dcrat | 2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-02-2025 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b330a516dc2ed01776ad58b0dc970216.exe
Size

1.6MB
MD5

b330a516dc2ed01776ad58b0dc970216
SHA1

78db141d31b8131aabd9ba1c9144a33c8cd6842b
SHA256

2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2
SHA512

f25f66055176b4060b94ff3c765d54d6d7ee0186b70001205c2e65696180a57b32de897df1664bad8611f81da0f3267b6daf9eea46a0c68c4746c54a56999209
SSDEEP

24576:GlZi59u2GRCRXXdoOH0dMPg/riXqsLS29ryVYNN+GCiRtnATOD:GPfsDHwsg/riE29rC2+GJRVA

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\OfficeClickToRun.exe\", \"C:\\Users\\Default\\My Documents\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\Windows Portable Devices\\OfficeClickToRun.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\b330a516dc2ed01776ad58b0dc970216.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Idle.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\OfficeClickToRun.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\OfficeClickToRun.exe\", \"C:\\Users\\Default\\My Documents\\TextInputHost.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\OfficeClickToRun.exe\", \"C:\\Users\\Default\\My Documents\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\OfficeClickToRun.exe\", \"C:\\Users\\Default\\My Documents\\TextInputHost.exe\", \"C:\\Users\\All Users\\Desktop\\smss.exe\", \"C:\\Program Files\\Windows Portable Devices\\OfficeClickToRun.exe\""	b330a516dc2ed01776ad58b0dc970216.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1936	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	3200	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	3200	schtasks.exe	82

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	b330a516dc2ed01776ad58b0dc970216.exe

Executes dropped EXE 1 IoCs

pid	Process
1564	smss.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Idle.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\My Documents\\TextInputHost.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\All Users\\Desktop\\smss.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\All Users\\Desktop\\smss.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Portable Devices\\OfficeClickToRun.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b330a516dc2ed01776ad58b0dc970216 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b330a516dc2ed01776ad58b0dc970216.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\All Users\\Idle.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\OfficeClickToRun.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\Default\\My Documents\\TextInputHost.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Windows Portable Devices\\OfficeClickToRun.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b330a516dc2ed01776ad58b0dc970216 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b330a516dc2ed01776ad58b0dc970216.exe\""	b330a516dc2ed01776ad58b0dc970216.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\OfficeClickToRun.exe\""	b330a516dc2ed01776ad58b0dc970216.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC78EE8B8ADE3427DB4874DF736C978AE.TMP	csc.exe
File created	\??\c:\Windows\System32\enb1sa.exe	csc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	b330a516dc2ed01776ad58b0dc970216.exe
File created	C:\Program Files\Windows Portable Devices\e6c9b481da804f	b330a516dc2ed01776ad58b0dc970216.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\OfficeClickToRun.exe	b330a516dc2ed01776ad58b0dc970216.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\e6c9b481da804f	b330a516dc2ed01776ad58b0dc970216.exe
File created	C:\Program Files\ModifiableWindowsApps\StartMenuExperienceHost.exe	b330a516dc2ed01776ad58b0dc970216.exe
File created	C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe	b330a516dc2ed01776ad58b0dc970216.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1900	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	b330a516dc2ed01776ad58b0dc970216.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1900	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5048	schtasks.exe
3952	schtasks.exe
3612	schtasks.exe
404	schtasks.exe
1320	schtasks.exe
4012	schtasks.exe
2424	schtasks.exe
1288	schtasks.exe
2096	schtasks.exe
2792	schtasks.exe
4880	schtasks.exe
4644	schtasks.exe
2356	schtasks.exe
1840	schtasks.exe
1936	schtasks.exe
3288	schtasks.exe
3788	schtasks.exe
2668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1080	b330a516dc2ed01776ad58b0dc970216.exe
1564	smss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	b330a516dc2ed01776ad58b0dc970216.exe
Token: SeDebugPrivilege	1564	smss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2080	1080	b330a516dc2ed01776ad58b0dc970216.exe	86
PID 1080 wrote to memory of 2080	1080	b330a516dc2ed01776ad58b0dc970216.exe	86
PID 2080 wrote to memory of 1484	2080	csc.exe	88
PID 2080 wrote to memory of 1484	2080	csc.exe	88
PID 1080 wrote to memory of 4424	1080	b330a516dc2ed01776ad58b0dc970216.exe	104
PID 1080 wrote to memory of 4424	1080	b330a516dc2ed01776ad58b0dc970216.exe	104
PID 4424 wrote to memory of 3388	4424	cmd.exe	106
PID 4424 wrote to memory of 3388	4424	cmd.exe	106
PID 4424 wrote to memory of 1900	4424	cmd.exe	107
PID 4424 wrote to memory of 1900	4424	cmd.exe	107
PID 4424 wrote to memory of 1564	4424	cmd.exe	113
PID 4424 wrote to memory of 1564	4424	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b330a516dc2ed01776ad58b0dc970216.exe
"C:\Users\Admin\AppData\Local\Temp\b330a516dc2ed01776ad58b0dc970216.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g20yq4z4\g20yq4z4.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E2B.tmp" "c:\Windows\System32\CSC78EE8B8ADE3427DB4874DF736C978AE.TMP"
    3⤵
    PID:1484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PCKg8b7wgB.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3388
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1900
- - C:\Users\All Users\Desktop\smss.exe
    "C:\Users\All Users\Desktop\smss.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Users\Default\My Documents\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\My Documents\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Portable Devices\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "b330a516dc2ed01776ad58b0dc970216b" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\b330a516dc2ed01776ad58b0dc970216.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "b330a516dc2ed01776ad58b0dc970216" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\b330a516dc2ed01776ad58b0dc970216.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "b330a516dc2ed01776ad58b0dc970216b" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\b330a516dc2ed01776ad58b0dc970216.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Idle.exe

Filesize
1.6MB

MD5
b330a516dc2ed01776ad58b0dc970216

SHA1
78db141d31b8131aabd9ba1c9144a33c8cd6842b

SHA256
2b513177e1ebb418f3e4d2cd3947c0b248bdd064188538d00518118dd916aee2

SHA512
f25f66055176b4060b94ff3c765d54d6d7ee0186b70001205c2e65696180a57b32de897df1664bad8611f81da0f3267b6daf9eea46a0c68c4746c54a56999209

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCKg8b7wgB.bat

Filesize
163B

MD5
3cb9a2420020d2eeb8b6a9567752d5d0

SHA1
81e3a2bf1a95e1503ac7a89b8c762ec20fb66d91

SHA256
e87266ec59a2b1ffe9ad8f4732be37ecd1b0df38e7105244ff3d839590e848de

SHA512
4796908d3c1b917f33babc998ef149a4dfa8bc8505cde4880c2efb5d27535b707a44bcb1c8d03b59a97eac86dbf27aa6dd05c2222237314f561c4ee1cef162ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6E2B.tmp

Filesize
1KB

MD5
293c8d23acc1737c50dedba1a97f81b8

SHA1
30dd30c361d2ed3a80f12f8c752862cb8188e131

SHA256
3cbe05335d6098072c896546385862721ac16b9b955c8dd9763cea2785bafae0

SHA512
109c49cf9c2ba971582e062a02be4cc7c6f2ace0e3b1670b99f314115051ead7de1ae09ce0b96076a181b4bb9342805c8d8d2d75e3e3cc2021ffb7f05f9d9ff2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g20yq4z4\g20yq4z4.0.cs

Filesize
359B

MD5
140d27dc5e2744a5515a3597f1cd1462

SHA1
ec2b31a90c2ea93af433d303ed21a90fcb305e93

SHA256
7e90710008e9021f9ab97ada10ce0e950aca1710dc8b8b95745a442a623e013f

SHA512
a9995685a42c048e882a96fe03f5b0cdc439cf0201740d23d92fe342df5cfd5aeac69841a348798f92d0b1ba336d3681dd778d18ef2e9c083865f2e7eb6ce0a5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g20yq4z4\g20yq4z4.cmdline

Filesize
235B

MD5
b1e37055bdd1c2f21198010e00dcd683

SHA1
aea0296c27294ba7f34d360c298d234ec049fb75

SHA256
f3c633afbed2398ed01d821d5aadce2652aad08b5087e998631e6fe25bc513e4

SHA512
fb98cf07b96fe8b06675974f2ff90e51465bc6ef5fac6b702e06513bb971fb87937fbe5cd6dc90c41ac1c1b0c12a1a7500679c6a6e08c095d0d1fad6db28ce65

Download Submit
\??\c:\Windows\System32\CSC78EE8B8ADE3427DB4874DF736C978AE.TMP

Filesize
1KB

MD5
5984679060d0fc54eba47cead995f65a

SHA1
f72bbbba060ac80ac6abedc7b8679e8963f63ebf

SHA256
4104fdf5499f0aa7dd161568257acae002620ec385f2ede2072d4f550ecff433

SHA512
bc8aadfabe5dbb4e3ea5e07a5ccbddd363400005675acda3e9cb414dc75fb0ba74f41b4a6baf34d42f85a9ae0af7d2418420c78b0c643f7243fe93a49b8140b5

Download Submit
memory/1080-24-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-25-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-10-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-11-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-3-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-23-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-4-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-9-0x000000001AD60000-0x000000001AD6C000-memory.dmp

Filesize
48KB

Download
memory/1080-7-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-0-0x00007FFF3DBE3000-0x00007FFF3DBE5000-memory.dmp

Filesize
8KB

Download
memory/1080-2-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-6-0x0000000002260000-0x000000000226E000-memory.dmp

Filesize
56KB

Download
memory/1080-44-0x00007FFF3DBE0000-0x00007FFF3E6A1000-memory.dmp

Filesize
10.8MB

Download
memory/1080-1-0x0000000000020000-0x00000000001CA000-memory.dmp

Filesize
1.7MB

Download