dcrat | e7fe25f706806440e04205b7fbe8c4dc0bef064327770b7ba7682917090509f5

Analysis

max time kernel
172s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

taskHostw.exe
Size

1.1MB
MD5

9acac2f1709100c4f471c5c4d9a6559a
SHA1

b0de7b3d1340bb3edc9b67a6ae2be9d25f1e6172
SHA256

e7fe25f706806440e04205b7fbe8c4dc0bef064327770b7ba7682917090509f5
SHA512

196cea984b335b1cd03032d9002d799cb9bc85fb252f102510da8d3b14e0f02c15627f82c64cdc6ce086cf91e1960c0e3d6fc1bc539c657f1b0ff2e94276f1b8
SSDEEP

24576:U2G/nvxW3Ww0tGyuDFfYdKDe17qJSZLQ+r/kDIdCCj:UbA30yFbaqerDPdF

Score

10^/10

dcrat defense_evasion discovery infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe"	csrss.exe

Process spawned unexpected child process 44 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3360	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	184	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	4040	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4604	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	4440	schtasks.exe	137
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	4440	schtasks.exe	137

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Bridgebrokerperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Bridgebrokerperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Bridgebrokerperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000023c95-10.dat	dcrat
behavioral1/memory/916-13-0x0000000000D50000-0x0000000000E30000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	taskHostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Bridgebrokerperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	csrss.exe

Executes dropped EXE 2 IoCs

pid	Process
916	Bridgebrokerperf.exe
2152	csrss.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Bridgebrokerperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Bridgebrokerperf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	csrss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\System.Net.Sockets.dll	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OutlookAccount.scale-100.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLargeTile.scale-100.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\HostConfig.json	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-100.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-32.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-100.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-150.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-24_altform-unplated.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\ZviewOverlay.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-lightunplated.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16_altform-unplated.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptySearch.scale-125.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomSetupDisambig_DeskScale.jpg	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\15.jpg	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_ReptileEye.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-40.png	csrss.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\sqmapi.dll	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreLogo.scale-100.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_contrast-white.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jsaddins\locallaunch\locallaunchdlg.html	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-80.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-300.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\[email protected]	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-200.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-150.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-256.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\YahooPromoTile.scale-200.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-32.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-125.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.dll	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalMedTile.scale-125_contrast-white.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-100.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	csrss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-white_scale-100.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-300.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-200.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MediumTile.scale-125_contrast-black.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\MedTile.scale-125.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-100_contrast-black.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-16_altform-unplated_contrast-white.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\avutil-56_ms.dll	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsWideTile.contrast-black_scale-200.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FlagToastQuickAction.scale-80.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-250.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\SmallTile.scale-125.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\BuildInfo.xml	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hr-HR\View3d\3DViewerProductDescription-universal.xml	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-unplated_contrast-black.png	csrss.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcjavas.inc	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\cpprestsdk_winapp.dll	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Call_Ended.m4a	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-256.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_scale-200.png	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.Upgrade.dll	csrss.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\progress.gif	csrss.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Boot\EFI\da-DK\bootmgr.efi.mui	csrss.exe
File opened for modification	C:\Windows\INF\usbhub\0411\usbperf.ini	csrss.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100enu_x86	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll	csrss.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\fr-CA_BitLockerToGo.exe.mui	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\IESecurity\ja-JP\RS_IESecuritylevels.psd1	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\it-IT\CL_LocalizationData.psd1	csrss.exe
File opened for modification	C:\Windows\INF\mbtr8897w81x64.inf	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\DE\System.EnterpriseServices.Resources.dll	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\Apps\es-ES\DiagPackage.dll.mui	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsUpdate\CL_SetupEnv.ps1	csrss.exe
File opened for modification	C:\Windows\Globalization\ELS\SpellDictionaries\MsSp7fr.dub	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Xml.Linq.resources.dll	csrss.exe
File opened for modification	C:\Windows\INF\scmvolume.inf	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\Microsoft.Build.Engine.resources.dll	csrss.exe
File opened for modification	C:\Windows\Cursors\aero_nwse_l.cur	csrss.exe
File opened for modification	C:\Windows\Cursors\cross_im.cur	csrss.exe
File opened for modification	C:\Windows\Cursors\size2_i.cur	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\Power\TS_DimDisplay.ps1	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\Search\ja-JP\DiagPackage.dll.mui	csrss.exe
File opened for modification	C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\es-ES\charactermap.json	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\System.Runtime.Remoting.Resources.dll	csrss.exe
File opened for modification	C:\Windows\Media\Windows Navigation Start.wav	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\fr-FR\PresentationHostDLL.dll.mui	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\clretwrc.dll	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\Audio\TS_DisabledInCPL.ps1	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\BITS\fr-FR\CL_LocalizationData.psd1	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\es-ES\RS_DisableAddon.psd1	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Workflow.Activities.resources.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\Microsoft.VisualBasic.Compatibility.resources.dll	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\Power\fr-FR\RS_Adjustwirelessadaptersettings.psd1	csrss.exe
File opened for modification	C:\Windows\INF\mdmgen.inf	csrss.exe
File opened for modification	C:\Windows\Media\MovePrevious_48000Hz.raw	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\Device\RS_DriverNotFound.ps1	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\DeviceCenter\CL_Utility.ps1	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\uk-UA\DiagPackage.dll.mui	csrss.exe
File opened for modification	C:\Windows\Fonts\cga40866.fon	csrss.exe
File opened for modification	C:\Windows\Fonts\modern.fon	csrss.exe
File opened for modification	C:\Windows\INF\c_mcx.inf	csrss.exe
File opened for modification	C:\Windows\Cursors\aero_busy_xl.ani	csrss.exe
File opened for modification	C:\Windows\Fonts\corbell.ttf	csrss.exe
File opened for modification	C:\Windows\Globalization\ELS\SpellDictionaries\Fluency\it-IT\ime.json	csrss.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeLinguistic.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.IO.Compression.resources.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\Microsoft.Build.Utilities.Resources.dll	csrss.exe
File opened for modification	C:\Windows\diagnostics\system\IEBrowseWeb\it-IT\RS_RestoreIEconnection.psd1	csrss.exe
File opened for modification	C:\Windows\INF\.NET CLR Networking\_NetworkingPerfCounters_v2.h	csrss.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\dummy.dic	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\System.Workflow.Runtime.resources.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\Microsoft.Build.Conversion.v4.0.resources.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\mscorlib.resources.dll	csrss.exe
File opened for modification	C:\Windows\Media\Show_48000Hz.raw	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExecRemote.dll	csrss.exe
File opened for modification	C:\Windows\Cursors\person_r.cur	csrss.exe
File opened for modification	C:\Windows\Fonts\corbelli.ttf	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Workflow.ComponentModel.dll	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Security.resources.dll	csrss.exe
File opened for modification	C:\Windows\INF\netrasa.inf	csrss.exe
File opened for modification	C:\Windows\INF\prnms005.inf	csrss.exe
File opened for modification	C:\Windows\InputMethod\CHS\ChsPinyinDM03.lex	csrss.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe	csrss.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\indexc.dat	csrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskHostw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	taskHostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5092	schtasks.exe
2136	schtasks.exe
2572	schtasks.exe
4552	schtasks.exe
4956	schtasks.exe
3312	schtasks.exe
3188	schtasks.exe
3532	schtasks.exe
4420	schtasks.exe
32	schtasks.exe
408	schtasks.exe
3484	schtasks.exe
3384	schtasks.exe
1784	schtasks.exe
3360	schtasks.exe
4760	schtasks.exe
1008	schtasks.exe
2548	schtasks.exe
5036	schtasks.exe
4440	schtasks.exe
5008	schtasks.exe
184	schtasks.exe
1864	schtasks.exe
5064	schtasks.exe
2620	schtasks.exe
64	schtasks.exe
1596	schtasks.exe
1988	schtasks.exe
4932	schtasks.exe
4620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
916	Bridgebrokerperf.exe
2152	csrss.exe
2152	csrss.exe
2152	csrss.exe
2152	csrss.exe
2152	csrss.exe
2152	csrss.exe
2152	csrss.exe
2152	csrss.exe
2152	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	Bridgebrokerperf.exe
Token: SeDebugPrivilege	2152	csrss.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 396	844	taskHostw.exe	83
PID 844 wrote to memory of 396	844	taskHostw.exe	83
PID 844 wrote to memory of 396	844	taskHostw.exe	83
PID 396 wrote to memory of 3052	396	WScript.exe	92
PID 396 wrote to memory of 3052	396	WScript.exe	92
PID 396 wrote to memory of 3052	396	WScript.exe	92
PID 3052 wrote to memory of 916	3052	cmd.exe	94
PID 3052 wrote to memory of 916	3052	cmd.exe	94
PID 916 wrote to memory of 2152	916	Bridgebrokerperf.exe	125
PID 916 wrote to memory of 2152	916	Bridgebrokerperf.exe	125
PID 2152 wrote to memory of 2832	2152	csrss.exe	153
PID 2152 wrote to memory of 2832	2152	csrss.exe	153
PID 2832 wrote to memory of 1132	2832	cmd.exe	155
PID 2832 wrote to memory of 1132	2832	cmd.exe	155

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Bridgebrokerperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Bridgebrokerperf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Bridgebrokerperf.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\taskHostw.exe
"C:\Users\Admin\AppData\Local\Temp\taskHostw.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\webfontSessionBrokerHost\Ur1NipdNxN.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\webfontSessionBrokerHost\SpdD9zKqJDT3l.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\webfontSessionBrokerHost\Bridgebrokerperf.exe
      "C:\webfontSessionBrokerHost\Bridgebrokerperf.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:916
    - - C:\Program Files\Windows Photo Viewer\en-US\csrss.exe
        
        "C:\Program Files\Windows Photo Viewer\en-US\csrss.exe"
        5⤵
        Modifies WinLogon for persistence
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops autorun.inf file
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Music\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Admin\Music\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Music\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\L2Schemas\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\L2Schemas\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "Bridgebrokerperf" /f
1⤵
- Process spawned unexpected child process
PID:3672

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "BridgebrokerperfB" /f
1⤵
- Process spawned unexpected child process
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "csrss" /f
1⤵
- Process spawned unexpected child process
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "csrssc" /f
1⤵
- Process spawned unexpected child process
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "cmd" /f
1⤵
- Process spawned unexpected child process
PID:4604

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "cmdc" /f
1⤵
- Process spawned unexpected child process
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "dllhost" /f
1⤵
- Process spawned unexpected child process
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "dllhostd" /f
1⤵
- Process spawned unexpected child process
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "RuntimeBroker" /f
1⤵
- Process spawned unexpected child process
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "RuntimeBrokerR" /f
1⤵
- Process spawned unexpected child process
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "sihost" /f
1⤵
- Process spawned unexpected child process
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "sihosts" /f
1⤵
- Process spawned unexpected child process
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "csrss" /f
1⤵
- Process spawned unexpected child process
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /delete /tn "csrssc" /f
1⤵
- Process spawned unexpected child process
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\ja-JP\5940a34987c991

Filesize
511B

MD5
6dab694701b631a67a68ce70ac0fba37

SHA1
86ac87bd36a9e9d34a6fe83faa29384f6f87bde9

SHA256
3615ccd932d223a6d1485fe8b78c8c8acd3546bef761defde8425029b3298c5c

SHA512
e2dcb223c691597ecaddd007e0354ac7bf467235b3275b3c37a3c92dabe3a429dc43235e5eef05dd69b762042418d6bf0abc2abdfd56f91f071c1bffb704d96a

Download Submit
C:\Program Files\MSBuild\22eafd247d37c3

Filesize
822B

MD5
d8edd458d7319ffd0ab9cd40a21125d1

SHA1
a3b6dbf7c03de53513c4ecea3054446f518e3030

SHA256
3fc2957eff55615adb76e8e18f8b6dc148341ce8be0523230bffb9d58b406248

SHA512
2aaf0a52d4ffd2283fc7516426dbc7f11c268ab6bd625e49c8849c1cc33121e7fcfed09edb560b21247dff2dc20d7a7728c303337da7b93df21afd4e5d081b8f

Download Submit
C:\Program Files\Windows Media Player\de-DE\886983d96e3d3e

Filesize
714B

MD5
438c554a8cd748fe964557cbe2c2b776

SHA1
6d0caeee28bd37bdc884271d0e7ce4eedb418581

SHA256
d3dab7a0b5be25ce1cfb486b7fcae2093aae4f81537e88cb155b295007db6cd2

SHA512
0c5f538063c2295e338aec82aa5cf08c6765bfd6bd07da43491a4ccb94ea37b2623b53b69f73f0413f826b53f50358242b51f4201280a8cbfe9040a1564d9fc3

Download Submit
C:\Program Files\Windows Photo Viewer\en-US\886983d96e3d3e

Filesize
760B

MD5
3d81dd588d3e5c4e3f14efd746a22d04

SHA1
cf2d0522f41cf69254e8bdfee04e6cd395b0e75d

SHA256
366129d7fd7ddc1548703755c70bb5c85d5763bf9087b71f65b5ac21ee5a1fae

SHA512
a02a3dafbf694087da6b3eeb353e8b13e5f8817ec25ab09f3e710efae5e50bbd55341fcb3c1e22b86ae64652303758832b0e4161d651aeaaaa957fc05f7a4c04

Download Submit
C:\Recovery\WindowsRE\9e8d7a4ca61bd9

Filesize
67B

MD5
145d19ba0335687d32fb47366c9ce9ab

SHA1
921a9e040d5292d960f264b992919e003ab42570

SHA256
513e716578ded861a735d1f89b7172b08f1269c908f91b586ddb614697f18679

SHA512
1187f04bdedfcfd5c92e79d3ce23d39aba6589e284481b850b5fbcde58b56ff1cc36598aaa384bb5c0fde88dec2d45071c78b773b9705725bb4c1e840b9b8d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat

Filesize
297B

MD5
6592153d8c9ed9dcb2129fb2c5ce17e0

SHA1
4a332986fcf8be0c43e0ae225ef3a28dc52b61ee

SHA256
1bfba54f1715e3955780414b906a295f85b0b28d76152af3eaa05c415c1dff69

SHA512
43a4e723ef3b57f166c0aa153839634b712915b47db586d42aa71ba4f324aa0851ca3c08cf5a6e5ce84ccde89c9cd7e46707d6191ced5faa6684e3184852f07c

Download Submit
C:\Users\Admin\Music\ebf1f9fa8afd6d

Filesize
984B

MD5
0e957b0b46a173ddbb61da75c9ad00ae

SHA1
891eda656ed68b30012e14dc0c4a8e481961c810

SHA256
b58e05b917f80d37cffdd556d52807da1ba46651b0c27bc4bc5dac562b9d068e

SHA512
477bc0788da05e35972407acdfa67399be9f4d186c070789e1e217a763b360906a7994b6775713ca193f3d66d38e85fdb48c6bcd46bc9bd6d628ff348c07cde9

Download Submit
C:\Users\Public\Pictures\66fc9ff0ee96c2

Filesize
375B

MD5
fd5953a590691e4974bc837f9aa57b5b

SHA1
2c5b002ddd4b6e15e66eb7b09b27ec59ebe98baa

SHA256
db1935147b61e72bde2991607c179da2190544d7913436c48019df3decdbec39

SHA512
1cd6137c1042e63fd43d5f181dfa234bd5f52b499752b524f8663b515a47f47c4cf0e1c4d32e7a68c0b89a69fac9981df1d64d91cf10cc637047b947a7ec2553

Download Submit
C:\Windows\L2Schemas\ee2ad38f3d4382

Filesize
850B

MD5
b210b403d847e7fef6c61e106cb1820b

SHA1
9d8777579d8546eb62dfdde79fc605a008fdc4c1

SHA256
eab65bbfc685f360b115515130f9035700cd7c07b49e0c1be9eff4043c393bf3

SHA512
c1f1a654c22ad5e39e24b028793b1d9afd929c78c7c995b3044b5194170b635e0dcd562ecabd05406eb9c492cfa10a194090763054c162b6b4efcd1a21042de3

Download Submit
C:\Windows\de-DE\f3b6ecef712a24

Filesize
275B

MD5
eb563c54684e9cc3e6b21538514bb845

SHA1
b4266cfcf5d60042c7944bb7e78dd8135d3c0c88

SHA256
b7eed7943acef1245f6b05a9bc6e328251009dd55c2b6a53d6ea6dbaeab0fc3b

SHA512
7f53002be03e4ee7f11105d16c5e20eb78379ac0e2b7f3e3872d3e0ef065f38ebb33feff567a18607490fd09435120f98341b7552ad3e06fd7a1a11d932b4b2d

Download Submit
C:\webfontSessionBrokerHost\Bridgebrokerperf.exe

Filesize
865KB

MD5
1465b464ff78a41cf8af12d58ca62588

SHA1
9c4904b19b2b111c9c96cb0aba28aa3413b54c83

SHA256
485228dc5bfeb7694133fd50861f0c48f314003f8ee1030db3d063d07930bd3a

SHA512
c609086d161150a3754240aab9f76904a221314374b7b5c373bd9548bce6ec1cce509564523c9b8b2a16710f8ecbe558dd7b8f62adecc2007fe83320a19bdb0b

Download Submit
C:\webfontSessionBrokerHost\SpdD9zKqJDT3l.bat

Filesize
50B

MD5
37e781c64e1e5057220cc587925258d4

SHA1
3cd34c35d3d528b8ec2952d6c616cc3896b2dc66

SHA256
24510bbfd8f20c029b17d88853e82dbc2d2637b52dc76be8ceebf57243cac344

SHA512
3fa6c68ea554401af69bdf21061b17d9c068a2e7f42b2901c4a3e18d14aae7b52706fd24edc2f2da06db806a8b3d00dbdbfe3b963d72945af0801c8c3c9840ba

Download Submit
C:\webfontSessionBrokerHost\Ur1NipdNxN.vbe

Filesize
215B

MD5
56f8dfb763248f67943afcc431c9a28c

SHA1
b31a8e990b3971d27bbb0ff1c9bcff6fbaf33211

SHA256
db5202acf3a53d23f14faa846e27c2415cb33c26b5ac151a298209a0e7a1e4ac

SHA512
c0a81de45024a042abfc5876f3fde486b2ae809ac2d5ff099cd2d288ba863b0bff86cf4d6fda335a7eb40a2c26218e3ffb417d20b7167c9dd54be4b74e921b6b

Download Submit
memory/916-14-0x0000000002F60000-0x0000000002F6A000-memory.dmp

Filesize
40KB

Download
memory/916-13-0x0000000000D50000-0x0000000000E30000-memory.dmp

Filesize
896KB

Download
memory/916-12-0x00007FF855753000-0x00007FF855755000-memory.dmp

Filesize
8KB

Download