dcrat | 7e71c79883eb025596762b4e0bf86b447039079dfe510ccf13a383b612575fa6

Analysis

max time kernel
138s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d81f411b0ec1ac7d861358e145db4ba.exe
Size

999KB
MD5

3d81f411b0ec1ac7d861358e145db4ba
SHA1

4b945e693bc455840912fc5b5f155c36501d235e
SHA256

72b49e4d9aa54af40111e35d0d4bcb4a7a313c4f2f5c5f33c3b7a093b7f4fc0e
SHA512

216c654e895ec5065b7d724f5421184e2a3445f4b801f0ebcc3ce34676e2d89240f22af079fd7a7d074af3567ee483ebe2f6b40bfea224956ff00f5d326894fe
SSDEEP

12288:H9pLLk45WSSY1BX6f4bIS7rMNetPfC9Vs6IFGs0jxAqXj9xPSI0dzNgCoD7WX+Iu:H9pP5WS3lrMNyC9TJPCXBi

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat 60 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
4800	schtasks.exe
3548	schtasks.exe
4992	schtasks.exe
1468	schtasks.exe
5272	schtasks.exe
1080	schtasks.exe
2376	schtasks.exe
5772	schtasks.exe
4856	schtasks.exe
3992	schtasks.exe
5516	schtasks.exe
4432	schtasks.exe
4704	schtasks.exe
3612	schtasks.exe
2912	schtasks.exe
1380	schtasks.exe
2388	schtasks.exe
4104	schtasks.exe
6012	schtasks.exe
856	schtasks.exe
2300	schtasks.exe
2264	schtasks.exe
3880	schtasks.exe
964	schtasks.exe
4100	schtasks.exe
5988	schtasks.exe
4444	schtasks.exe
4820	schtasks.exe
5712	schtasks.exe
5520	schtasks.exe
4908	schtasks.exe
1612	schtasks.exe
4700	schtasks.exe
4044	schtasks.exe
4016	schtasks.exe
448	schtasks.exe
4708	schtasks.exe
3768	schtasks.exe
2132	schtasks.exe
4872	schtasks.exe
5056	schtasks.exe
5064	schtasks.exe
508	schtasks.exe
1252	schtasks.exe
5168	schtasks.exe
3380	schtasks.exe
4436	schtasks.exe
6096	schtasks.exe
2236	schtasks.exe
5108	schtasks.exe
5232	schtasks.exe
5704	schtasks.exe
1488	schtasks.exe
3484	schtasks.exe
4760	schtasks.exe
4368	schtasks.exe
4692	schtasks.exe
3608	schtasks.exe
4888	schtasks.exe
5052	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 15 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\taskhostw.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\ProgramData\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\S-1-5-21-3920955164-3782810283-1225622749-1000\\services.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\taskhostw.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\taskhostw.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\ProgramData\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\S-1-5-21-3920955164-3782810283-1225622749-1000\\services.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\taskhostw.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\services.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\taskhostw.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\", \"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\", \"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\", \"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\", \"C:\\Users\\All Users\\taskhostw.exe\", \"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\services.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\explorer.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe

Process spawned unexpected child process 60 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6012	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	508	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5272	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3992	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5704	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5520	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6096	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5232	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5712	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4992	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5516	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5064	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5772	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5168	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5988	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4016	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4760	4544	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	4544	schtasks.exe	86

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	3d81f411b0ec1ac7d861358e145db4ba.exe

Executes dropped EXE 1 IoCs

pid	Process
1752	dllhost.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Users\\All Users\\regid.1991-06.com.microsoft\\TextInputHost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ProgramData\\Package Cache\\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\\RuntimeBroker.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\unsecapp.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\ProgramData\\Microsoft OneDrive\\setup\\RuntimeBroker.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\services.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\es-ES\\dwm.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\34c553de294c1d56d0a800105b\\backgroundTaskHost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\PerceptionSimulation\\pris\\dllhost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\2f3e0199fccb3f72e8a39924edc6a781\\Registry.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\All Users\\taskhostw.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\ProgramData\\Packages\\Microsoft.Getstarted_8wekyb3d8bbwe\\S-1-5-21-3920955164-3782810283-1225622749-1000\\services.exe\""	3d81f411b0ec1ac7d861358e145db4ba.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\PerceptionSimulation\pris\5940a34987c991	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Windows\System32\PerceptionSimulation\pris\RCXEE0F.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Windows\System32\PerceptionSimulation\pris\RCXEE30.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe	3d81f411b0ec1ac7d861358e145db4ba.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\6cb0b6c459d5d3	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCX255.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCX256.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCX51.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\services.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\services.exe	3d81f411b0ec1ac7d861358e145db4ba.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\c5b4cb5e9653cc	3d81f411b0ec1ac7d861358e145db4ba.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXFFE2.tmp	3d81f411b0ec1ac7d861358e145db4ba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 60 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4016	schtasks.exe
3484	schtasks.exe
4760	schtasks.exe
5052	schtasks.exe
3548	schtasks.exe
4856	schtasks.exe
4444	schtasks.exe
4100	schtasks.exe
5520	schtasks.exe
5712	schtasks.exe
5108	schtasks.exe
1380	schtasks.exe
4800	schtasks.exe
5704	schtasks.exe
3608	schtasks.exe
4708	schtasks.exe
4704	schtasks.exe
1468	schtasks.exe
6012	schtasks.exe
4872	schtasks.exe
5272	schtasks.exe
3612	schtasks.exe
2132	schtasks.exe
2236	schtasks.exe
4992	schtasks.exe
2300	schtasks.exe
2264	schtasks.exe
1488	schtasks.exe
2388	schtasks.exe
5772	schtasks.exe
3380	schtasks.exe
4820	schtasks.exe
4436	schtasks.exe
1612	schtasks.exe
4888	schtasks.exe
1252	schtasks.exe
3768	schtasks.exe
5516	schtasks.exe
5064	schtasks.exe
5988	schtasks.exe
448	schtasks.exe
4432	schtasks.exe
856	schtasks.exe
5056	schtasks.exe
2376	schtasks.exe
2912	schtasks.exe
3992	schtasks.exe
4104	schtasks.exe
3880	schtasks.exe
964	schtasks.exe
508	schtasks.exe
4368	schtasks.exe
4692	schtasks.exe
4908	schtasks.exe
4700	schtasks.exe
6096	schtasks.exe
1080	schtasks.exe
5232	schtasks.exe
4044	schtasks.exe
5168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1124	3d81f411b0ec1ac7d861358e145db4ba.exe
1124	3d81f411b0ec1ac7d861358e145db4ba.exe
1124	3d81f411b0ec1ac7d861358e145db4ba.exe
1124	3d81f411b0ec1ac7d861358e145db4ba.exe
1124	3d81f411b0ec1ac7d861358e145db4ba.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	3d81f411b0ec1ac7d861358e145db4ba.exe
Token: SeDebugPrivilege	1752	dllhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1752	1124	3d81f411b0ec1ac7d861358e145db4ba.exe	147
PID 1124 wrote to memory of 1752	1124	3d81f411b0ec1ac7d861358e145db4ba.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3d81f411b0ec1ac7d861358e145db4ba.exe
"C:\Users\Admin\AppData\Local\Temp\3d81f411b0ec1ac7d861358e145db4ba.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe
  "C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc MINUTE /mo 14 /tr "'C:\34c553de294c1d56d0a800105b\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONSTART /tr "'C:\34c553de294c1d56d0a800105b\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\34c553de294c1d56d0a800105b\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONSTART /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc MINUTE /mo 11 /tr "'C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONSTART /tr "'C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\System32\PerceptionSimulation\pris\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 13 /tr "'C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONSTART /tr "'C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc MINUTE /mo 10 /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONSTART /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONSTART /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc MINUTE /mo 11 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONSTART /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 13 /tr "'C:\ProgramData\Microsoft OneDrive\setup\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONSTART /tr "'C:\ProgramData\Microsoft OneDrive\setup\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\ProgramData\Microsoft OneDrive\setup\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONSTART /tr "'C:\Users\All Users\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONSTART /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONSTART /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONSTART /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc MINUTE /mo 12 /tr "'C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\S-1-5-21-3920955164-3782810283-1225622749-1000\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\S-1-5-21-3920955164-3782810283-1225622749-1000\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONSTART /tr "'C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\S-1-5-21-3920955164-3782810283-1225622749-1000\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\ProgramData\Packages\Microsoft.Getstarted_8wekyb3d8bbwe\S-1-5-21-3920955164-3782810283-1225622749-1000\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONSTART /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe

Filesize
999KB

MD5
3d81f411b0ec1ac7d861358e145db4ba

SHA1
4b945e693bc455840912fc5b5f155c36501d235e

SHA256
72b49e4d9aa54af40111e35d0d4bcb4a7a313c4f2f5c5f33c3b7a093b7f4fc0e

SHA512
216c654e895ec5065b7d724f5421184e2a3445f4b801f0ebcc3ce34676e2d89240f22af079fd7a7d074af3567ee483ebe2f6b40bfea224956ff00f5d326894fe

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\services.exe

Filesize
999KB

MD5
652a5a81a419f270f9a544f5cd785169

SHA1
68bfad412af0a94fdd2651768bdb22dc942af849

SHA256
300ae2bd9ab44f86a6fa607245e0b32325f5dcfa0ae158797ba5f5e8132aea78

SHA512
269fc75e5bcd712ed1b2c014bdbb4230704c9113e4ef3df551db3a320a84f20a970291fb7f6c5cfe79f5c849955cc0acc78c300f2e00d437313d81f176ec308b

Download Submit
memory/1124-3-0x0000000002710000-0x000000000272C000-memory.dmp

Filesize
112KB

Download
memory/1124-9-0x0000000002890000-0x000000000289E000-memory.dmp

Filesize
56KB

Download
memory/1124-0-0x00007FF8DB2B3000-0x00007FF8DB2B5000-memory.dmp

Filesize
8KB

Download
memory/1124-5-0x0000000002730000-0x0000000002740000-memory.dmp

Filesize
64KB

Download
memory/1124-7-0x0000000002760000-0x0000000002770000-memory.dmp

Filesize
64KB

Download
memory/1124-6-0x0000000002750000-0x0000000002760000-memory.dmp

Filesize
64KB

Download
memory/1124-8-0x0000000002770000-0x000000000277C000-memory.dmp

Filesize
48KB

Download
memory/1124-4-0x00000000028E0000-0x0000000002930000-memory.dmp

Filesize
320KB

Download
memory/1124-10-0x00000000028A0000-0x00000000028AC000-memory.dmp

Filesize
48KB

Download
memory/1124-11-0x00000000028B0000-0x00000000028BC000-memory.dmp

Filesize
48KB

Download
memory/1124-2-0x00007FF8DB2B0000-0x00007FF8DBD71000-memory.dmp

Filesize
10.8MB

Download
memory/1124-1-0x0000000000510000-0x0000000000610000-memory.dmp

Filesize
1024KB

Download
memory/1124-186-0x00007FF8DB2B3000-0x00007FF8DB2B5000-memory.dmp

Filesize
8KB

Download
memory/1124-211-0x00007FF8DB2B0000-0x00007FF8DBD71000-memory.dmp

Filesize
10.8MB

Download
memory/1124-226-0x00007FF8DB2B0000-0x00007FF8DBD71000-memory.dmp

Filesize
10.8MB

Download