dcrat | a239175d724d2caf4b4de497e819e32c8575fc1f93ddfbc7ec510cbc63b6bbac

Analysis

max time kernel
138s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2025, 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HORNETrat_launcher.exe
Size

2.9MB
MD5

f07b8eea2d8c8ee368b680254ad0fee5
SHA1

1c75b5bcabedf0e31c76df0ff6ee23ab389bae3b
SHA256

34947ad997759cb6aaf571df44c0996dae57e04cf4510ef4136b8b7ca16eea4e
SHA512

9c01412cb8aa51419f74f8b614f88383f41ce2e2698b373b7d59519d23b875e0660b6fe4a947afa0b79878223afacb8cb8b8a3164b0a44d20f8f58521ff9d21e
SSDEEP

49152:BB3kRVwF/UHWZU5qfD330oa5EL0h81IC4XA4QKa1lWpdh:L0ReSS05G281ICX4QKa1lWpdh

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2580	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4536	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4536	schtasks.exe	90

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	hyperInto.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	HORNETrat_launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 6 IoCs

pid	Process
4884	hyperInto.exe
3552	RuntimeBroker.exe
3912	RuntimeBroker.exe
2368	RuntimeBroker.exe
3664	RuntimeBroker.exe
3348	RuntimeBroker.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\dwm.exe	hyperInto.exe
File opened for modification	C:\Program Files\Uninstall Information\dwm.exe	hyperInto.exe
File created	C:\Program Files\Uninstall Information\6cb0b6c459d5d3	hyperInto.exe
File created	C:\Program Files (x86)\Windows Portable Devices\sysmon.exe	hyperInto.exe
File created	C:\Program Files (x86)\Windows Portable Devices\121e5b5079f7c0	hyperInto.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HORNETrat_launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1732	PING.EXE

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	HORNETrat_launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	hyperInto.exe
Key created	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000_Classes\Local Settings	RuntimeBroker.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1732	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2996	schtasks.exe
4572	schtasks.exe
1184	schtasks.exe
2156	schtasks.exe
4468	schtasks.exe
4016	schtasks.exe
2980	schtasks.exe
4412	schtasks.exe
2720	schtasks.exe
1180	schtasks.exe
4040	schtasks.exe
2580	schtasks.exe
4560	schtasks.exe
4596	schtasks.exe
4488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe
4884	hyperInto.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4884	hyperInto.exe
Token: SeDebugPrivilege	3552	RuntimeBroker.exe
Token: SeDebugPrivilege	3912	RuntimeBroker.exe
Token: SeDebugPrivilege	2368	RuntimeBroker.exe
Token: SeDebugPrivilege	3664	RuntimeBroker.exe
Token: SeDebugPrivilege	3348	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3580	4924	HORNETrat_launcher.exe	86
PID 4924 wrote to memory of 3580	4924	HORNETrat_launcher.exe	86
PID 4924 wrote to memory of 3580	4924	HORNETrat_launcher.exe	86
PID 3580 wrote to memory of 4496	3580	WScript.exe	87
PID 3580 wrote to memory of 4496	3580	WScript.exe	87
PID 3580 wrote to memory of 4496	3580	WScript.exe	87
PID 4496 wrote to memory of 4884	4496	cmd.exe	89
PID 4496 wrote to memory of 4884	4496	cmd.exe	89
PID 4884 wrote to memory of 632	4884	hyperInto.exe	106
PID 4884 wrote to memory of 632	4884	hyperInto.exe	106
PID 632 wrote to memory of 3964	632	cmd.exe	108
PID 632 wrote to memory of 3964	632	cmd.exe	108
PID 632 wrote to memory of 1732	632	cmd.exe	109
PID 632 wrote to memory of 1732	632	cmd.exe	109
PID 632 wrote to memory of 3552	632	cmd.exe	110
PID 632 wrote to memory of 3552	632	cmd.exe	110
PID 3552 wrote to memory of 1504	3552	RuntimeBroker.exe	113
PID 3552 wrote to memory of 1504	3552	RuntimeBroker.exe	113
PID 1504 wrote to memory of 4076	1504	cmd.exe	115
PID 1504 wrote to memory of 4076	1504	cmd.exe	115
PID 1504 wrote to memory of 3772	1504	cmd.exe	116
PID 1504 wrote to memory of 3772	1504	cmd.exe	116
PID 1504 wrote to memory of 3912	1504	cmd.exe	117
PID 1504 wrote to memory of 3912	1504	cmd.exe	117
PID 3912 wrote to memory of 3616	3912	RuntimeBroker.exe	118
PID 3912 wrote to memory of 3616	3912	RuntimeBroker.exe	118
PID 3616 wrote to memory of 3580	3616	cmd.exe	120
PID 3616 wrote to memory of 3580	3616	cmd.exe	120
PID 3616 wrote to memory of 3232	3616	cmd.exe	121
PID 3616 wrote to memory of 3232	3616	cmd.exe	121
PID 3616 wrote to memory of 2368	3616	cmd.exe	122
PID 3616 wrote to memory of 2368	3616	cmd.exe	122
PID 2368 wrote to memory of 4560	2368	RuntimeBroker.exe	123
PID 2368 wrote to memory of 4560	2368	RuntimeBroker.exe	123
PID 4560 wrote to memory of 1336	4560	cmd.exe	125
PID 4560 wrote to memory of 1336	4560	cmd.exe	125
PID 4560 wrote to memory of 952	4560	cmd.exe	126
PID 4560 wrote to memory of 952	4560	cmd.exe	126
PID 4560 wrote to memory of 3664	4560	cmd.exe	127
PID 4560 wrote to memory of 3664	4560	cmd.exe	127
PID 3664 wrote to memory of 2992	3664	RuntimeBroker.exe	128
PID 3664 wrote to memory of 2992	3664	RuntimeBroker.exe	128
PID 2992 wrote to memory of 1664	2992	cmd.exe	130
PID 2992 wrote to memory of 1664	2992	cmd.exe	130
PID 2992 wrote to memory of 2416	2992	cmd.exe	131
PID 2992 wrote to memory of 2416	2992	cmd.exe	131
PID 2992 wrote to memory of 3348	2992	cmd.exe	132
PID 2992 wrote to memory of 3348	2992	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\HORNETrat_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\HORNETrat_launcher.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mshyperblock\7CVEgcv.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\mshyperblock\S9mCKi92BftZwElqhr8FGhYT1zV90zFd1F.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\mshyperblock\hyperInto.exe
      "C:\mshyperblock/hyperInto.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gEzZlFc3Jo.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:632
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3964
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1732
      - C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tkLJtwnwVT.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:3772
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yhfppzmMH9.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3232
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mup9OI6yD3.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:952
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8MPHA9c1U6.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2416
        
        C:\Recovery\WindowsRE\RuntimeBroker.exe
        
        "C:\Recovery\WindowsRE\RuntimeBroker.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\TextInputHost.exe

Filesize
2.6MB

MD5
01ab4515258f4bddd97d98518cb46409

SHA1
f45b1ee75f483b1a603023830835b3965b43c789

SHA256
3603dda2245769a7f744499c40cf05ba21483b991e401635f5f6c649de9861c8

SHA512
fde32d8839c6aa3d41522d40398b5151c64fd6cb8d81e6d964ef18f726accc831fc7f70e7d921b6ac0f0ff262ae824aa45c72fe450be83993f26a204515ef22a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
c8e311b78b67d7909e05b01de9cf1ffb

SHA1
198f9411189ef79a8de60fa7fdfe957239de767b

SHA256
48c4b6ae7307aca161d53a1076f8d33b5c55b2f9664804df1adfe098ab6368d2

SHA512
abaece55e4fb680c0b54e3306970eef42262ea1f352728e871ee1ff19042b6e7145a67f0914039f62e8ed273de66d094251633d6cf0a79c4c00e4b43c48108b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\8MPHA9c1U6.bat

Filesize
215B

MD5
b4669c657d5156b5c6d95febb06f5c83

SHA1
10d8f3bfd7c83ab7c48889f3c2b7a11f622d8729

SHA256
aedafbb3781eb3e085cefa7cc4ff4ac9eb2ecdfdf713b65f66e5241aa8fb7c2b

SHA512
32208267d508f0611981ab44c483fedb2665b819fb9e1f5bb73cbe0453760d74c75560292a33a40e7a5edce88c8ef953372da70ff746cfdfd3b57f7c7c059dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\gEzZlFc3Jo.bat

Filesize
167B

MD5
0d92b5f1ec4bf7dd810c5c5a9d4f7c75

SHA1
b408283c6cb4142d5328d433b91cbf2c016f331c

SHA256
bbf54c6ca43a8ec63e6a6caeca8267b8b71a15bcce86c97fd3c87a4867b995d0

SHA512
1afb122ad3906d17bea1d8484a17c00abee784dbc80e158b099515c025edb3768295c8eaaa93b2b5a8ee794fa3902186fd445b654b30604a8940e46c4ecc0324

Download Submit
C:\Users\Admin\AppData\Local\Temp\mup9OI6yD3.bat

Filesize
215B

MD5
d9ce3947a87d9fe21d8a77ef62389edd

SHA1
143293db03b938132685653c93691edc80713749

SHA256
20b3711f220be8dbd410ada57aec8bdbab849e947ae1d04bbb18e465a88ffa39

SHA512
7c362e57eeacefa69ca1954124e8c3534eb06fa16962e62febdf5dbf6e77497a8ebdc5076ca20c5ba0f350223fc46d1bd5544403b28f59cb539fc2e073ea8d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tkLJtwnwVT.bat

Filesize
215B

MD5
d10fc91fb3ceebe75535063e7a529608

SHA1
979c999d004e0b1abdee0e9ff45121805d0710f9

SHA256
f8939b2560d0fa75e63a864ad2f084f70cbabb082042e7d9c3c6c185ec18bdf5

SHA512
27966c33aebfd56dc7eab57a304532837cc74293f28590166459433b585cfd1dabb89da53d00789fbbedc7fb1984b1ea4d023b0447ca364f5e7d51790aa8066a

Download Submit
C:\Users\Admin\AppData\Local\Temp\yhfppzmMH9.bat

Filesize
215B

MD5
9691bd69ea8fc875eeac6c0bb96eee80

SHA1
fc81b15d97a9a72ed2141153f0c74895a9b624a7

SHA256
3b525378c59c95646fb3aa275ae7d3f93e6a0cc2c12cb244e0180e170a075a66

SHA512
07553c291bc6ad715990ff7c69cc21c3a604cd1933821d9dc788c4f00f9b2871ec749aa6c31d304ea5058031d22aa8839977f2d3def317b9c58e53e74f9e395f

Download Submit
C:\mshyperblock\7CVEgcv.vbe

Filesize
225B

MD5
b7a9d7bc751980e5d28b50643805b2b0

SHA1
dd4e0de7003f4dfc9a4cc52bfbf542e335a700f3

SHA256
417517292e016853942d2072a55cb914a1e9c552af7d4fce9e9497d32d42ae2f

SHA512
965e0ecc6c2535d46c7cc27ca7917f5ff20e07b881bf4ab15f26fd25807ad756fed4eca03f8315b68d1e72db1b97f9344ce111955b4c7368f40c5d2f8afec8a0

Download Submit
C:\mshyperblock\S9mCKi92BftZwElqhr8FGhYT1zV90zFd1F.bat

Filesize
71B

MD5
769d41729d7dc06c2302102db2bf90bf

SHA1
156cdeacce22a5969515bc4d61f47a908da78f1e

SHA256
38f5e3ea511d8cfe28b6d163d844a8cd7c1428ba2f0017793fba1fbae559d54e

SHA512
f33d0e2ca822168915a2ac6f8ab8bc4774d8733f92d8937b96c9b3e39ece245f003183c53d55c6a51b6c9b1241d252bd303af7381516ae1cd23641fda45de5c7

Download Submit
C:\mshyperblock\hyperInto.exe

Filesize
2.6MB

MD5
5bdfa3d66339a5624d36ee2038584cfc

SHA1
a55b70c8e118a0aa3d3d06281ce5809db2933a7a

SHA256
a1cdf05403d641c6717c540e76ee1cff8b3d3723df3574413dbdd7e18d1393fa

SHA512
de156c9044d48657056d087252f46ed3c36f1ce676b1e0a2b3946dc29fa6e5347685bff1b4ad83ecb5b194bd3eb2e3976cbd7028d34390590393bbb5373b84c2

Download Submit
memory/4884-29-0x0000000002A40000-0x0000000002A52000-memory.dmp

Filesize
72KB

Download
memory/4884-38-0x000000001B450000-0x000000001B468000-memory.dmp

Filesize
96KB

Download
memory/4884-25-0x00000000028B0000-0x00000000028C0000-memory.dmp

Filesize
64KB

Download
memory/4884-30-0x000000001BAF0000-0x000000001C018000-memory.dmp

Filesize
5.2MB

Download
memory/4884-32-0x0000000002A00000-0x0000000002A0C000-memory.dmp

Filesize
48KB

Download
memory/4884-34-0x000000001B5C0000-0x000000001B61A000-memory.dmp

Filesize
360KB

Download
memory/4884-36-0x0000000002A10000-0x0000000002A1E000-memory.dmp

Filesize
56KB

Download
memory/4884-27-0x0000000002A20000-0x0000000002A36000-memory.dmp

Filesize
88KB

Download
memory/4884-40-0x0000000002A60000-0x0000000002A6C000-memory.dmp

Filesize
48KB

Download
memory/4884-23-0x00000000028A0000-0x00000000028AC000-memory.dmp

Filesize
48KB

Download
memory/4884-21-0x00000000029E0000-0x00000000029F2000-memory.dmp

Filesize
72KB

Download
memory/4884-19-0x0000000002890000-0x000000000289E000-memory.dmp

Filesize
56KB

Download
memory/4884-17-0x0000000002880000-0x0000000002890000-memory.dmp

Filesize
64KB

Download
memory/4884-15-0x0000000000E80000-0x0000000000E8E000-memory.dmp

Filesize
56KB

Download
memory/4884-13-0x00000000003E0000-0x0000000000676000-memory.dmp

Filesize
2.6MB

Download
memory/4884-12-0x00007FFB99FC3000-0x00007FFB99FC5000-memory.dmp

Filesize
8KB

Download