Overview
overview
10Static
static
104b5d342b8c...86.exe
windows7-x64
94b5d342b8c...86.exe
windows10-2004-x64
94bb452a3de...a3.exe
windows7-x64
104bb452a3de...a3.exe
windows10-2004-x64
74bbf1f33d0...4d.exe
windows7-x64
84bbf1f33d0...4d.exe
windows10-2004-x64
84bc17871c1...64.exe
windows7-x64
104bc17871c1...64.exe
windows10-2004-x64
104be84836f6...c8.exe
windows7-x64
104be84836f6...c8.exe
windows10-2004-x64
104c2f38b994...d5.exe
windows7-x64
104c2f38b994...d5.exe
windows10-2004-x64
104c948e4226...26.exe
windows7-x64
104c948e4226...26.exe
windows10-2004-x64
104ca1d61a24...2e.exe
windows7-x64
104ca1d61a24...2e.exe
windows10-2004-x64
104cc3e6fe69...22.exe
windows7-x64
104cc3e6fe69...22.exe
windows10-2004-x64
104cf9706999...8e.exe
windows7-x64
104cf9706999...8e.exe
windows10-2004-x64
104d8cd82fa6...d5.exe
windows7-x64
104d8cd82fa6...d5.exe
windows10-2004-x64
104d947659fe...19.exe
windows7-x64
104d947659fe...19.exe
windows10-2004-x64
104dac62ad00...ec.exe
windows7-x64
104dac62ad00...ec.exe
windows10-2004-x64
104dde57eed0...7b.exe
windows7-x64
104dde57eed0...7b.exe
windows10-2004-x64
104e1fdde317...d3.exe
windows7-x64
104e1fdde317...d3.exe
windows10-2004-x64
104e248cce2f...a7.exe
windows7-x64
104e248cce2f...a7.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:10
Behavioral task
behavioral1
Sample
4b5d342b8c5a5b19fac86b1315802786.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
4b5d342b8c5a5b19fac86b1315802786.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
4bc17871c10bb28c4e2b5e2f1d9e4664.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
4bc17871c10bb28c4e2b5e2f1d9e4664.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
4be84836f68985fd15cbf992a7b0e782d1bab4439960e27c6e252e76a89ce2c8.exe
Resource
win7-20250207-en
Behavioral task
behavioral10
Sample
4be84836f68985fd15cbf992a7b0e782d1bab4439960e27c6e252e76a89ce2c8.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
4c2f38b99403c4aaca4e0a524b094c17b8d7b462af1041dee9e7562c512af4d5.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
4c2f38b99403c4aaca4e0a524b094c17b8d7b462af1041dee9e7562c512af4d5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
4c948e42267877c379b01be5faa66926.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
4c948e42267877c379b01be5faa66926.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
4ca1d61a2465b19118d75478ec45e38cf03e101fd7422cfb04e4a526251ac92e.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
4ca1d61a2465b19118d75478ec45e38cf03e101fd7422cfb04e4a526251ac92e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
4cc3e6fe699a661d5a6ea786a93cfacd887570860b351476e5f5a1d3616bf922.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
4cc3e6fe699a661d5a6ea786a93cfacd887570860b351476e5f5a1d3616bf922.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
4cf97069999c57b9ff02fc34f4efbe8e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
4cf97069999c57b9ff02fc34f4efbe8e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
4d8cd82fa6662df02eb5af2abbf815d5.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
4d8cd82fa6662df02eb5af2abbf815d5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
4d947659fef83a302fd6b7451b980b19.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
4d947659fef83a302fd6b7451b980b19.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
4dac62ad007ffed0e0d4b738af6da8ec.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
4dac62ad007ffed0e0d4b738af6da8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
4dde57eed00149aa841c1408694ff4614ca0f5c17c6b4ef8040bef7639be857b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
4dde57eed00149aa841c1408694ff4614ca0f5c17c6b4ef8040bef7639be857b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
4e1fdde317913d69f35aa03397b5ded3.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
4e1fdde317913d69f35aa03397b5ded3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
4e248cce2fb9b5f155ca62d21c6e9da7.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
4e248cce2fb9b5f155ca62d21c6e9da7.exe
Resource
win10v2004-20250314-en
General
-
Target
4c948e42267877c379b01be5faa66926.exe
-
Size
5.9MB
-
MD5
4c948e42267877c379b01be5faa66926
-
SHA1
282254e3ab196c9810c8bdf74f3fe00977bfa120
-
SHA256
63a4873a5658c4de311b5952d39969115f434f90c14d18a991dbc475b03ce8a7
-
SHA512
776483f78e6f9634551ce06d87e8fad9a58afbd962d62eb6176f2e5d05bf3c77a026af2b2e0a36c22957141de18ce085e9084aafb0c3ca3436270395f6fc5612
-
SSDEEP
98304:hyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw47:hyeU11Rvqmu8TWKnF6N/1wK
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2448 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2464 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2760 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 328 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 112 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1060 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2272 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 772 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1452 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 108 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1232 2620 schtasks.exe 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1000 2620 schtasks.exe 29 -
UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4c948e42267877c379b01be5faa66926.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 4c948e42267877c379b01be5faa66926.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 4c948e42267877c379b01be5faa66926.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1632 powershell.exe 1464 powershell.exe 276 powershell.exe 1796 powershell.exe 684 powershell.exe 356 powershell.exe 576 powershell.exe 1520 powershell.exe 2996 powershell.exe 1864 powershell.exe 2516 powershell.exe 900 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 4c948e42267877c379b01be5faa66926.exe -
Executes dropped EXE 3 IoCs
pid Process 2480 taskhost.exe 3040 taskhost.exe 1584 taskhost.exe -
Checks whether UAC is enabled 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4c948e42267877c379b01be5faa66926.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4c948e42267877c379b01be5faa66926.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA taskhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 2480 taskhost.exe 2480 taskhost.exe 3040 taskhost.exe 3040 taskhost.exe 1584 taskhost.exe 1584 taskhost.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Adobe\Updater6\spoolsv.exe 4c948e42267877c379b01be5faa66926.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\f3b6ecef712a24 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\RCX9056.tmp 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\RCX9057.tmp 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe 4c948e42267877c379b01be5faa66926.exe File created C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe 4c948e42267877c379b01be5faa66926.exe File created C:\Program Files\Reference Assemblies\Microsoft\24dbde2999530e 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\RCX947F.tmp 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\RCX94FC.tmp 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\spoolsv.exe 4c948e42267877c379b01be5faa66926.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\PCHEALTH\RCX926B.tmp 4c948e42267877c379b01be5faa66926.exe File created C:\Windows\system\886983d96e3d3e 4c948e42267877c379b01be5faa66926.exe File created C:\Windows\PCHEALTH\System.exe 4c948e42267877c379b01be5faa66926.exe File created C:\Windows\PCHEALTH\27d1bcfc3c54e0 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Windows\PCHEALTH\System.exe 4c948e42267877c379b01be5faa66926.exe File created C:\Windows\system\csrss.exe 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Windows\system\RCX8E41.tmp 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Windows\system\RCX8E42.tmp 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Windows\system\csrss.exe 4c948e42267877c379b01be5faa66926.exe File opened for modification C:\Windows\PCHEALTH\RCX926A.tmp 4c948e42267877c379b01be5faa66926.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1000 schtasks.exe 1060 schtasks.exe 1452 schtasks.exe 2448 schtasks.exe 2464 schtasks.exe 2284 schtasks.exe 2288 schtasks.exe 1932 schtasks.exe 2944 schtasks.exe 2760 schtasks.exe 112 schtasks.exe 2272 schtasks.exe 1232 schtasks.exe 328 schtasks.exe 2056 schtasks.exe 772 schtasks.exe 2412 schtasks.exe 108 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 576 powershell.exe 900 powershell.exe 1632 powershell.exe 1744 4c948e42267877c379b01be5faa66926.exe 1744 4c948e42267877c379b01be5faa66926.exe 276 powershell.exe 684 powershell.exe 1864 powershell.exe 2996 powershell.exe 1796 powershell.exe 1520 powershell.exe 356 powershell.exe 2516 powershell.exe 1464 powershell.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe 2480 taskhost.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 1744 4c948e42267877c379b01be5faa66926.exe Token: SeDebugPrivilege 576 powershell.exe Token: SeDebugPrivilege 900 powershell.exe Token: SeDebugPrivilege 1632 powershell.exe Token: SeDebugPrivilege 276 powershell.exe Token: SeDebugPrivilege 684 powershell.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeDebugPrivilege 2996 powershell.exe Token: SeDebugPrivilege 1796 powershell.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 356 powershell.exe Token: SeDebugPrivilege 2516 powershell.exe Token: SeDebugPrivilege 1464 powershell.exe Token: SeDebugPrivilege 2480 taskhost.exe Token: SeDebugPrivilege 3040 taskhost.exe Token: SeDebugPrivilege 1584 taskhost.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1744 wrote to memory of 576 1744 4c948e42267877c379b01be5faa66926.exe 48 PID 1744 wrote to memory of 576 1744 4c948e42267877c379b01be5faa66926.exe 48 PID 1744 wrote to memory of 576 1744 4c948e42267877c379b01be5faa66926.exe 48 PID 1744 wrote to memory of 1632 1744 4c948e42267877c379b01be5faa66926.exe 49 PID 1744 wrote to memory of 1632 1744 4c948e42267877c379b01be5faa66926.exe 49 PID 1744 wrote to memory of 1632 1744 4c948e42267877c379b01be5faa66926.exe 49 PID 1744 wrote to memory of 356 1744 4c948e42267877c379b01be5faa66926.exe 51 PID 1744 wrote to memory of 356 1744 4c948e42267877c379b01be5faa66926.exe 51 PID 1744 wrote to memory of 356 1744 4c948e42267877c379b01be5faa66926.exe 51 PID 1744 wrote to memory of 1464 1744 4c948e42267877c379b01be5faa66926.exe 52 PID 1744 wrote to memory of 1464 1744 4c948e42267877c379b01be5faa66926.exe 52 PID 1744 wrote to memory of 1464 1744 4c948e42267877c379b01be5faa66926.exe 52 PID 1744 wrote to memory of 900 1744 4c948e42267877c379b01be5faa66926.exe 53 PID 1744 wrote to memory of 900 1744 4c948e42267877c379b01be5faa66926.exe 53 PID 1744 wrote to memory of 900 1744 4c948e42267877c379b01be5faa66926.exe 53 PID 1744 wrote to memory of 2516 1744 4c948e42267877c379b01be5faa66926.exe 55 PID 1744 wrote to memory of 2516 1744 4c948e42267877c379b01be5faa66926.exe 55 PID 1744 wrote to memory of 2516 1744 4c948e42267877c379b01be5faa66926.exe 55 PID 1744 wrote to memory of 684 1744 4c948e42267877c379b01be5faa66926.exe 57 PID 1744 wrote to memory of 684 1744 4c948e42267877c379b01be5faa66926.exe 57 PID 1744 wrote to memory of 684 1744 4c948e42267877c379b01be5faa66926.exe 57 PID 1744 wrote to memory of 1864 1744 4c948e42267877c379b01be5faa66926.exe 58 PID 1744 wrote to memory of 1864 1744 4c948e42267877c379b01be5faa66926.exe 58 PID 1744 wrote to memory of 1864 1744 4c948e42267877c379b01be5faa66926.exe 58 PID 1744 wrote to memory of 2996 1744 4c948e42267877c379b01be5faa66926.exe 60 PID 1744 wrote to memory of 2996 1744 4c948e42267877c379b01be5faa66926.exe 60 PID 1744 wrote to memory of 2996 1744 4c948e42267877c379b01be5faa66926.exe 60 PID 1744 wrote to memory of 1796 1744 4c948e42267877c379b01be5faa66926.exe 62 PID 1744 wrote to memory of 1796 1744 4c948e42267877c379b01be5faa66926.exe 62 PID 1744 wrote to memory of 1796 1744 4c948e42267877c379b01be5faa66926.exe 62 PID 1744 wrote to memory of 1520 1744 4c948e42267877c379b01be5faa66926.exe 64 PID 1744 wrote to memory of 1520 1744 4c948e42267877c379b01be5faa66926.exe 64 PID 1744 wrote to memory of 1520 1744 4c948e42267877c379b01be5faa66926.exe 64 PID 1744 wrote to memory of 276 1744 4c948e42267877c379b01be5faa66926.exe 65 PID 1744 wrote to memory of 276 1744 4c948e42267877c379b01be5faa66926.exe 65 PID 1744 wrote to memory of 276 1744 4c948e42267877c379b01be5faa66926.exe 65 PID 1744 wrote to memory of 2480 1744 4c948e42267877c379b01be5faa66926.exe 72 PID 1744 wrote to memory of 2480 1744 4c948e42267877c379b01be5faa66926.exe 72 PID 1744 wrote to memory of 2480 1744 4c948e42267877c379b01be5faa66926.exe 72 PID 2480 wrote to memory of 2180 2480 taskhost.exe 73 PID 2480 wrote to memory of 2180 2480 taskhost.exe 73 PID 2480 wrote to memory of 2180 2480 taskhost.exe 73 PID 2480 wrote to memory of 2096 2480 taskhost.exe 74 PID 2480 wrote to memory of 2096 2480 taskhost.exe 74 PID 2480 wrote to memory of 2096 2480 taskhost.exe 74 PID 2180 wrote to memory of 3040 2180 WScript.exe 75 PID 2180 wrote to memory of 3040 2180 WScript.exe 75 PID 2180 wrote to memory of 3040 2180 WScript.exe 75 PID 3040 wrote to memory of 2332 3040 taskhost.exe 76 PID 3040 wrote to memory of 2332 3040 taskhost.exe 76 PID 3040 wrote to memory of 2332 3040 taskhost.exe 76 PID 3040 wrote to memory of 2632 3040 taskhost.exe 77 PID 3040 wrote to memory of 2632 3040 taskhost.exe 77 PID 3040 wrote to memory of 2632 3040 taskhost.exe 77 PID 2332 wrote to memory of 1584 2332 WScript.exe 78 PID 2332 wrote to memory of 1584 2332 WScript.exe 78 PID 2332 wrote to memory of 1584 2332 WScript.exe 78 PID 1584 wrote to memory of 2588 1584 taskhost.exe 79 PID 1584 wrote to memory of 2588 1584 taskhost.exe 79 PID 1584 wrote to memory of 2588 1584 taskhost.exe 79 PID 1584 wrote to memory of 2268 1584 taskhost.exe 80 PID 1584 wrote to memory of 2268 1584 taskhost.exe 80 PID 1584 wrote to memory of 2268 1584 taskhost.exe 80 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4c948e42267877c379b01be5faa66926.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 4c948e42267877c379b01be5faa66926.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 4c948e42267877c379b01be5faa66926.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" taskhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" taskhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c948e42267877c379b01be5faa66926.exe"C:\Users\Admin\AppData\Local\Temp\4c948e42267877c379b01be5faa66926.exe"1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:276
-
-
C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exe"C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2480 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f2f7c7b-a596-41c1-b95c-4a28ad553aa0.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exeC:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exe4⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3040 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\757224aa-b812-4baf-8661-ca388a49ba41.vbs"5⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exeC:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exe6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1584 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db014481-c8ca-4e51-af84-5912c67be572.vbs"7⤵PID:2588
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3683397a-33c3-418b-83a2-be6e31037460.vbs"7⤵PID:2268
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71e5858d-358e-4688-845b-404703284bc6.vbs"5⤵PID:2632
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15c38bc6-88b6-4a63-8693-63bc7803781b.vbs"3⤵PID:2096
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Recovery\3a99bb82-4e15-11ef-8354-cae67966b5f6\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\system\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\system\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Windows\system\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\PCHEALTH\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\PCHEALTH\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Adobe\Updater6\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Updater6\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Adobe\Updater6\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58e389a2d683417d1a3b3d6f15002dfad
SHA15577324c1c238946f808605da35611a3c60b8d77
SHA2569d0e05f41e9d926468993150937ccf30cc5f6b572e34f466a9983bea23435455
SHA512a4f0c816ea7368be0466ba5739fe356b5460c930bb28de597922e9ad9b90cf713612ecda95b04028381934d77b34e770d4a010daec6ee792636b4cb695fd58e5
-
Filesize
513B
MD50ce86e29532e10dfd6121379d5857335
SHA1b5242f3ab6528b7b992201ad5d4db3be627f8222
SHA25642e03af162e7962865fe2ac174183e5b58fc846daee1e41d0f40d650ff8a6dc1
SHA512f2ba8791ca81d075cccbcff4db9b95587932f5452f33935266da9560c8cda9e43fe302e6af3f058a101b3710c8c488e7936c070914267bda0f6ee0787b7de30f
-
Filesize
737B
MD58cd48d5797991e373d738e674d8682f1
SHA176fe47a25f32c79fd90dece975f762dc8b9f4f13
SHA256fc8aadf475d68ef30167a7d1caa2d1a82b35e205eff05c13c5f43e7f7db04550
SHA512285a7407ef5a33f71e1b35543b081b623660dc32be88ac77ca3dc10294f134679c03428e57482b4922ddd59326fe784fd326a789b29ca450aa2bea03c7303568
-
Filesize
737B
MD553018d5772d90c6d17ebf45f0c936c2d
SHA12b68505d2a86f36056dce639a1eab81d069298ac
SHA256719458b708a9c8b760208cbd77c784ff33d35f6277402a38e8757d36551efe86
SHA5123616622d937ad6aeb2c5f061c9a29f056082b0a04cc0ed147e24790d3c5b7781fbc4383bf5f3e437ff9940717dd887166c519a87de0bb840aa7e2df76c3ade73
-
Filesize
737B
MD587feefd19a249d52c0872d23c5ec244b
SHA1e462b16b106817cac42e615cd11e0afcb5783e6a
SHA256eab1a771f2d8a864d4e1a68ec74ab012430a59686d4c6089f1fbdfec7d16a320
SHA512169d7eb46201090353cd5a040f5c9bce23b1067d87a45950b23a94b838984cda191bf824202266750898ce4dea2b3344e4ee74e7e768829a99a45e48bcf8feaf
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5878c014e1acaed6816984b450a1fdd09
SHA156aae4acf5648170d39c8eaaeb698dd9a97f1550
SHA2567bed139aa65b062c0de5f39fbe098b61a35d6c15798455cc48bd6631527e123b
SHA5128626249a610375138391f2f0397b3043d6b075bd28dd1513dd0eb5635f550667053abd08b7b6ca04b7d0b9af7bcd04b678c918494a1079bf7fccdf8dec724d0b
-
Filesize
5.9MB
MD54c948e42267877c379b01be5faa66926
SHA1282254e3ab196c9810c8bdf74f3fe00977bfa120
SHA25663a4873a5658c4de311b5952d39969115f434f90c14d18a991dbc475b03ce8a7
SHA512776483f78e6f9634551ce06d87e8fad9a58afbd962d62eb6176f2e5d05bf3c77a026af2b2e0a36c22957141de18ce085e9084aafb0c3ca3436270395f6fc5612