dcrat | 0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012

Analysis

max time kernel
119s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
Size

1.7MB
MD5

41ab31f7992973414712ec5526c1fc70
SHA1

bd1eb2471b1a16ef2e2bc29571c98b670de563f3
SHA256

0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012
SHA512

f3d90be2a0fbb838fbaf222ec6d64db5597e8104d53f863e0240cb8fd5bf72fb7f3c3d072b37e91967f80f4c298c295886eff89fd7b9831bbf8f2bc6d7120960
SSDEEP

49152:T+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKv:+THUxUoh1IF9gl2

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4752	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5092	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2372	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	824	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	824	schtasks.exe	83

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/3016-1-0x0000000000590000-0x0000000000750000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cb1-30.dat	dcrat
behavioral2/files/0x000b000000023cdc-109.dat	dcrat
behavioral2/files/0x0009000000023cb1-120.dat	dcrat
behavioral2/files/0x0009000000023cb8-131.dat	dcrat
behavioral2/files/0x000400000001e762-142.dat	dcrat
behavioral2/files/0x0009000000023cde-166.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4248	powershell.exe
772	powershell.exe
4448	powershell.exe
5092	powershell.exe
2920	powershell.exe
4380	powershell.exe
4764	powershell.exe
972	powershell.exe
2244	powershell.exe
1284	powershell.exe
5064	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 3 IoCs

pid	Process
3984	taskhostw.exe
2528	taskhostw.exe
3300	taskhostw.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\lt-LT\dllhost.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Windows\System32\lt-LT\dllhost.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Windows\System32\lt-LT\5940a34987c991	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Windows\System32\lt-LT\RCXD03F.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Windows\System32\lt-LT\RCXD0BD.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Security\BrowserCore\0a1fd5f707cd16	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\ea9f0e6c9e2dcd	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCXCDBC.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXD2E1.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\RCXDC31.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files\ModifiableWindowsApps\SppExtComObj.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\5940a34987c991	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\RCXCE3A.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\sppsvc.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\RCXDC30.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\6ccacd8608530f	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RCXC297.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files\Windows Security\BrowserCore\sppsvc.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\RCXC296.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\RCXD35F.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\fr-FR\RCXCB98.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Windows\INF\RCXDE36.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Windows\INF\RuntimeBroker.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Windows\fr-FR\TextInputHost.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Windows\fr-FR\22eafd247d37c3	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Windows\INF\RuntimeBroker.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File created	C:\Windows\INF\9e8d7a4ca61bd9	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Windows\fr-FR\RCXCB1A.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Windows\fr-FR\TextInputHost.exe	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
File opened for modification	C:\Windows\INF\RCXDE35.tmp	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	taskhostw.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2476	schtasks.exe
3516	schtasks.exe
2864	schtasks.exe
4960	schtasks.exe
1068	schtasks.exe
4832	schtasks.exe
2528	schtasks.exe
4536	schtasks.exe
4248	schtasks.exe
2436	schtasks.exe
4752	schtasks.exe
3468	schtasks.exe
4472	schtasks.exe
4572	schtasks.exe
324	schtasks.exe
4376	schtasks.exe
4940	schtasks.exe
112	schtasks.exe
3344	schtasks.exe
4492	schtasks.exe
5020	schtasks.exe
5064	schtasks.exe
3056	schtasks.exe
4552	schtasks.exe
3160	schtasks.exe
3644	schtasks.exe
4880	schtasks.exe
5092	schtasks.exe
2372	schtasks.exe
1384	schtasks.exe
3112	schtasks.exe
932	schtasks.exe
4528	schtasks.exe
5008	schtasks.exe
4584	schtasks.exe
820	schtasks.exe
3428	schtasks.exe
3276	schtasks.exe
3716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
2244	powershell.exe
2244	powershell.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
772	powershell.exe
772	powershell.exe
972	powershell.exe
972	powershell.exe
2920	powershell.exe
2920	powershell.exe
4380	powershell.exe
4380	powershell.exe
4764	powershell.exe
4764	powershell.exe
5092	powershell.exe
5092	powershell.exe
5064	powershell.exe
5064	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	772	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	3984	taskhostw.exe
Token: SeDebugPrivilege	2528	taskhostw.exe
Token: SeDebugPrivilege	3300	taskhostw.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2920	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	128
PID 3016 wrote to memory of 2920	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	128
PID 3016 wrote to memory of 4380	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	129
PID 3016 wrote to memory of 4380	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	129
PID 3016 wrote to memory of 4764	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	130
PID 3016 wrote to memory of 4764	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	130
PID 3016 wrote to memory of 972	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	131
PID 3016 wrote to memory of 972	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	131
PID 3016 wrote to memory of 4248	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	132
PID 3016 wrote to memory of 4248	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	132
PID 3016 wrote to memory of 2244	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	133
PID 3016 wrote to memory of 2244	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	133
PID 3016 wrote to memory of 1284	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	134
PID 3016 wrote to memory of 1284	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	134
PID 3016 wrote to memory of 772	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	135
PID 3016 wrote to memory of 772	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	135
PID 3016 wrote to memory of 5064	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	136
PID 3016 wrote to memory of 5064	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	136
PID 3016 wrote to memory of 4448	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	137
PID 3016 wrote to memory of 4448	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	137
PID 3016 wrote to memory of 5092	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	138
PID 3016 wrote to memory of 5092	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	138
PID 3016 wrote to memory of 3984	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	150
PID 3016 wrote to memory of 3984	3016	0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe	150
PID 3984 wrote to memory of 1716	3984	taskhostw.exe	154
PID 3984 wrote to memory of 1716	3984	taskhostw.exe	154
PID 3984 wrote to memory of 5040	3984	taskhostw.exe	155
PID 3984 wrote to memory of 5040	3984	taskhostw.exe	155
PID 1716 wrote to memory of 2528	1716	WScript.exe	165
PID 1716 wrote to memory of 2528	1716	WScript.exe	165
PID 2528 wrote to memory of 4600	2528	taskhostw.exe	167
PID 2528 wrote to memory of 4600	2528	taskhostw.exe	167
PID 2528 wrote to memory of 408	2528	taskhostw.exe	168
PID 2528 wrote to memory of 408	2528	taskhostw.exe	168
PID 4600 wrote to memory of 3300	4600	WScript.exe	170
PID 4600 wrote to memory of 3300	4600	WScript.exe	170
PID 3300 wrote to memory of 4696	3300	taskhostw.exe	172
PID 3300 wrote to memory of 4696	3300	taskhostw.exe	172
PID 3300 wrote to memory of 1588	3300	taskhostw.exe	173
PID 3300 wrote to memory of 1588	3300	taskhostw.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe
"C:\Users\Admin\AppData\Local\Temp\0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012N.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe
  "C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b3aab91-23ab-4009-90dd-3befcdc01aa2.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe
      "C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\557cb3bd-8a35-4834-95f4-e368919b6917.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4600
      - C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe
        
        "C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9f947ea-af09-455c-a47a-5dcb3e971191.vbs"
        7⤵
        
        PID:4696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e20a914-d019-4dee-be2e-8944fe26db91.vbs"
        7⤵
        
        PID:1588
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98550ba2-7a3b-4a5f-afcf-b433adf558d2.vbs"
        5⤵
        
        PID:408
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b702c6e0-f7a8-4b72-87bf-616b76954824.vbs"
    3⤵
    PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\Media Renderer\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Application Data\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\fr-FR\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\fr-FR\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Windows\fr-FR\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Security\BrowserCore\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\System32\lt-LT\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\lt-LT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\System32\lt-LT\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\INF\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\INF\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\INF\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Multimedia Platform\dllhost.exe

Filesize
1.7MB

MD5
a0937604f25f9cbb6b95b844028edbc0

SHA1
e8670a80fa0981a7e4690bfaff8b50d7776f164a

SHA256
a73c9ce08325e1a11166cee531a6c4f6e54be9ee7c6ab38a9bba81443af3a6f2

SHA512
672468b44aee6252e153ef17fe957bd6642548d647ae59b49fa1c98966104dfaf9ba07b636728fb0056197cb73ca5dd6f0670315d6cce429e7a9cfd848b9735a

Download Submit
C:\Program Files\Windows Security\BrowserCore\sppsvc.exe

Filesize
1.7MB

MD5
e7d54088f5f51af4a7ffcae6d14eec10

SHA1
5f0854dff4f1421cebf00ca1bb92a09b46ab998b

SHA256
8c50f39adc7e83d26e54ae2a99a1a547ada4c663837a9a75a782d4140beec607

SHA512
1b433f1e5895456387a46c609126d61cbecd0d9805c4458fffcb92e2beda81401165131e3a91cb7c52408f98e7dbe4f9a6ad140b7bb80894260afca37764a849

Download Submit
C:\Recovery\WindowsRE\unsecapp.exe

Filesize
1.7MB

MD5
ca3d465daa51bd931a7246c9d9be0a24

SHA1
2c2b90d8d444a00811ac746fec71fbc79aaa7d66

SHA256
eb6807be99b151b4fc89b657ccfa5cc2b0938881fde161afe34a98be8d5f9fe1

SHA512
26b16daf2c0af7ee0a30a72805bc0c83c2ce5fb3e291aa91a4a39b235c278c841746573f49c5906633f65c875b3e169caff51a83fb16969b5621f627a3012323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\0b3aab91-23ab-4009-90dd-3befcdc01aa2.vbs

Filesize
751B

MD5
9b577cce40790689cf172f7a91484caa

SHA1
a7421a436ae005442334459f1b438282b0768ddf

SHA256
a75ccd79d68a487af6e6dc7ce5c9bbef3433456210747fc01f8807843e10f1d2

SHA512
615854c6aab67f1aca1a948092d96fd63b49451cfd737d627d8a29fb3db89071693636b48d7cca63db818618833b099715d71591438a647703328108fd33d05f

Download Submit
C:\Users\Admin\AppData\Local\Temp\557cb3bd-8a35-4834-95f4-e368919b6917.vbs

Filesize
751B

MD5
c6cfd8a1b93475dec3ffe8be6050a272

SHA1
c465763066fad0883527fb4bd3a0a0088bce8728

SHA256
24265bb706d1a3363dd8c4632c3edbb2641d58db0b0105f1bc2fa5ab0c82594b

SHA512
292a0a8e356bbc8b4ccf7e3eaf6b6540452415c9f3df1172ce0e009a9d091a6b437de2d8ff1f4a5892d10e07b61b7ae2a08ece52cc656fe542ccbab1ff0d7465

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uenum0sy.vbi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b702c6e0-f7a8-4b72-87bf-616b76954824.vbs

Filesize
527B

MD5
789ec80c945749c7eb0e085a127b05bb

SHA1
70f02254e3a5d8188255c0e46c879592281e04dd

SHA256
fd3ee38bb2c1e9e686cf615e5b7c08efdda0353b297eedeb5fa330ada0393d30

SHA512
98bdc085f9a2602bcb84a150ba248bdab785e438e9aedfa7fd1f6a3706717d0b082958eb51628365f89fdb6eb3acce4fea0c716d519eafa48cbf6b845d85af56

Download Submit
C:\Users\Admin\AppData\Local\Temp\d9f947ea-af09-455c-a47a-5dcb3e971191.vbs

Filesize
751B

MD5
e8564466c541d153810f8cb0a2cb2da4

SHA1
10d6b0bf2e6a3da375492b52a27bf1b226254fdb

SHA256
8a7d8327e63a89c62f8dbe1f91772dfc7ee62e47e2e4413f17b8a59421264c8f

SHA512
3afe1a14f6b9d0bef3096eba5c5787c72ac084a4f956ea22d52aff0a6b2de60095bc42c22ef0de12a29d916470e77e479a4fce700baabf40c1feb181ba12c420

Download Submit
C:\Windows\System32\lt-LT\dllhost.exe

Filesize
1.7MB

MD5
3ad4d121308921d9e9eda8cec659b467

SHA1
18218c3b567c2854971d06d3db4ace9c3c54c79c

SHA256
59978caff36b232ff0106cfb8cd5990147bdc63bc3658b8dd24aff6aa9b73b22

SHA512
dc7ab862ed8543286679a6bbcc545869de78e419f0afee88341d9629d4617732843014567d237042bb599449e6557351ed195c2b0c8a55c54e66d69de1904f40

Download Submit
C:\Windows\fr-FR\TextInputHost.exe

Filesize
1.7MB

MD5
41ab31f7992973414712ec5526c1fc70

SHA1
bd1eb2471b1a16ef2e2bc29571c98b670de563f3

SHA256
0db13d5a3f1aa341822454bf1d807a06240479a15513185097217bdaf5f8b012

SHA512
f3d90be2a0fbb838fbaf222ec6d64db5597e8104d53f863e0240cb8fd5bf72fb7f3c3d072b37e91967f80f4c298c295886eff89fd7b9831bbf8f2bc6d7120960

Download Submit
C:\Windows\fr-FR\TextInputHost.exe

Filesize
1.7MB

MD5
e7414417420a64115c47ee3364d99a97

SHA1
5b60395ce6b76a34a1faa175099e380310d527b9

SHA256
8d0348ea991955784fee26bbaea0e3b248cedfbea69057550031a4397d174389

SHA512
0f26047a516d802a205f8b566cf5de85ad71abf86c58965eb5db82740e98bb4026ec9e1b8060205a1e81b0fe0cd14c6e3f8544b55e945ca5cee9ee11447d76ff

Download Submit
memory/2244-268-0x0000028F68CA0000-0x0000028F68CC2000-memory.dmp

Filesize
136KB

Download
memory/3016-12-0x0000000002900000-0x0000000002912000-memory.dmp

Filesize
72KB

Download
memory/3016-13-0x000000001C080000-0x000000001C5A8000-memory.dmp

Filesize
5.2MB

Download
memory/3016-23-0x00007FFFFE6F0000-0x00007FFFFF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3016-19-0x000000001B490000-0x000000001B49C000-memory.dmp

Filesize
48KB

Download
memory/3016-16-0x000000001B4F0000-0x000000001B4FE000-memory.dmp

Filesize
56KB

Download
memory/3016-17-0x000000001B470000-0x000000001B478000-memory.dmp

Filesize
32KB

Download
memory/3016-18-0x000000001B480000-0x000000001B48C000-memory.dmp

Filesize
48KB

Download
memory/3016-15-0x000000001B4E0000-0x000000001B4EA000-memory.dmp

Filesize
40KB

Download
memory/3016-145-0x00007FFFFE6F3000-0x00007FFFFE6F5000-memory.dmp

Filesize
8KB

Download
memory/3016-14-0x0000000002930000-0x000000000293C000-memory.dmp

Filesize
48KB

Download
memory/3016-169-0x00007FFFFE6F0000-0x00007FFFFF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3016-194-0x00007FFFFE6F0000-0x00007FFFFF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3016-256-0x00007FFFFE6F0000-0x00007FFFFF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3016-22-0x00007FFFFE6F0000-0x00007FFFFF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3016-0-0x00007FFFFE6F3000-0x00007FFFFE6F5000-memory.dmp

Filesize
8KB

Download
memory/3016-368-0x00007FFFFE6F0000-0x00007FFFFF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3016-1-0x0000000000590000-0x0000000000750000-memory.dmp

Filesize
1.8MB

Download
memory/3016-10-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/3016-5-0x0000000001060000-0x0000000001068000-memory.dmp

Filesize
32KB

Download
memory/3016-9-0x00000000028D0000-0x00000000028DC000-memory.dmp

Filesize
48KB

Download
memory/3016-7-0x0000000002890000-0x00000000028A6000-memory.dmp

Filesize
88KB

Download
memory/3016-8-0x00000000028B0000-0x00000000028C0000-memory.dmp

Filesize
64KB

Download
memory/3016-6-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/3016-4-0x0000000002940000-0x0000000002990000-memory.dmp

Filesize
320KB

Download
memory/3016-3-0x0000000002860000-0x000000000287C000-memory.dmp

Filesize
112KB

Download
memory/3016-2-0x00007FFFFE6F0000-0x00007FFFFF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3984-369-0x0000000002A30000-0x0000000002A42000-memory.dmp

Filesize
72KB

Download