77d9314465798a232b0fc78fde854c3b65f97f06f96732939167d9d7e46a3672598ea7a629b5a066d1679bbbbea8bad93432f2792d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
eeb904957b404b57d6b72fb365ff6687

SHA1
833fce3528a182e3141e7edba0835485745673da

SHA256
f6eff4d416a336269d1342ced3de50a3947510751dc99f3e6a744e4b7f0f2592

SHA512
6cb7f95c3504bb2b9fa8162fb39c9e79511a1786b4bbb16352a8e6e3cd7f4db003c6a5949ec8a4b90922f042de689f79bbc245557ccbe86e943fa57f51b30f60

Download Submit
memory/476-63-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/1592-77-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/1892-122-0x00000000004A0000-0x00000000004B2000-memory.dmp

Filesize
72KB

Download
memory/1892-78-0x0000000001220000-0x00000000013D6000-memory.dmp

Filesize
1.7MB

Download
memory/2516-6-0x00000000009A0000-0x00000000009B6000-memory.dmp

Filesize
88KB

Download
memory/2516-20-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-10-0x0000000002280000-0x0000000002288000-memory.dmp

Filesize
32KB

Download
memory/2516-12-0x0000000002290000-0x000000000229C000-memory.dmp

Filesize
48KB

Download
memory/2516-15-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/2516-14-0x00000000023B0000-0x00000000023BA000-memory.dmp

Filesize
40KB

Download
memory/2516-13-0x00000000022A0000-0x00000000022AC000-memory.dmp

Filesize
48KB

Download
memory/2516-16-0x00000000023D0000-0x00000000023DC000-memory.dmp

Filesize
48KB

Download
memory/2516-17-0x000000001A850000-0x000000001A85C000-memory.dmp

Filesize
48KB

Download
memory/2516-9-0x0000000002270000-0x000000000227C000-memory.dmp

Filesize
48KB

Download
memory/2516-8-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/2516-7-0x0000000002190000-0x00000000021A2000-memory.dmp

Filesize
72KB

Download
memory/2516-0-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

Filesize
4KB

Download
memory/2516-5-0x0000000000990000-0x00000000009A0000-memory.dmp

Filesize
64KB

Download
memory/2516-4-0x0000000000980000-0x0000000000988000-memory.dmp

Filesize
32KB

Download
memory/2516-84-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-3-0x0000000000960000-0x000000000097C000-memory.dmp

Filesize
112KB

Download
memory/2516-2-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2516-1-0x00000000009C0000-0x0000000000B76000-memory.dmp

Filesize
1.7MB

Download