dcrat | 5b1a883fc342ab1654912c119190f04771ae47477f1a006b932150129675134c

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
Size

1.6MB
MD5

38f861dde9adcb292ab747d998438b20
SHA1

0ace12fd6fda2f2663b5b2c83c9451ad439436e0
SHA256

38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0
SHA512

3ce0f60b7031d2e5d3e108663d1c7b3d07bb467be1ec0b02e61e2e49161593e2700fec12d144ffaa7e2d1401b5adeb53bb3c1d8a3d48e711c1e5f9ecaa96513a
SSDEEP

24576:Ksm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:KD8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 21 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5776	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	5624	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	5624	schtasks.exe	89

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral16/memory/2288-1-0x0000000000B70000-0x0000000000D12000-memory.dmp	dcrat
behavioral16/files/0x0007000000024262-26.dat	dcrat
behavioral16/files/0x0009000000024280-104.dat	dcrat
behavioral16/files/0x000a000000024266-115.dat	dcrat
behavioral16/files/0x0009000000024283-295.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4064	powershell.exe
3480	powershell.exe
3924	powershell.exe
4280	powershell.exe
2924	powershell.exe
2364	powershell.exe
3524	powershell.exe
432	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 13 IoCs

pid	Process
4832	RuntimeBroker.exe
5112	RuntimeBroker.exe
5604	RuntimeBroker.exe
1612	RuntimeBroker.exe
380	RuntimeBroker.exe
5756	RuntimeBroker.exe
1880	RuntimeBroker.exe
516	RuntimeBroker.exe
3064	RuntimeBroker.exe
6096	RuntimeBroker.exe
3932	RuntimeBroker.exe
3556	RuntimeBroker.exe
4548	RuntimeBroker.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\5940a34987c991	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files (x86)\Windows Portable Devices\System.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files (x86)\Windows Portable Devices\27d1bcfc3c54e0	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files\edge_BITS_4460_115844552\9e8d7a4ca61bd9	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files\edge_BITS_4460_573039931\csrss.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX6391.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\System.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4460_115844552\RCX6839.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4600_849449143\RCX6C72.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX617C.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files\edge_BITS_4460_573039931\886983d96e3d3e	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4460_115844552\RCX6828.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4600_849449143\unsecapp.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4460_573039931\RCX6F82.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4460_573039931\csrss.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files\edge_BITS_4600_849449143\unsecapp.exe	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File created	C:\Program Files\edge_BITS_4600_849449143\29c1c3cc0f7685	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCX617B.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX6390.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4600_849449143\RCX6CF0.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
File opened for modification	C:\Program Files\edge_BITS_4460_573039931\RCX6F04.tmp	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4808	schtasks.exe
4632	schtasks.exe
4512	schtasks.exe
4172	schtasks.exe
4824	schtasks.exe
4648	schtasks.exe
2688	schtasks.exe
4584	schtasks.exe
3948	schtasks.exe
3044	schtasks.exe
4856	schtasks.exe
4536	schtasks.exe
3084	schtasks.exe
3628	schtasks.exe
2708	schtasks.exe
4920	schtasks.exe
5776	schtasks.exe
4560	schtasks.exe
4620	schtasks.exe
4488	schtasks.exe
4800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
4064	powershell.exe
4064	powershell.exe
3480	powershell.exe
3480	powershell.exe
432	powershell.exe
432	powershell.exe
3524	powershell.exe
3524	powershell.exe
2924	powershell.exe
2924	powershell.exe
4280	powershell.exe
4280	powershell.exe
3924	powershell.exe
3924	powershell.exe
2364	powershell.exe
2364	powershell.exe
3924	powershell.exe
4064	powershell.exe
432	powershell.exe
3480	powershell.exe
3524	powershell.exe
2924	powershell.exe
4280	powershell.exe
2364	powershell.exe
4832	RuntimeBroker.exe
5112	RuntimeBroker.exe
5112	RuntimeBroker.exe
5604	RuntimeBroker.exe
5604	RuntimeBroker.exe
1612	RuntimeBroker.exe
1612	RuntimeBroker.exe
380	RuntimeBroker.exe
5756	RuntimeBroker.exe
1880	RuntimeBroker.exe
516	RuntimeBroker.exe
3064	RuntimeBroker.exe
6096	RuntimeBroker.exe
3932	RuntimeBroker.exe
3556	RuntimeBroker.exe
4548	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	2924	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	4832	RuntimeBroker.exe
Token: SeDebugPrivilege	5112	RuntimeBroker.exe
Token: SeDebugPrivilege	5604	RuntimeBroker.exe
Token: SeDebugPrivilege	1612	RuntimeBroker.exe
Token: SeDebugPrivilege	380	RuntimeBroker.exe
Token: SeDebugPrivilege	5756	RuntimeBroker.exe
Token: SeDebugPrivilege	1880	RuntimeBroker.exe
Token: SeDebugPrivilege	516	RuntimeBroker.exe
Token: SeDebugPrivilege	3064	RuntimeBroker.exe
Token: SeDebugPrivilege	6096	RuntimeBroker.exe
Token: SeDebugPrivilege	3932	RuntimeBroker.exe
Token: SeDebugPrivilege	3556	RuntimeBroker.exe
Token: SeDebugPrivilege	4548	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3924	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	115
PID 2288 wrote to memory of 3924	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	115
PID 2288 wrote to memory of 3480	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	116
PID 2288 wrote to memory of 3480	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	116
PID 2288 wrote to memory of 4064	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	117
PID 2288 wrote to memory of 4064	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	117
PID 2288 wrote to memory of 432	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	119
PID 2288 wrote to memory of 432	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	119
PID 2288 wrote to memory of 3524	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	120
PID 2288 wrote to memory of 3524	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	120
PID 2288 wrote to memory of 2364	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	121
PID 2288 wrote to memory of 2364	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	121
PID 2288 wrote to memory of 2924	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	123
PID 2288 wrote to memory of 2924	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	123
PID 2288 wrote to memory of 4280	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	124
PID 2288 wrote to memory of 4280	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	124
PID 2288 wrote to memory of 4832	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	131
PID 2288 wrote to memory of 4832	2288	38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe	131
PID 4832 wrote to memory of 2896	4832	RuntimeBroker.exe	133
PID 4832 wrote to memory of 2896	4832	RuntimeBroker.exe	133
PID 4832 wrote to memory of 5084	4832	RuntimeBroker.exe	134
PID 4832 wrote to memory of 5084	4832	RuntimeBroker.exe	134
PID 2896 wrote to memory of 5112	2896	WScript.exe	138
PID 2896 wrote to memory of 5112	2896	WScript.exe	138
PID 5112 wrote to memory of 3460	5112	RuntimeBroker.exe	139
PID 5112 wrote to memory of 3460	5112	RuntimeBroker.exe	139
PID 5112 wrote to memory of 1640	5112	RuntimeBroker.exe	140
PID 5112 wrote to memory of 1640	5112	RuntimeBroker.exe	140
PID 3460 wrote to memory of 5604	3460	WScript.exe	142
PID 3460 wrote to memory of 5604	3460	WScript.exe	142
PID 5604 wrote to memory of 4996	5604	RuntimeBroker.exe	143
PID 5604 wrote to memory of 4996	5604	RuntimeBroker.exe	143
PID 5604 wrote to memory of 4256	5604	RuntimeBroker.exe	144
PID 5604 wrote to memory of 4256	5604	RuntimeBroker.exe	144
PID 4996 wrote to memory of 1612	4996	WScript.exe	147
PID 4996 wrote to memory of 1612	4996	WScript.exe	147
PID 1612 wrote to memory of 5924	1612	RuntimeBroker.exe	148
PID 1612 wrote to memory of 5924	1612	RuntimeBroker.exe	148
PID 1612 wrote to memory of 4564	1612	RuntimeBroker.exe	149
PID 1612 wrote to memory of 4564	1612	RuntimeBroker.exe	149
PID 5924 wrote to memory of 380	5924	WScript.exe	150
PID 5924 wrote to memory of 380	5924	WScript.exe	150
PID 380 wrote to memory of 4796	380	RuntimeBroker.exe	151
PID 380 wrote to memory of 4796	380	RuntimeBroker.exe	151
PID 380 wrote to memory of 1480	380	RuntimeBroker.exe	152
PID 380 wrote to memory of 1480	380	RuntimeBroker.exe	152
PID 4796 wrote to memory of 5756	4796	WScript.exe	153
PID 4796 wrote to memory of 5756	4796	WScript.exe	153
PID 5756 wrote to memory of 1872	5756	RuntimeBroker.exe	154
PID 5756 wrote to memory of 1872	5756	RuntimeBroker.exe	154
PID 5756 wrote to memory of 1636	5756	RuntimeBroker.exe	155
PID 5756 wrote to memory of 1636	5756	RuntimeBroker.exe	155
PID 1872 wrote to memory of 1880	1872	WScript.exe	157
PID 1872 wrote to memory of 1880	1872	WScript.exe	157
PID 1880 wrote to memory of 6068	1880	RuntimeBroker.exe	159
PID 1880 wrote to memory of 6068	1880	RuntimeBroker.exe	159
PID 1880 wrote to memory of 2184	1880	RuntimeBroker.exe	160
PID 1880 wrote to memory of 2184	1880	RuntimeBroker.exe	160
PID 6068 wrote to memory of 516	6068	WScript.exe	161
PID 6068 wrote to memory of 516	6068	WScript.exe	161
PID 516 wrote to memory of 1488	516	RuntimeBroker.exe	162
PID 516 wrote to memory of 1488	516	RuntimeBroker.exe	162
PID 516 wrote to memory of 1720	516	RuntimeBroker.exe	163
PID 516 wrote to memory of 1720	516	RuntimeBroker.exe	163

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
"C:\Users\Admin\AppData\Local\Temp\38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\900323d723f1dd1206\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4600_849449143\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4460_573039931\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
  "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f07982f3-c159-405f-96de-135a5fc4f885.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
      "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa8dbe51-a347-4f23-a4d4-36bb5655ffa0.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbf16c29-c361-4088-a093-e5676f383eb2.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ebc1217-9276-4d24-a9bc-e582b1eab94e.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5924
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\020473e7-2b6c-4e13-9360-6328fbc8e8aa.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d245514-cb67-4133-8b0c-0726538b6349.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dec55831-5a5c-4d25-a63b-b838ad9ff069.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:6068
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\748cf9dc-b72b-48b5-8d9d-cb14bc387c0a.vbs"
        17⤵
        
        PID:1488
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a27b586-230c-45ce-ad0f-403a9001ce03.vbs"
        19⤵
        
        PID:4456
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8c6461a2-5bc7-4e8d-b8a6-bd1739601e06.vbs"
        21⤵
        
        PID:4864
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a0075b7-c748-49c1-823e-fa95db217541.vbs"
        23⤵
        
        PID:1916
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59700f5c-94bc-4b73-bea3-7e71a7abe509.vbs"
        25⤵
        
        PID:5332
        
        C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe
        
        "C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6f52a22-c921-43d0-9436-98fa44c4e631.vbs"
        27⤵
        
        PID:5416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10c55087-76af-4f89-a501-ef96b95b3f2b.vbs"
        27⤵
        
        PID:828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3515b7e4-88d5-4a94-893b-6a3dab891c0a.vbs"
        25⤵
        
        PID:5424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ae1cb4b-34b3-4990-a93d-3580e75e6117.vbs"
        23⤵
        
        PID:5924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b048609-be56-4829-b6a4-8a34f93a95a0.vbs"
        21⤵
        
        PID:1376
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62ead1bf-349a-4bda-87ae-ece4da106639.vbs"
        19⤵
        
        PID:4348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1100c99-829e-4591-9b8a-e57fe4449dee.vbs"
        17⤵
        
        PID:1720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f98d17a0-428f-4a17-98be-c97e85b07211.vbs"
        15⤵
        
        PID:2184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\990e5a79-89f7-4b92-936f-4f3692f7c384.vbs"
        13⤵
        
        PID:1636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59c17bba-b91c-4d2c-9e46-2bb2aab94947.vbs"
        11⤵
        
        PID:1480
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9f84a3d-225a-4b6d-b339-6fc2d3357c01.vbs"
        9⤵
        
        PID:4564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e562c5bf-058d-4548-961e-b2f03c8ba715.vbs"
        7⤵
        
        PID:4256
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f2c51579-6354-46ff-94c5-2e137bc8e074.vbs"
        5⤵
        
        PID:1640
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a796d3b1-e0fe-4aa5-b309-64f24c195c79.vbs"
    3⤵
    PID:5084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\900323d723f1dd1206\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\900323d723f1dd1206\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\900323d723f1dd1206\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\edge_BITS_4460_115844552\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\60739cf6f660743813\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\60739cf6f660743813\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\60739cf6f660743813\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\edge_BITS_4600_849449143\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4600_849449143\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4600_849449143\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\edge_BITS_4460_573039931\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4460_573039931\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\edge_BITS_4460_573039931\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\60739cf6f660743813\upfc.exe

Filesize
1.6MB

MD5
38f861dde9adcb292ab747d998438b20

SHA1
0ace12fd6fda2f2663b5b2c83c9451ad439436e0

SHA256
38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0

SHA512
3ce0f60b7031d2e5d3e108663d1c7b3d07bb467be1ec0b02e61e2e49161593e2700fec12d144ffaa7e2d1401b5adeb53bb3c1d8a3d48e711c1e5f9ecaa96513a

Download Submit
C:\Program Files\edge_BITS_4460_573039931\csrss.exe

Filesize
1.6MB

MD5
60f5b69ca495fb6b9b6f9a4a4597393d

SHA1
3f6ce659fd29c86636be83f9e7dc2f97bc2c05b9

SHA256
3793cf521b854203867e7dbeaaa7d32a198c0613e9612a09a3220c39a718c9dc

SHA512
809f3e77925decebf096e3aba5617acfceb5e0ea03c7105bfbcdca0890811f9451e4e7edf3fb3355e8f824899dbb52c43bef2bea7b3ce2fea8cdb5fccb308cc2

Download Submit
C:\Program Files\edge_BITS_4600_849449143\unsecapp.exe

Filesize
1.6MB

MD5
84e6c47320b9fc8b5a2d21106dac82f7

SHA1
9986125f263d057bc47cbdfee9706dc3c184dada

SHA256
4b44aa0488cbdbd9d6859dfb029f7abf60f18ee05d7781f0006c3201af9c5362

SHA512
194f7d1b6129f1fe95033a09998173a00440ca6a117156c5d01d1502cd6d2fcc24a954104f8078048d20aab0df53b3a02f2388826621f90fddd36bcec1164333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
354ebb8d437ee057dacfef36baced4e9

SHA1
30460dbe64847ebb524d7d1fd5b9bf8a851a7626

SHA256
bcf3ba98af6ee96a3eba9bbc6bdb2ae36b883f5f1e9cdad2974cbbcb9c102237

SHA512
1f2cb272ad33df6e34949ac4d60ec0702316d9e21992be52cd9c6abd846472e7c868a8e96b5922b016e7952e460671e5768d007e28d84940a1b956eef4705b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
abc61b7a532b5a8ab5bede2f413c1a71

SHA1
82ed1d78231b408bd8c072b7e08ac0aec0c43a7e

SHA256
43027d7e917d7dc6caa6621eec3187dbfb8c2d3d02f3e0b4c8cf0a37505c9a51

SHA512
2ebe7180da937c44f332dfec8e1b0e5a6b00a8825555829ad6a631d7e54252d3254b9c544370717042cc6c118b83f21f09798d5891d3919363c69439af956adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5a933acb47347f3acfbe61dc611837f1

SHA1
0f971f7257c034fa64d9b6bcea2ea6962c48dfb7

SHA256
98f9484f576da87f1a99c6c495e2cd222e139d6867e8409cadde65ccbdb991dd

SHA512
74094c94c5864fbc99cb293d43ecd147686160c32c323ee0e3577e6d1b28b6a68c921cf3711c73c510eea5b6ce0b24268753dfc38b4f67f9a6a238bb4e8bef83

Download Submit
C:\Users\Admin\AppData\Local\Temp\020473e7-2b6c-4e13-9360-6328fbc8e8aa.vbs

Filesize
734B

MD5
9e66fa208e746bde2790a2763c8f52a1

SHA1
37ca1e376dfbb63c89160299e0b8a00141e88782

SHA256
8ad9d105f17e6f16b4340bc7b3e8a51a475062677950687543428b69f1ee7d93

SHA512
7a10247b6d6b6c0ed43a041171d91b68733be2c6678ec03123d91e4525f948f28e2f19e53711bac30ccd200ae046f6389cd00a3db9255426be093b1ffc55f32a

Download Submit
C:\Users\Admin\AppData\Local\Temp\59700f5c-94bc-4b73-bea3-7e71a7abe509.vbs

Filesize
735B

MD5
fde0e7f8fdc6373a2709de252702ff22

SHA1
6b0daeb1849d3e107293c14a539d7e4e5958678b

SHA256
7665975d04baa7b4744f155e2d2cdf50229ea4823909bb9bb8cd981e53a09230

SHA512
86020929cfbc185c6c6293c4d63571c800d9b620b919beac946016259c4ce595202ff87defedd26988b03fae1e10d9675a22b28a3d1d5df69937263a0b717946

Download Submit
C:\Users\Admin\AppData\Local\Temp\748cf9dc-b72b-48b5-8d9d-cb14bc387c0a.vbs

Filesize
734B

MD5
7f7f9a34a3f60e0c8669c1307f552c96

SHA1
b131c35649eba3d9e9a418041d1f2114636b0005

SHA256
4582bf08ff2a40810fda8595744266a59aaf41031261e1696e510736b7fffa0b

SHA512
ab17729c3b57ad334892b2fc56309ee71419b7c67ff647e5b573038b6eb0cdbb8e5fff0c140c118df166dafee7ed455a6d3892640debf5e81e451fa7040c0e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8c6461a2-5bc7-4e8d-b8a6-bd1739601e06.vbs

Filesize
735B

MD5
63c3d652b53bba5734a9b9f713851536

SHA1
3e6cb951fe5c4c7c5551594856ece12aee99aa9c

SHA256
c32f902cc9625fcc41681d28ead38a673e39874f279cefc963b34359f96b794e

SHA512
d4bacfbd1e5fbc470544aef86d12ac72d3f7895c15dbb7c673883c2f9fc02550f7c80314dcf6f054503e526629c6d70f98fe0707df01aa8904788c4ef0470b3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\8d245514-cb67-4133-8b0c-0726538b6349.vbs

Filesize
735B

MD5
7a1b6b407297ef9b4392bf79a0b10800

SHA1
6f2db9ae2c00f5862e6e4ecf9355249ce55c120f

SHA256
01cc39049847b54f36cf3a9572776e46b4fb4c703acd042a3dc04ab6bce00b2f

SHA512
f4e45fa50300f3cdfb7348a062a03b92f0c6553d7400645052e812d303b60f179a97cac3b44b713aaead3852143bcc675e5c3a51509f4faeaca2b209bef58565

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a0075b7-c748-49c1-823e-fa95db217541.vbs

Filesize
735B

MD5
9656089dea05bcadde3e08bc00547b98

SHA1
4900ec6ab98a56dbee623dd0a29f53d01e77183d

SHA256
9d0cf793684aa6088fe4d04630af1e5bf6ee91630a0a6388cfb20dcde2f02764

SHA512
b361991ac1764ae23899861adfe9ae8cab7ae1543ce509d06f306003ad9229276bb0fb489946a74d177952318413b3dcbcb0ad26106ec6d95b9ea9db3fc1b349

Download Submit
C:\Users\Admin\AppData\Local\Temp\9a27b586-230c-45ce-ad0f-403a9001ce03.vbs

Filesize
735B

MD5
ef6a22e82849b7c864d8b01c4f92a138

SHA1
6f4ad9bfa0e8cb167807863dbd88cabe26a841db

SHA256
1266231bb05b770a30716f733a142a4615d41620a12d208e766476d501494269

SHA512
c210dab581c67bc6c2c3057002d482f42a14c6f16fa4d6692f800f6eb8d235e4161040d2f2d1c4e9adcd2f4222b44c1054938247d59650c1c932510993996808

Download Submit
C:\Users\Admin\AppData\Local\Temp\9ebc1217-9276-4d24-a9bc-e582b1eab94e.vbs

Filesize
735B

MD5
40091d12b51a206e7e04c69a5e17a8d8

SHA1
f2ee4e2551349cc2c962d77665197d8e7de3ec25

SHA256
3cee57beb2ce42f08d55f399b377726da171eaa79e0e34f1ca1809029dc084ed

SHA512
9a27d6886a4003e86c3b7ef4caeadfdf772a6a72e0c75abb0664eb040a8d4abcd1c4ec446d6536a977a2a14a1011f877656d7fc05ba5d914652724743095e252

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgm1xnht.rre.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a796d3b1-e0fe-4aa5-b309-64f24c195c79.vbs

Filesize
511B

MD5
0d63e6c6e10bdec0799586caa71a79fa

SHA1
d8ae17c61f6ad58da244d8f2f3c6d162f2998023

SHA256
dc849c01d6a93e6ab8bfbf05d757ec96097d915d040acde3c1913da5356c37ab

SHA512
91c44162ce4e23d5959ff5466908861a19a25517bbacbb1b8435db676f4ce66a46ebd95aef04a4fb10d9823243b19f3b5196df7fde438336bf9a4effd9d7eb05

Download Submit
C:\Users\Admin\AppData\Local\Temp\aa8dbe51-a347-4f23-a4d4-36bb5655ffa0.vbs

Filesize
735B

MD5
583db8a5bacf822506a82555f4924fde

SHA1
2897061e9f2ae06ceaf51a6b63e14a9cfce17be4

SHA256
4bc122a08bce510da595fba0540977a7faa6624e7353d25ed030cfaf4e221bb1

SHA512
816a3c9abb38dd3f22bb04be78bd2a4edbb062cf9ad29643e4a035b6cd9a65e71b2751cf1a858a2b7a2563bca27fc33133a708a41d9506eedceb288a5f5e324c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c6f52a22-c921-43d0-9436-98fa44c4e631.vbs

Filesize
735B

MD5
22e63d583540081f0a6d84311df924d0

SHA1
b8cd12445047431740769f8f1049fefff84c590e

SHA256
23eee232fe610a18d1b78f57f6f0ccd0ca2b6f46216c0a5fa284b301fbd6f739

SHA512
77331c0e17ad77c69ae3587e6ce3337bd569ed81ea0c1666a3478e3ff5f3f5e2cbc9ecda33f5d496e99bf0f86df298b843f606aa7f17db646636003f702e5034

Download Submit
C:\Users\Admin\AppData\Local\Temp\dec55831-5a5c-4d25-a63b-b838ad9ff069.vbs

Filesize
735B

MD5
a6a8f62965f095f9dc0eca23cbb705be

SHA1
703a608dc217e14c4ac22cc56486723283d9749f

SHA256
aeb3fa40d8820b1595d2b7ff5929c8b9a333b4bb4f4a688dab25db026a5cebf3

SHA512
a5646e6773be13b7124e7f1d39691fa4786f800587c69116b6b569eb91fa7515dfa6e7e01b27ff13b29b884fb18ee104f65ea406cee0f75e3bf7e0bddbdda30c

Download Submit
C:\Users\Admin\AppData\Local\Temp\f07982f3-c159-405f-96de-135a5fc4f885.vbs

Filesize
735B

MD5
ff1fceff32cb2bd40ccb264996f60029

SHA1
14c75f25c6d15c2f45e2d0974ecaf1be199d8496

SHA256
e642d9987a96c2adafb5bbb591c7d6f0b9e8287e3ff65b0c7e9dcfe82f671b2b

SHA512
4af05d3f88807f2421b740ff134798d44281e3328e271cf3d8f39bb3c4b503b2645e3cc438d1b7ad205533f237012f5ac51c9a06e94d4ec2eb1875477696a97b

Download Submit
C:\Users\Admin\AppData\Local\Temp\f41467ed2f8f667b0802443f55c4739e035a691f.exe

Filesize
1.6MB

MD5
0ccea7336ebe785712e6f14e51e78d03

SHA1
819ed4bae8db9e3e60145c242e1c81f38b05ffbb

SHA256
095ff11d4d67e71ce17d5cc1967a2a5dd8c7dd5b491c36184129236fb7f9b62f

SHA512
8e98129db6cc81e73c8820d72989124a427ddbf809503ea279a802fbf7dfcafc29b9b9f0d2ed2556b2b7f3ec089d686038f20d2c308b01911bf002fc6dc5ff09

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbf16c29-c361-4088-a093-e5676f383eb2.vbs

Filesize
735B

MD5
2d45f5a1b600f3de7052f1fd2cce32d4

SHA1
eee93a60d89460e2cbd0303dff6a1a60bb241687

SHA256
9ff8275ea1bc042fa68a66a577f3d1dd0f35e5f729aba0464d521fbcf8f05149

SHA512
85ec1cf45b21da3d18777414f0f1424bbcf75ec58a22dda25c4024ffea71fcc0dbe48567039f47d61b030ebe3eb559bf8c9183a9d5073cd59d803c38116de652

Download Submit
memory/432-176-0x000001C3D8F80000-0x000001C3D8FA2000-memory.dmp

Filesize
136KB

Download
memory/2288-12-0x0000000003230000-0x000000000323A000-memory.dmp

Filesize
40KB

Download
memory/2288-13-0x000000001BA80000-0x000000001BA8E000-memory.dmp

Filesize
56KB

Download
memory/2288-5-0x0000000001550000-0x0000000001560000-memory.dmp

Filesize
64KB

Download
memory/2288-251-0x00007FFAE7990000-0x00007FFAE8451000-memory.dmp

Filesize
10.8MB

Download
memory/2288-7-0x0000000001590000-0x0000000001598000-memory.dmp

Filesize
32KB

Download
memory/2288-9-0x0000000003090000-0x0000000003098000-memory.dmp

Filesize
32KB

Download
memory/2288-10-0x00000000030A0000-0x00000000030AC000-memory.dmp

Filesize
48KB

Download
memory/2288-11-0x0000000003220000-0x000000000322C000-memory.dmp

Filesize
48KB

Download
memory/2288-4-0x00000000031D0000-0x0000000003220000-memory.dmp

Filesize
320KB

Download
memory/2288-0-0x00007FFAE7993000-0x00007FFAE7995000-memory.dmp

Filesize
8KB

Download
memory/2288-6-0x0000000003070000-0x0000000003086000-memory.dmp

Filesize
88KB

Download
memory/2288-14-0x000000001BA90000-0x000000001BA98000-memory.dmp

Filesize
32KB

Download
memory/2288-16-0x000000001BAB0000-0x000000001BABA000-memory.dmp

Filesize
40KB

Download
memory/2288-17-0x000000001BAC0000-0x000000001BACC000-memory.dmp

Filesize
48KB

Download
memory/2288-15-0x000000001BAA0000-0x000000001BAA8000-memory.dmp

Filesize
32KB

Download
memory/2288-8-0x00000000030B0000-0x00000000030C0000-memory.dmp

Filesize
64KB

Download
memory/2288-3-0x0000000001570000-0x000000000158C000-memory.dmp

Filesize
112KB

Download
memory/2288-2-0x00007FFAE7990000-0x00007FFAE8451000-memory.dmp

Filesize
10.8MB

Download
memory/2288-1-0x0000000000B70000-0x0000000000D12000-memory.dmp

Filesize
1.6MB

Download