dcrat | 5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
Size

1.7MB
MD5

4c5cdbe993419be6ff5d2608e01f7620
SHA1

0f9cddc4a321cd1641d5c207f7223f61de0c54dd
SHA256

5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987
SHA512

cae371309fda6b5fee01284ca445be72c47ab0816a2451835e8da5c9ba8bd741eab2160602d62b8064b80220a713d1d89a5371bcb2f6aaafba7f7c10150696d9
SSDEEP

24576:t3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:tgwuuEpdDLNwVMeXDL0fdSzAG

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1208	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3816	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4464	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3420	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1880	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	2160	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	904	2160	schtasks.exe	82

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4616-1-0x00000000008B0000-0x0000000000A66000-memory.dmp	dcrat
behavioral2/files/0x000a000000023bab-30.dat	dcrat
behavioral2/files/0x000b000000023b9e-76.dat	dcrat
behavioral2/files/0x000c000000023b9e-95.dat	dcrat
behavioral2/files/0x000d000000023ba4-120.dat	dcrat
behavioral2/files/0x000b000000023bae-131.dat	dcrat
behavioral2/files/0x000e000000023bbc-179.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe
1984	powershell.exe
1600	powershell.exe
2672	powershell.exe
2176	powershell.exe
4748	powershell.exe
1992	powershell.exe
704	powershell.exe
3840	powershell.exe
1708	powershell.exe
3596	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 2 IoCs

pid	Process
4128	fontdrvhost.exe
2564	fontdrvhost.exe

Drops file in Program Files directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX344F.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\dllhost.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX3E0B.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX4020.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\SppExtComObj.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Windows Sidebar\5940a34987c991	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Windows Portable Devices\System.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\e1ef82546f0b02	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\RCX344E.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\taskhostw.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Internet Explorer\5b884080fd4f94	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\9e8d7a4ca61bd9	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX42A3.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\RCX49CE.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\69ddcba757bf72	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCX3916.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\SppExtComObj.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCX3E0C.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX4594.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Windows Sidebar\dllhost.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files\Windows Multimedia Platform\taskhostw.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCX38F6.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX409E.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\System.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\Mozilla Firefox\fonts\RCX49CD.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\RCX5156.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\e1ef82546f0b02	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files (x86)\Windows Portable Devices\27d1bcfc3c54e0	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\RCX50E7.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Program Files\Windows Multimedia Platform\ea9f0e6c9e2dcd	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX4525.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX4321.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TAPI\RCX4798.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Windows\TAPI\RCX4799.tmp	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File opened for modification	C:\Windows\TAPI\winlogon.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Windows\TAPI\winlogon.exe	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
File created	C:\Windows\TAPI\cc11b995f2a76d	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2084	schtasks.exe
388	schtasks.exe
1752	schtasks.exe
1880	schtasks.exe
5048	schtasks.exe
904	schtasks.exe
2552	schtasks.exe
2288	schtasks.exe
2596	schtasks.exe
4372	schtasks.exe
1520	schtasks.exe
3812	schtasks.exe
1500	schtasks.exe
1208	schtasks.exe
2848	schtasks.exe
3420	schtasks.exe
232	schtasks.exe
908	schtasks.exe
2884	schtasks.exe
4272	schtasks.exe
1432	schtasks.exe
4864	schtasks.exe
3200	schtasks.exe
4780	schtasks.exe
4492	schtasks.exe
4464	schtasks.exe
2880	schtasks.exe
4008	schtasks.exe
3816	schtasks.exe
4852	schtasks.exe
1240	schtasks.exe
4024	schtasks.exe
5088	schtasks.exe
2540	schtasks.exe
4580	schtasks.exe
628	schtasks.exe
1456	schtasks.exe
2700	schtasks.exe
4824	schtasks.exe
2036	schtasks.exe
3636	schtasks.exe
4336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
2176	powershell.exe
2176	powershell.exe
1708	powershell.exe
1708	powershell.exe
1600	powershell.exe
1600	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	2672	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	4748	powershell.exe
Token: SeDebugPrivilege	4128	fontdrvhost.exe
Token: SeDebugPrivilege	2564	fontdrvhost.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4412	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	129
PID 4616 wrote to memory of 4412	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	129
PID 4616 wrote to memory of 4748	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	131
PID 4616 wrote to memory of 4748	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	131
PID 4616 wrote to memory of 3596	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	132
PID 4616 wrote to memory of 3596	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	132
PID 4616 wrote to memory of 2176	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	133
PID 4616 wrote to memory of 2176	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	133
PID 4616 wrote to memory of 2672	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	134
PID 4616 wrote to memory of 2672	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	134
PID 4616 wrote to memory of 1708	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	135
PID 4616 wrote to memory of 1708	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	135
PID 4616 wrote to memory of 1600	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	136
PID 4616 wrote to memory of 1600	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	136
PID 4616 wrote to memory of 3840	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	137
PID 4616 wrote to memory of 3840	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	137
PID 4616 wrote to memory of 704	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	138
PID 4616 wrote to memory of 704	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	138
PID 4616 wrote to memory of 1992	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	139
PID 4616 wrote to memory of 1992	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	139
PID 4616 wrote to memory of 1984	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	140
PID 4616 wrote to memory of 1984	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	140
PID 4616 wrote to memory of 4128	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	153
PID 4616 wrote to memory of 4128	4616	5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe	153
PID 4128 wrote to memory of 4636	4128	fontdrvhost.exe	154
PID 4128 wrote to memory of 4636	4128	fontdrvhost.exe	154
PID 4128 wrote to memory of 1268	4128	fontdrvhost.exe	155
PID 4128 wrote to memory of 1268	4128	fontdrvhost.exe	155
PID 4636 wrote to memory of 2564	4636	WScript.exe	156
PID 4636 wrote to memory of 2564	4636	WScript.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe
"C:\Users\Admin\AppData\Local\Temp\5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987N.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe
  "C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76142fcd-c060-4631-b5ab-2b00c9eed66e.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe
      "C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23e4da6f-0a77-4e39-9e90-4720f784d3c1.vbs"
    3⤵
    PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Public\Videos\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Videos\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\TAPI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\fonts\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe

Filesize
1.7MB

MD5
7f1c24f74ac4a0341a92d70f5de66056

SHA1
6b965ebc060e95dc027354eea81adb349844dc35

SHA256
290c09852628c7851a5ec325f363ced4549e99b61f3487664b4c68ff4d79ef2f

SHA512
353222667cca6e531a651750216d0e439f594fdd0cbc7a6e65fd9661c54b10edc989bafb1b1d12949c1b5cd0e976dde76f186a0a203ea7143d256ff6dc91c98f

Download Submit
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\smss.exe

Filesize
1.7MB

MD5
fdacbdc1294e02369a2dbc0a5f81df7e

SHA1
a8d1599f78752fcbb926c9903615df0267bbd09e

SHA256
5557c1183b95c1b434577848f1a0fa815a0330e397c8e3a63cd2c7d7003e2318

SHA512
f38583286ae77757e11166a2abfabf4c3df32c47269c63c74a606719ae3e8343d0c8f5fa61aa88e31ca57f25e6fe51e4f5eb32ec6d050f7a64d13101d9ff0e7b

Download Submit
C:\Program Files\Windows Multimedia Platform\taskhostw.exe

Filesize
1.7MB

MD5
4c5cdbe993419be6ff5d2608e01f7620

SHA1
0f9cddc4a321cd1641d5c207f7223f61de0c54dd

SHA256
5a57068f66938c8c0346643f8cedd304cd572b3c3f55e15887081b94edaa8987

SHA512
cae371309fda6b5fee01284ca445be72c47ab0816a2451835e8da5c9ba8bd741eab2160602d62b8064b80220a713d1d89a5371bcb2f6aaafba7f7c10150696d9

Download Submit
C:\Recovery\WindowsRE\System.exe

Filesize
1.7MB

MD5
041a0aed95c23e602e8fc89ea6d4beb0

SHA1
4ad8667d8aab5b5fbdcf8b42904a8b921eced30a

SHA256
5df48cc37bd62e0cb75c33d2c390620f99e8a8e4fe7e29ddcd9e8fde355f0bac

SHA512
63c2eb2a435396e4840c52ff0ebf55e8ff2ca8fc9f3f1188fc20b7d11ed8b7f12cf10ae57bd23852a78489195e55dc689031799aa00556cc5b162efa85b34164

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

Filesize
1KB

MD5
3ad9a5252966a3ab5b1b3222424717be

SHA1
5397522c86c74ddbfb2585b9613c794f4b4c3410

SHA256
27525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249

SHA512
b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\23e4da6f-0a77-4e39-9e90-4720f784d3c1.vbs

Filesize
508B

MD5
50fe509c5cd6cc41ba7862a2961c6f10

SHA1
eb37202707a71387faa8172a3dba57f9ae76ff1d

SHA256
3ca815b026e71a39cec7ef04822522ca1f37dec390daf1f8df8c90c5639cf886

SHA512
cfee517ff69dbf55c436ef04014561be932c565aa1cb87fd7bbae9f947e81476851f40a071c7564ed72893aa88ac3492512223864dad213d1fdbc062edbea2c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\76142fcd-c060-4631-b5ab-2b00c9eed66e.vbs

Filesize
732B

MD5
c37ceb6a25cd16a218ad5cdc2cb5d5d4

SHA1
bd815728af000c2bfd65077311b156ae4bb0c265

SHA256
18f406706a8978225d189773fe9a54ce1c4c83030b4cb5346322507d2f4f860d

SHA512
fbffb24dcda9b63d5bb45cd38280831b3795871ff99bb039410ea95e69c3cab570383047f68b4f32357c4f7b1a47e2f5d591737c146dbb762f345359dc8c828f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1fnzulim.bp1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\Music\smss.exe

Filesize
1.7MB

MD5
9776399c58f7db54fa81d1ac87e00b27

SHA1
dc1f3e6f063343d919012ada0f062b1c8d9901e5

SHA256
0f9b9ba611c59b02256f18c40d8c17606592405c0a60b082ab36ec4b28ffb61b

SHA512
f5e2f17a6875a0326201bb659f461ff2aab923565a55bb43ddc378c1f0d4c661b810d4d0a2c1f18e3b2a156a6900366794abe17b928d6722fa7560ce8bacd054

Download Submit
C:\Users\Public\Videos\RCX36F1.tmp

Filesize
1.7MB

MD5
a2d33cadf540bb2c25dd895b63c3c942

SHA1
ee0936ff2f583b62e750265967be43986a50e987

SHA256
3cb300a495ce4ce5c4e5dd4245d76446fed87240b551932dfe606efe6951f76b

SHA512
1164b85785b3a4a03db598d9d3242bafb21c92933ccca1e45f4c3cc173ceb9f8a9df92371668ebc37eca45749767df5ddabd5ff9227941eb8d0317845b2b669d

Download Submit
memory/2176-275-0x00000203F2500000-0x00000203F2522000-memory.dmp

Filesize
136KB

Download
memory/2564-414-0x000000001BC40000-0x000000001BC52000-memory.dmp

Filesize
72KB

Download
memory/4128-378-0x0000000000EC0000-0x0000000000ED2000-memory.dmp

Filesize
72KB

Download
memory/4616-23-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-199-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-22-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-19-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-0-0x00007FFD9A553000-0x00007FFD9A555000-memory.dmp

Filesize
8KB

Download
memory/4616-16-0x000000001B780000-0x000000001B788000-memory.dmp

Filesize
32KB

Download
memory/4616-17-0x000000001B790000-0x000000001B79C000-memory.dmp

Filesize
48KB

Download
memory/4616-15-0x000000001B770000-0x000000001B77A000-memory.dmp

Filesize
40KB

Download
memory/4616-14-0x000000001B7D0000-0x000000001B7DC000-memory.dmp

Filesize
48KB

Download
memory/4616-13-0x000000001B760000-0x000000001B76C000-memory.dmp

Filesize
48KB

Download
memory/4616-134-0x00007FFD9A553000-0x00007FFD9A555000-memory.dmp

Filesize
8KB

Download
memory/4616-158-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-11-0x0000000002C60000-0x0000000002C68000-memory.dmp

Filesize
32KB

Download
memory/4616-18-0x000000001B7A0000-0x000000001B7AC000-memory.dmp

Filesize
48KB

Download
memory/4616-216-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-10-0x0000000002C50000-0x0000000002C5C000-memory.dmp

Filesize
48KB

Download
memory/4616-9-0x0000000002C70000-0x0000000002C80000-memory.dmp

Filesize
64KB

Download
memory/4616-377-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-7-0x0000000002BD0000-0x0000000002BE6000-memory.dmp

Filesize
88KB

Download
memory/4616-8-0x0000000002BF0000-0x0000000002C02000-memory.dmp

Filesize
72KB

Download
memory/4616-5-0x0000000002BB0000-0x0000000002BB8000-memory.dmp

Filesize
32KB

Download
memory/4616-6-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Filesize
64KB

Download
memory/4616-4-0x0000000002C00000-0x0000000002C50000-memory.dmp

Filesize
320KB

Download
memory/4616-3-0x0000000002B90000-0x0000000002BAC000-memory.dmp

Filesize
112KB

Download
memory/4616-2-0x00007FFD9A550000-0x00007FFD9B011000-memory.dmp

Filesize
10.8MB

Download
memory/4616-1-0x00000000008B0000-0x0000000000A66000-memory.dmp

Filesize
1.7MB

Download