dcrat | 0ac36210d2b3663424a66df7c87c9415ced58aabc4871defe1b16e299e6122ce

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2025 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ec8a79c37b454b049a99fe266d79fc2.exe
Size

1.1MB
MD5

3ec8a79c37b454b049a99fe266d79fc2
SHA1

89d63cae0fe6a94eee5d59b2f5e12837a4183a8a
SHA256

0ac36210d2b3663424a66df7c87c9415ced58aabc4871defe1b16e299e6122ce
SHA512

10e924a57eb16071d80f7efedd316eaeda8127752d22c2ab6c6a2287b175af683d6a9138ac9b8749ca38a8772c045e63f75e38b58d36ac44b814c47daf4b3977
SSDEEP

24576:2TbBv5rUyXVYsTn6lY+MSJMA+SL3iE0nH863:IBJ1Tn6lY+9mA+03KH1

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Msagentserverfontwin\\fontdrvhost.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Msagentserverfontwin\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Msagentserverfontwin\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\RuntimeBroker.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Msagentserverfontwin\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\RuntimeBroker.exe\", \"C:\\Msagentserverfontwin\\SearchApp.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Msagentserverfontwin\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\RuntimeBroker.exe\", \"C:\\Msagentserverfontwin\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Msagentserverfontwin\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Windows\\BitLockerDiscoveryVolumeContents\\RuntimeBroker.exe\", \"C:\\Msagentserverfontwin\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Msagentserverfontwin\\Mssurrogate.exe\""	Mssurrogate.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	4788	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	4788	schtasks.exe	86

DCRat payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d000000023b79-10.dat	family_dcrat_v2
behavioral2/memory/4224-13-0x0000000000C30000-0x0000000000D0E000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4920	powershell.exe
3004	powershell.exe
3620	powershell.exe
2824	powershell.exe
4684	powershell.exe
4064	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	3ec8a79c37b454b049a99fe266d79fc2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Mssurrogate.exe

Executes dropped EXE 2 IoCs

pid	Process
4224	Mssurrogate.exe
4084	SearchApp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Msagentserverfontwin\\fontdrvhost.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\RuntimeBroker.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mssurrogate = "\"C:\\Msagentserverfontwin\\Mssurrogate.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Msagentserverfontwin\\fontdrvhost.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\BitLockerDiscoveryVolumeContents\\RuntimeBroker.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Msagentserverfontwin\\SearchApp.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Msagentserverfontwin\\SearchApp.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	Mssurrogate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mssurrogate = "\"C:\\Msagentserverfontwin\\Mssurrogate.exe\""	Mssurrogate.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
4	ipinfo.io
45	ipinfo.io
46	ipinfo.io

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCEE682AC2A3D64751A4CF97132E6926B0.TMP	csc.exe
File created	\??\c:\Windows\System32\lhkpi-.exe	csc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe	Mssurrogate.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\9e8d7a4ca61bd9	Mssurrogate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ec8a79c37b454b049a99fe266d79fc2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	3ec8a79c37b454b049a99fe266d79fc2.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	Mssurrogate.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
464	schtasks.exe
2932	schtasks.exe
208	schtasks.exe
4360	schtasks.exe
4704	schtasks.exe
3496	schtasks.exe
4364	schtasks.exe
4964	schtasks.exe
3948	schtasks.exe
1492	schtasks.exe
4520	schtasks.exe
1976	schtasks.exe
2396	schtasks.exe
2744	schtasks.exe
368	schtasks.exe
5072	schtasks.exe
4084	schtasks.exe
2708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe
4224	Mssurrogate.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	Mssurrogate.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	4084	SearchApp.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 3576	3992	3ec8a79c37b454b049a99fe266d79fc2.exe	82
PID 3992 wrote to memory of 3576	3992	3ec8a79c37b454b049a99fe266d79fc2.exe	82
PID 3992 wrote to memory of 3576	3992	3ec8a79c37b454b049a99fe266d79fc2.exe	82
PID 3576 wrote to memory of 3172	3576	WScript.exe	83
PID 3576 wrote to memory of 3172	3576	WScript.exe	83
PID 3576 wrote to memory of 3172	3576	WScript.exe	83
PID 3172 wrote to memory of 4224	3172	cmd.exe	85
PID 3172 wrote to memory of 4224	3172	cmd.exe	85
PID 4224 wrote to memory of 3320	4224	Mssurrogate.exe	90
PID 4224 wrote to memory of 3320	4224	Mssurrogate.exe	90
PID 3320 wrote to memory of 3640	3320	csc.exe	92
PID 3320 wrote to memory of 3640	3320	csc.exe	92
PID 4224 wrote to memory of 4920	4224	Mssurrogate.exe	109
PID 4224 wrote to memory of 4920	4224	Mssurrogate.exe	109
PID 4224 wrote to memory of 4064	4224	Mssurrogate.exe	110
PID 4224 wrote to memory of 4064	4224	Mssurrogate.exe	110
PID 4224 wrote to memory of 4684	4224	Mssurrogate.exe	111
PID 4224 wrote to memory of 4684	4224	Mssurrogate.exe	111
PID 4224 wrote to memory of 2824	4224	Mssurrogate.exe	112
PID 4224 wrote to memory of 2824	4224	Mssurrogate.exe	112
PID 4224 wrote to memory of 3620	4224	Mssurrogate.exe	113
PID 4224 wrote to memory of 3620	4224	Mssurrogate.exe	113
PID 4224 wrote to memory of 3004	4224	Mssurrogate.exe	114
PID 4224 wrote to memory of 3004	4224	Mssurrogate.exe	114
PID 4224 wrote to memory of 1480	4224	Mssurrogate.exe	121
PID 4224 wrote to memory of 1480	4224	Mssurrogate.exe	121
PID 1480 wrote to memory of 3516	1480	cmd.exe	123
PID 1480 wrote to memory of 3516	1480	cmd.exe	123
PID 1480 wrote to memory of 2000	1480	cmd.exe	124
PID 1480 wrote to memory of 2000	1480	cmd.exe	124
PID 1480 wrote to memory of 4084	1480	cmd.exe	128
PID 1480 wrote to memory of 4084	1480	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3ec8a79c37b454b049a99fe266d79fc2.exe
"C:\Users\Admin\AppData\Local\Temp\3ec8a79c37b454b049a99fe266d79fc2.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Msagentserverfontwin\hhBzn.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Msagentserverfontwin\XWSDQAYTYEP13xxz2N7ltPvKTQTAvSoSE16NupOHA3nwG2zyDasP4h.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Msagentserverfontwin\Mssurrogate.exe
      "C:\Msagentserverfontwin/Mssurrogate.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\akchbjwt\akchbjwt.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3320
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC13D.tmp" "c:\Windows\System32\CSCEE682AC2A3D64751A4CF97132E6926B0.TMP"
        6⤵
        
        PID:3640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Msagentserverfontwin\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Msagentserverfontwin\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Msagentserverfontwin\Mssurrogate.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V47gQYrYKf.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3516
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2000
      - C:\Msagentserverfontwin\SearchApp.exe
        
        "C:\Msagentserverfontwin\SearchApp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Msagentserverfontwin\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Msagentserverfontwin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Msagentserverfontwin\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Msagentserverfontwin\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Msagentserverfontwin\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Msagentserverfontwin\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MssurrogateM" /sc MINUTE /mo 5 /tr "'C:\Msagentserverfontwin\Mssurrogate.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Mssurrogate" /sc ONLOGON /tr "'C:\Msagentserverfontwin\Mssurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MssurrogateM" /sc MINUTE /mo 12 /tr "'C:\Msagentserverfontwin\Mssurrogate.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Msagentserverfontwin\Mssurrogate.exe

Filesize
862KB

MD5
05b6288aed1f198480a08503b5b43160

SHA1
589a94e936ae85af38480e060fd675fccc29677c

SHA256
b6e42627e68c312f797df7ed4e48c1347f4f54a3238d79a0b281e8ca7cc9a7e3

SHA512
9ae6d1610409148b01734da636708c6178e1dbf04cc834ab6a45ac5e51c61582d2b20cf0add1a50d1ebaa77e58ca016a3f24b7046f9f110b596c99f257058d73

Download Submit
C:\Msagentserverfontwin\XWSDQAYTYEP13xxz2N7ltPvKTQTAvSoSE16NupOHA3nwG2zyDasP4h.bat

Filesize
93B

MD5
e73433c63df46567702eda90cfa558b8

SHA1
af806a0ad4419ef04175a7f381195e9b15726855

SHA256
1981c864866e956ebe40edd09dcd67a2767e7963ae4344cd43cf8129bc097772

SHA512
264e4a0ae2c226c0240fa127f212f97fff2d4e86479b781afda085498554509b98cd2c4babf4ab06f70bb02f454254c0b88ee936a0931804535defc7e16e6e30

Download Submit
C:\Msagentserverfontwin\hhBzn.vbe

Filesize
252B

MD5
a5e575f2f3162d4e2a922f6b60a1ff78

SHA1
bb04116cc3e6ace4cd9c15dad5ed3cf747e62911

SHA256
d17a0ab3537604f13e384c54a6f1d8c87088974f4298e4c2d8cad70536af1b32

SHA512
915850324f009dd5ed240a5f08f74f482edf7dad25bb01c615101d07f898c2a9fc061cd8eeec541017d1d4420849fd2cd90c4cef356a0b5bc8a275fb2de9b0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC13D.tmp

Filesize
1KB

MD5
932be1c55fc9b19ddab7c57c4bcf8e18

SHA1
b92dafe054b0b2ccb1c09cb9f99fed16782ba473

SHA256
95ff5b5481769db92b7f224316171cedd2b9c426f76972ae5fa784d951bbd38b

SHA512
36939ffa709ea94befe3cacb1309fab50752396f2beaccc08d3dff829ea6784cc1855291dc48c073fb4d12c6b37899dd36c90d05cce02c6bce75a27ae7e4d85b

Download Submit
C:\Users\Admin\AppData\Local\Temp\V47gQYrYKf.bat

Filesize
213B

MD5
50d6322c9d72d3f7e485c1f140cafc77

SHA1
7014b1d13b89977db00b1d722cd0b0fa5d55a276

SHA256
6b7ebc049283985acf0a8c124cef80e3a9e828c9e9e97070f57abac0f331e49d

SHA512
913c23a0e89aef1e190c3e198e0183cf6db7b0cf0aeb8cfb1ea9e207534394f6dbc9ff9980de742acb582b52defa45ba6207a761d1712e65315030a2a3fa54b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0nmjyhe5.yiu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\akchbjwt\akchbjwt.0.cs

Filesize
371B

MD5
8ffbd730a6dde785aa371ba40424bbe5

SHA1
1b6793cba3eb86c768414d4a2be0f091eca3600e

SHA256
089eed5bdb4cc42a10eeec1aecfb22f090a5a17afb80ff1b8ff1a46c90b644ab

SHA512
c66fe4ae519027eb0ae8908a5584ccb8310693fe96c19a2e1fcffbc68377ca8c816b893210688f9e01ab56ffa7bd5a86ac1de4c21c8aa7a2ca62b0291b820073

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\akchbjwt\akchbjwt.cmdline

Filesize
235B

MD5
ff0e56f9789bc8b6c11c179596cfe6e1

SHA1
63b8ae01ca06a5c5e398d76d21d9cc68455342d9

SHA256
9c4ff4a1a813001d7aad77fbc22a1e5abf327360487bbb2dfdc0ed60b4bbb5dc

SHA512
8487dfe2227aa95c153ecaeff8fc36a44fdddff6e96d2fcf2838e9fff62badabd7d32c894036574668aea120d503f12bf07cd4c2510766a5acc9b9dd1d9c5ba7

Download Submit
\??\c:\Windows\System32\CSCEE682AC2A3D64751A4CF97132E6926B0.TMP

Filesize
1KB

MD5
75e32610d8ef6143201c7c28465fcda9

SHA1
b2bae99fade2dda07aecbe1659d184be0fc4e7a6

SHA256
97ee1cac3965d9cc55a60f20206f384719431f19ac96bdc52b93a98de51a639b

SHA512
b303fb99586efd19a08223ba93472fa6d33fcf9198bbf42fb16ba61001db59e5fd5835ea7696ed34e4004d23fa60697e724e6085d1269d788204bf95dfe46abc

Download Submit
memory/2824-123-0x000001F11E000000-0x000001F11E01E000-memory.dmp

Filesize
120KB

Download
memory/2824-122-0x000001F11DFE0000-0x000001F11DFF9000-memory.dmp

Filesize
100KB

Download
memory/3004-134-0x000001DB00180000-0x000001DB00199000-memory.dmp

Filesize
100KB

Download
memory/3004-135-0x000001DB001A0000-0x000001DB001BE000-memory.dmp

Filesize
120KB

Download
memory/3620-125-0x00000172FDCB0000-0x00000172FDCCE000-memory.dmp

Filesize
120KB

Download
memory/3620-124-0x00000172FDC90000-0x00000172FDCA9000-memory.dmp

Filesize
100KB

Download
memory/4064-138-0x000001AFE3B30000-0x000001AFE3B49000-memory.dmp

Filesize
100KB

Download
memory/4064-76-0x000001AFE3B50000-0x000001AFE3B72000-memory.dmp

Filesize
136KB

Download
memory/4064-139-0x000001AFE3CA0000-0x000001AFE3CBE000-memory.dmp

Filesize
120KB

Download
memory/4084-150-0x000000001C2F0000-0x000000001C499000-memory.dmp

Filesize
1.7MB

Download
memory/4084-151-0x000000001C4A0000-0x000000001C4EE000-memory.dmp

Filesize
312KB

Download
memory/4084-183-0x000000001C2F0000-0x000000001C499000-memory.dmp

Filesize
1.7MB

Download
memory/4224-24-0x0000000002D80000-0x0000000002D8C000-memory.dmp

Filesize
48KB

Download
memory/4224-20-0x0000000002DD0000-0x0000000002DE8000-memory.dmp

Filesize
96KB

Download
memory/4224-12-0x00007FF929F63000-0x00007FF929F65000-memory.dmp

Filesize
8KB

Download
memory/4224-13-0x0000000000C30000-0x0000000000D0E000-memory.dmp

Filesize
888KB

Download
memory/4224-15-0x0000000002D60000-0x0000000002D6E000-memory.dmp

Filesize
56KB

Download
memory/4224-91-0x000000001D5E0000-0x000000001D62E000-memory.dmp

Filesize
312KB

Download
memory/4224-52-0x00007FF929F63000-0x00007FF929F65000-memory.dmp

Filesize
8KB

Download
memory/4224-28-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Filesize
48KB

Download
memory/4224-26-0x0000000002D90000-0x0000000002D98000-memory.dmp

Filesize
32KB

Download
memory/4224-22-0x0000000002D70000-0x0000000002D7E000-memory.dmp

Filesize
56KB

Download
memory/4224-17-0x0000000002DB0000-0x0000000002DCC000-memory.dmp

Filesize
112KB

Download
memory/4224-18-0x000000001B970000-0x000000001B9C0000-memory.dmp

Filesize
320KB

Download
memory/4684-127-0x00000261FA4B0000-0x00000261FA4CE000-memory.dmp

Filesize
120KB

Download
memory/4684-126-0x00000261FA490000-0x00000261FA4A9000-memory.dmp

Filesize
100KB

Download
memory/4920-131-0x000001DAABF00000-0x000001DAABF1E000-memory.dmp

Filesize
120KB

Download
memory/4920-130-0x000001DA93C90000-0x000001DA93CA9000-memory.dmp

Filesize
100KB

Download