dcrat | a239175d724d2caf4b4de497e819e32c8575fc1f93ddfbc7ec510cbc63b6bbac

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2025 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HORNETrat_launcher.exe
Size

2.9MB
MD5

f07b8eea2d8c8ee368b680254ad0fee5
SHA1

1c75b5bcabedf0e31c76df0ff6ee23ab389bae3b
SHA256

34947ad997759cb6aaf571df44c0996dae57e04cf4510ef4136b8b7ca16eea4e
SHA512

9c01412cb8aa51419f74f8b614f88383f41ce2e2698b373b7d59519d23b875e0660b6fe4a947afa0b79878223afacb8cb8b8a3164b0a44d20f8f58521ff9d21e
SSDEEP

49152:BB3kRVwF/UHWZU5qfD330oa5EL0h81IC4XA4QKa1lWpdh:L0ReSS05G281ICX4QKa1lWpdh

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	816	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	736	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	1364	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	1364	schtasks.exe	90

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	hyperInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	unsecapp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	HORNETrat_launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
2400	hyperInto.exe
920	unsecapp.exe
2484	unsecapp.exe
1940	unsecapp.exe
4696	unsecapp.exe
3836	unsecapp.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\unsecapp.exe	hyperInto.exe
File opened for modification	C:\Program Files (x86)\Windows NT\unsecapp.exe	hyperInto.exe
File created	C:\Program Files (x86)\Windows NT\29c1c3cc0f7685	hyperInto.exe
File created	C:\Program Files\Uninstall Information\unsecapp.exe	hyperInto.exe
File created	C:\Program Files\Uninstall Information\29c1c3cc0f7685	hyperInto.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\fontdrvhost.exe	hyperInto.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\5b884080fd4f94	hyperInto.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Boot\PCAT\SearchApp.exe	hyperInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HORNETrat_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4616	PING.EXE
2560	PING.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000_Classes\Local Settings	hyperInto.exe
Key created	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000_Classes\Local Settings	unsecapp.exe
Key created	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000_Classes\Local Settings	HORNETrat_launcher.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4616	PING.EXE
2560	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3112	schtasks.exe
1484	schtasks.exe
4508	schtasks.exe
3996	schtasks.exe
4712	schtasks.exe
816	schtasks.exe
736	schtasks.exe
2988	schtasks.exe
3644	schtasks.exe
1972	schtasks.exe
1684	schtasks.exe
876	schtasks.exe
1732	schtasks.exe
4072	schtasks.exe
4116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe
2400	hyperInto.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	hyperInto.exe
Token: SeDebugPrivilege	920	unsecapp.exe
Token: SeDebugPrivilege	2484	unsecapp.exe
Token: SeDebugPrivilege	1940	unsecapp.exe
Token: SeDebugPrivilege	4696	unsecapp.exe
Token: SeDebugPrivilege	3836	unsecapp.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 808	4328	HORNETrat_launcher.exe	86
PID 4328 wrote to memory of 808	4328	HORNETrat_launcher.exe	86
PID 4328 wrote to memory of 808	4328	HORNETrat_launcher.exe	86
PID 808 wrote to memory of 5116	808	WScript.exe	87
PID 808 wrote to memory of 5116	808	WScript.exe	87
PID 808 wrote to memory of 5116	808	WScript.exe	87
PID 5116 wrote to memory of 2400	5116	cmd.exe	89
PID 5116 wrote to memory of 2400	5116	cmd.exe	89
PID 2400 wrote to memory of 4088	2400	hyperInto.exe	106
PID 2400 wrote to memory of 4088	2400	hyperInto.exe	106
PID 4088 wrote to memory of 3280	4088	cmd.exe	108
PID 4088 wrote to memory of 3280	4088	cmd.exe	108
PID 4088 wrote to memory of 4616	4088	cmd.exe	109
PID 4088 wrote to memory of 4616	4088	cmd.exe	109
PID 4088 wrote to memory of 920	4088	cmd.exe	110
PID 4088 wrote to memory of 920	4088	cmd.exe	110
PID 920 wrote to memory of 3452	920	unsecapp.exe	113
PID 920 wrote to memory of 3452	920	unsecapp.exe	113
PID 3452 wrote to memory of 4136	3452	cmd.exe	115
PID 3452 wrote to memory of 4136	3452	cmd.exe	115
PID 3452 wrote to memory of 2520	3452	cmd.exe	116
PID 3452 wrote to memory of 2520	3452	cmd.exe	116
PID 3452 wrote to memory of 2484	3452	cmd.exe	117
PID 3452 wrote to memory of 2484	3452	cmd.exe	117
PID 2484 wrote to memory of 2164	2484	unsecapp.exe	118
PID 2484 wrote to memory of 2164	2484	unsecapp.exe	118
PID 2164 wrote to memory of 3944	2164	cmd.exe	120
PID 2164 wrote to memory of 3944	2164	cmd.exe	120
PID 2164 wrote to memory of 3544	2164	cmd.exe	121
PID 2164 wrote to memory of 3544	2164	cmd.exe	121
PID 2164 wrote to memory of 1940	2164	cmd.exe	122
PID 2164 wrote to memory of 1940	2164	cmd.exe	122
PID 1940 wrote to memory of 5008	1940	unsecapp.exe	123
PID 1940 wrote to memory of 5008	1940	unsecapp.exe	123
PID 5008 wrote to memory of 1388	5008	cmd.exe	125
PID 5008 wrote to memory of 1388	5008	cmd.exe	125
PID 5008 wrote to memory of 2580	5008	cmd.exe	126
PID 5008 wrote to memory of 2580	5008	cmd.exe	126
PID 5008 wrote to memory of 4696	5008	cmd.exe	127
PID 5008 wrote to memory of 4696	5008	cmd.exe	127
PID 4696 wrote to memory of 4452	4696	unsecapp.exe	128
PID 4696 wrote to memory of 4452	4696	unsecapp.exe	128
PID 4452 wrote to memory of 3608	4452	cmd.exe	130
PID 4452 wrote to memory of 3608	4452	cmd.exe	130
PID 4452 wrote to memory of 2560	4452	cmd.exe	131
PID 4452 wrote to memory of 2560	4452	cmd.exe	131
PID 4452 wrote to memory of 3836	4452	cmd.exe	132
PID 4452 wrote to memory of 3836	4452	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\HORNETrat_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\HORNETrat_launcher.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mshyperblock\7CVEgcv.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\mshyperblock\S9mCKi92BftZwElqhr8FGhYT1zV90zFd1F.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\mshyperblock\hyperInto.exe
      "C:\mshyperblock/hyperInto.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BtR8dixjJV.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4088
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3280
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4616
      - C:\Program Files (x86)\Windows NT\unsecapp.exe
        
        "C:\Program Files (x86)\Windows NT\unsecapp.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F0qtrCuOKA.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2520
        
        C:\Program Files (x86)\Windows NT\unsecapp.exe
        
        "C:\Program Files (x86)\Windows NT\unsecapp.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FfDOv2d6gz.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3944
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3544
        
        C:\Program Files (x86)\Windows NT\unsecapp.exe
        
        "C:\Program Files (x86)\Windows NT\unsecapp.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h53aanzGdD.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1388
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2580
        
        C:\Program Files (x86)\Windows NT\unsecapp.exe
        
        "C:\Program Files (x86)\Windows NT\unsecapp.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lnXy25yoCy.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3608
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2560
        
        C:\Program Files (x86)\Windows NT\unsecapp.exe
        
        "C:\Program Files (x86)\Windows NT\unsecapp.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\mshyperblock\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\mshyperblock\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\mshyperblock\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\unsecapp.exe.log

Filesize
1KB

MD5
c8e311b78b67d7909e05b01de9cf1ffb

SHA1
198f9411189ef79a8de60fa7fdfe957239de767b

SHA256
48c4b6ae7307aca161d53a1076f8d33b5c55b2f9664804df1adfe098ab6368d2

SHA512
abaece55e4fb680c0b54e3306970eef42262ea1f352728e871ee1ff19042b6e7145a67f0914039f62e8ed273de66d094251633d6cf0a79c4c00e4b43c48108b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\BtR8dixjJV.bat

Filesize
174B

MD5
2c6bba89544152a53472b489949d600a

SHA1
5561799f08b886ffd84bba30affbfe9531c20694

SHA256
971f0250b7a40aab5ec05f9e50bd6404ce29ed7cead2c2e03d43197b7c828c64

SHA512
d132df7b2e938b983040ecf5a8985c4f165337becc0795099f57ae0cc647ecf5a2a764920d32264ee2c650f9602793c4f4b7480077be23e2cbcc144631e540a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\F0qtrCuOKA.bat

Filesize
222B

MD5
f0008179c46ba80bbb7642fe6b8b3144

SHA1
c90b87da6585ac1b8b88918bde5e1b625f81ac80

SHA256
119469496f70b86200775c160f74a48b7327b78a6ef0dc14235a689a3fdb9b21

SHA512
7c1ba22ff681f26bf3cd244b530511b9dc8a74682b567d84fdd497903d13ddd7b7b2312e0f1861269827d25e57cba6c8ca7cc67bfb8f5df0c310644af9c1557e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FfDOv2d6gz.bat

Filesize
222B

MD5
2b24a4776ff6e620292faf21db7d7779

SHA1
7066700c7dd3d88cb4c2b41efbacdf557da73d8a

SHA256
dca448e0034f05232cb1a4e8c68b6a4a0f7c1fd12b6eeede708d4ffbf1dcdb2d

SHA512
9f3199e58b5a2311b88f32926fe398b0c0bad6f05a6101124dda7f7cf6744eb0b52dd5a72e679d81fcba9caa8cf7b58b1a1f14434816dc3b0c6b9211abc361ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\h53aanzGdD.bat

Filesize
222B

MD5
e48788fbf1e2ce7b1a38774b63f49877

SHA1
2474ab67dc7ebbe62e7e40d3ef4b52b7761b5e19

SHA256
a44c1915c62128cba327d436113a37b137d274b42c4a98ba81bc3fcb1013db1e

SHA512
65533911fbb1848cc56aa9bf07585e74c4de5baf0d771305aece2f9fb2af6060fd3d7f37bbba77f06856172fd541183af3cce20bbbee1556cc8bc941fde37f38

Download Submit
C:\Users\Admin\AppData\Local\Temp\lnXy25yoCy.bat

Filesize
174B

MD5
9f573fc9c9bacef181860db36b036072

SHA1
8cd1feca863d671efb244504814bfa08e679d094

SHA256
f826a7ffd058ffcd4ecff1b289c7fbb2bbfc17e25120560b248c7526050e5f9e

SHA512
42caaebfb8ee54e701a86a5c69f73b6de98af40490060154a3732b1fd6626654f63fab04b447e3f6c1a881f39ca4a566bc0190be6af146e937d4e4955c8c80f1

Download Submit
C:\mshyperblock\7CVEgcv.vbe

Filesize
225B

MD5
b7a9d7bc751980e5d28b50643805b2b0

SHA1
dd4e0de7003f4dfc9a4cc52bfbf542e335a700f3

SHA256
417517292e016853942d2072a55cb914a1e9c552af7d4fce9e9497d32d42ae2f

SHA512
965e0ecc6c2535d46c7cc27ca7917f5ff20e07b881bf4ab15f26fd25807ad756fed4eca03f8315b68d1e72db1b97f9344ce111955b4c7368f40c5d2f8afec8a0

Download Submit
C:\mshyperblock\S9mCKi92BftZwElqhr8FGhYT1zV90zFd1F.bat

Filesize
71B

MD5
769d41729d7dc06c2302102db2bf90bf

SHA1
156cdeacce22a5969515bc4d61f47a908da78f1e

SHA256
38f5e3ea511d8cfe28b6d163d844a8cd7c1428ba2f0017793fba1fbae559d54e

SHA512
f33d0e2ca822168915a2ac6f8ab8bc4774d8733f92d8937b96c9b3e39ece245f003183c53d55c6a51b6c9b1241d252bd303af7381516ae1cd23641fda45de5c7

Download Submit
C:\mshyperblock\hyperInto.exe

Filesize
2.6MB

MD5
5bdfa3d66339a5624d36ee2038584cfc

SHA1
a55b70c8e118a0aa3d3d06281ce5809db2933a7a

SHA256
a1cdf05403d641c6717c540e76ee1cff8b3d3723df3574413dbdd7e18d1393fa

SHA512
de156c9044d48657056d087252f46ed3c36f1ce676b1e0a2b3946dc29fa6e5347685bff1b4ad83ecb5b194bd3eb2e3976cbd7028d34390590393bbb5373b84c2

Download Submit
memory/920-79-0x000000001C450000-0x000000001C49E000-memory.dmp

Filesize
312KB

Download
memory/1940-120-0x000000001C3F0000-0x000000001C43E000-memory.dmp

Filesize
312KB

Download
memory/2400-19-0x0000000001AB0000-0x0000000001ABE000-memory.dmp

Filesize
56KB

Download
memory/2400-27-0x000000001BFD0000-0x000000001BFE6000-memory.dmp

Filesize
88KB

Download
memory/2400-30-0x000000001C650000-0x000000001CB78000-memory.dmp

Filesize
5.2MB

Download
memory/2400-32-0x0000000003490000-0x000000000349C000-memory.dmp

Filesize
48KB

Download
memory/2400-34-0x000000001C180000-0x000000001C1DA000-memory.dmp

Filesize
360KB

Download
memory/2400-36-0x00000000034C0000-0x00000000034CE000-memory.dmp

Filesize
56KB

Download
memory/2400-38-0x000000001C120000-0x000000001C138000-memory.dmp

Filesize
96KB

Download
memory/2400-40-0x000000001BFB0000-0x000000001BFBC000-memory.dmp

Filesize
48KB

Download
memory/2400-56-0x000000001CF90000-0x000000001CFDE000-memory.dmp

Filesize
312KB

Download
memory/2400-29-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/2400-25-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/2400-23-0x0000000001AC0000-0x0000000001ACC000-memory.dmp

Filesize
48KB

Download
memory/2400-21-0x00000000034A0000-0x00000000034B2000-memory.dmp

Filesize
72KB

Download
memory/2400-12-0x00007FF893F23000-0x00007FF893F25000-memory.dmp

Filesize
8KB

Download
memory/2400-17-0x0000000001900000-0x0000000001910000-memory.dmp

Filesize
64KB

Download
memory/2400-15-0x00000000018F0000-0x00000000018FE000-memory.dmp

Filesize
56KB

Download
memory/2400-13-0x0000000000FA0000-0x0000000001236000-memory.dmp

Filesize
2.6MB

Download
memory/2484-100-0x000000001C960000-0x000000001C9AE000-memory.dmp

Filesize
312KB

Download
memory/4696-140-0x000000001C950000-0x000000001C99E000-memory.dmp

Filesize
312KB

Download