dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Size 1.6MB
Sample250322-zaqppszvbx
SHA256 85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f
MD5 c87ae2c7c0c0a77294bdf61219b952f5
SHA1 009d29952e3cec0966402de8b8ffeb264c78a956
SHA512 b7477f968f2356dd08991668b6feb01bb878bad59a6b3857b0a226b1e246852ba0c40214c502e757b01bbd9fc130f9e0cad033a12ada3f1c6f42767b9b813c7c
SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2324	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4404	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3324	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	3324	schtasks.exe	88

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral14/memory/4468-1-0x00000000008D0000-0x0000000000A72000-memory.dmp	dcrat
behavioral14/files/0x00070000000240f1-26.dat	dcrat
behavioral14/files/0x000600000001dab1-89.dat	dcrat
behavioral14/files/0x000400000001dadb-100.dat	dcrat
behavioral14/files/0x000900000001db40-146.dat	dcrat
behavioral14/files/0x000400000001e974-389.dat	dcrat
behavioral14/files/0x000400000001e974-459.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2228	powershell.exe
2016	powershell.exe
3956	powershell.exe
1192	powershell.exe
2388	powershell.exe
4660	powershell.exe
2692	powershell.exe
412	powershell.exe
432	powershell.exe
4968	powershell.exe
1652	powershell.exe
3232	powershell.exe
4292	powershell.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	lsass.exe

Executes dropped EXE 12 IoCs

pid	Process
5408	lsass.exe
5756	lsass.exe
4420	lsass.exe
2396	lsass.exe
2300	lsass.exe
5428	lsass.exe
5060	lsass.exe
6128	lsass.exe
1796	lsass.exe
3736	lsass.exe
4652	lsass.exe
5424	lsass.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File created	C:\Program Files\dotnet\swidtag\csrss.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File created	C:\Program Files\dotnet\swidtag\886983d96e3d3e	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCXC0E2.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files\dotnet\swidtag\csrss.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXB4D1.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lsass.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\f29b7f83f50a4c	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File created	C:\Program Files\7-Zip\Lang\lsass.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File created	C:\Program Files\7-Zip\Lang\6203df4a6bafc7	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCXB2BD.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\en-US\RCXB2BC.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXB53F.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Program Files\dotnet\swidtag\RCXC074.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\security\database\csrss.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File created	C:\Windows\security\database\csrss.exe	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File created	C:\Windows\security\database\886983d96e3d3e	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Windows\security\database\RCXC2E7.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
File opened for modification	C:\Windows\security\database\RCXC2E8.tmp	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	lsass.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1160	schtasks.exe
432	schtasks.exe
4552	schtasks.exe
4488	schtasks.exe
2796	schtasks.exe
4952	schtasks.exe
4136	schtasks.exe
2692	schtasks.exe
3584	schtasks.exe
1600	schtasks.exe
2388	schtasks.exe
2056	schtasks.exe
856	schtasks.exe
2140	schtasks.exe
4404	schtasks.exe
1864	schtasks.exe
1868	schtasks.exe
216	schtasks.exe
4480	schtasks.exe
4664	schtasks.exe
4896	schtasks.exe
1064	schtasks.exe
4940	schtasks.exe
2168	schtasks.exe
3596	schtasks.exe
1656	schtasks.exe
1268	schtasks.exe
1896	schtasks.exe
4412	schtasks.exe
2088	schtasks.exe
1008	schtasks.exe
2324	schtasks.exe
1052	schtasks.exe
1500	schtasks.exe
3500	schtasks.exe
3136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
4968	powershell.exe
4968	powershell.exe
2388	powershell.exe
2388	powershell.exe
1192	powershell.exe
1192	powershell.exe
4660	powershell.exe
4660	powershell.exe
4292	powershell.exe
4292	powershell.exe
2016	powershell.exe
2016	powershell.exe
2228	powershell.exe
412	powershell.exe
2228	powershell.exe
412	powershell.exe
1652	powershell.exe
3232	powershell.exe
1652	powershell.exe
3232	powershell.exe
432	powershell.exe
432	powershell.exe
3956	powershell.exe
3956	powershell.exe
2692	powershell.exe
2692	powershell.exe
1192	powershell.exe
3956	powershell.exe
2016	powershell.exe
2692	powershell.exe
4968	powershell.exe
4968	powershell.exe
2388	powershell.exe
2388	powershell.exe
4660	powershell.exe
432	powershell.exe
4292	powershell.exe
1652	powershell.exe
2228	powershell.exe
412	powershell.exe
3232	powershell.exe
5408	lsass.exe
5756	lsass.exe
4420	lsass.exe
4420	lsass.exe
2396	lsass.exe
2300	lsass.exe
5428	lsass.exe
5060	lsass.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	5408	lsass.exe
Token: SeDebugPrivilege	5756	lsass.exe
Token: SeDebugPrivilege	4420	lsass.exe
Token: SeDebugPrivilege	2396	lsass.exe
Token: SeDebugPrivilege	2300	lsass.exe
Token: SeDebugPrivilege	5428	lsass.exe
Token: SeDebugPrivilege	5060	lsass.exe
Token: SeDebugPrivilege	6128	lsass.exe
Token: SeDebugPrivilege	1796	lsass.exe
Token: SeDebugPrivilege	3736	lsass.exe
Token: SeDebugPrivilege	4652	lsass.exe
Token: SeDebugPrivilege	5424	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4660	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	129
PID 4468 wrote to memory of 4660	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	129
PID 4468 wrote to memory of 2388	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	130
PID 4468 wrote to memory of 2388	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	130
PID 4468 wrote to memory of 2228	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	131
PID 4468 wrote to memory of 2228	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	131
PID 4468 wrote to memory of 4292	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	133
PID 4468 wrote to memory of 4292	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	133
PID 4468 wrote to memory of 3232	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	134
PID 4468 wrote to memory of 3232	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	134
PID 4468 wrote to memory of 1652	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	136
PID 4468 wrote to memory of 1652	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	136
PID 4468 wrote to memory of 1192	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	137
PID 4468 wrote to memory of 1192	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	137
PID 4468 wrote to memory of 4968	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	139
PID 4468 wrote to memory of 4968	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	139
PID 4468 wrote to memory of 432	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	140
PID 4468 wrote to memory of 432	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	140
PID 4468 wrote to memory of 3956	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	141
PID 4468 wrote to memory of 3956	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	141
PID 4468 wrote to memory of 412	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	143
PID 4468 wrote to memory of 412	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	143
PID 4468 wrote to memory of 2692	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	145
PID 4468 wrote to memory of 2692	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	145
PID 4468 wrote to memory of 2016	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	146
PID 4468 wrote to memory of 2016	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	146
PID 4468 wrote to memory of 1624	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	155
PID 4468 wrote to memory of 1624	4468	85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe	155
PID 1624 wrote to memory of 3692	1624	cmd.exe	157
PID 1624 wrote to memory of 3692	1624	cmd.exe	157
PID 1624 wrote to memory of 5408	1624	cmd.exe	160
PID 1624 wrote to memory of 5408	1624	cmd.exe	160
PID 5408 wrote to memory of 5580	5408	lsass.exe	161
PID 5408 wrote to memory of 5580	5408	lsass.exe	161
PID 5408 wrote to memory of 5620	5408	lsass.exe	162
PID 5408 wrote to memory of 5620	5408	lsass.exe	162
PID 5580 wrote to memory of 5756	5580	WScript.exe	163
PID 5580 wrote to memory of 5756	5580	WScript.exe	163
PID 5756 wrote to memory of 5896	5756	lsass.exe	164
PID 5756 wrote to memory of 5896	5756	lsass.exe	164
PID 5756 wrote to memory of 5944	5756	lsass.exe	165
PID 5756 wrote to memory of 5944	5756	lsass.exe	165
PID 5896 wrote to memory of 4420	5896	WScript.exe	171
PID 5896 wrote to memory of 4420	5896	WScript.exe	171
PID 4420 wrote to memory of 5232	4420	lsass.exe	172
PID 4420 wrote to memory of 5232	4420	lsass.exe	172
PID 4420 wrote to memory of 3768	4420	lsass.exe	173
PID 4420 wrote to memory of 3768	4420	lsass.exe	173
PID 5232 wrote to memory of 2396	5232	WScript.exe	177
PID 5232 wrote to memory of 2396	5232	WScript.exe	177
PID 2396 wrote to memory of 1120	2396	lsass.exe	178
PID 2396 wrote to memory of 1120	2396	lsass.exe	178
PID 2396 wrote to memory of 3524	2396	lsass.exe	179
PID 2396 wrote to memory of 3524	2396	lsass.exe	179
PID 1120 wrote to memory of 2300	1120	WScript.exe	180
PID 1120 wrote to memory of 2300	1120	WScript.exe	180
PID 2300 wrote to memory of 2128	2300	lsass.exe	181
PID 2300 wrote to memory of 2128	2300	lsass.exe	181
PID 2300 wrote to memory of 3344	2300	lsass.exe	182
PID 2300 wrote to memory of 3344	2300	lsass.exe	182
PID 2128 wrote to memory of 5428	2128	WScript.exe	184
PID 2128 wrote to memory of 5428	2128	WScript.exe	184
PID 5428 wrote to memory of 5776	5428	lsass.exe	185
PID 5428 wrote to memory of 5776	5428	lsass.exe	185

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe
"C:\Users\Admin\AppData\Local\Temp\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Saved Games\TextInputHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\swidtag\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\database\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MFwhts6Ouh.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3692
- - C:\0154351536fc379faee1\lsass.exe
    "C:\0154351536fc379faee1\lsass.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e4e425a-e0c4-44cc-82be-5780526281b5.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5580
    - - C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5756
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6d2c67fd-b58c-43c5-9570-e643ce5b4b80.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5896
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8220fc67-47a8-48ef-8746-c81e18864ba6.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5232
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3f58864-fc1f-4805-bea1-7c09807eed9b.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1a87d6f1-47ec-40a6-9083-889f7df7c7bd.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5428
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bafc7e63-1b4c-4572-9788-426a497d78d7.vbs"
        14⤵
        
        PID:5776
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf22c189-52de-4a60-b3e2-a5b58f4c709d.vbs"
        16⤵
        
        PID:5884
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:6128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e3b6ccb-aff0-4a75-940e-ca858f8d13bf.vbs"
        18⤵
        
        PID:2660
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97d8aa47-b5aa-427f-b8c8-ccfb33f1ced0.vbs"
        20⤵
        
        PID:4672
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b46b43b0-3b54-41b4-9377-9a970b5e7d45.vbs"
        22⤵
        
        PID:4420
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80aca8ad-ef20-491a-bf98-91be4efe17fa.vbs"
        24⤵
        
        PID:5204
        
        C:\0154351536fc379faee1\lsass.exe
        
        C:\0154351536fc379faee1\lsass.exe
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06055133-c577-41f6-9120-35f0886b61ba.vbs"
        26⤵
        
        PID:4844
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc87b4bc-1266-49b1-a267-6b8762d20c9a.vbs"
        26⤵
        
        PID:3636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e557376-beb7-44fb-9ce2-9db4473239f8.vbs"
        24⤵
        
        PID:2992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\567ad2be-315b-4af1-abb4-bdff1a46a1c1.vbs"
        22⤵
        
        PID:3988
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9054b1c3-f892-4b59-a7b7-326cc9381299.vbs"
        20⤵
        
        PID:4540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8520fefd-c0d7-43b5-878c-47603f8797ad.vbs"
        18⤵
        
        PID:5964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b7740fd-bc7a-4ef5-9696-a07c5c0c0e63.vbs"
        16⤵
        
        PID:6012
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2068e134-0fc8-4a15-b1d4-9de140071a42.vbs"
        14⤵
        
        PID:5892
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d9f73a0-74d6-48a8-912c-2a0d3a14e3a0.vbs"
        12⤵
        
        PID:3344
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93e972e6-ebed-4cdf-b7f8-bad0612b2576.vbs"
        10⤵
        
        PID:3524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87a1c5ef-4a85-4910-ba70-ca24f08b5fae.vbs"
        8⤵
        
        PID:3768
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5cdd5405-bd17-4b6f-8427-e99ffe220e69.vbs"
        6⤵
        
        PID:5944
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2fa9108-b31f-4787-a189-576390441d8f.vbs"
      4⤵
      PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\3ac54ddf2ad44faa6035cf\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\3ac54ddf2ad44faa6035cf\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\0154351536fc379faee1\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\0154351536fc379faee1\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\0154351536fc379faee1\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f8" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f8" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\3ac54ddf2ad44faa6035cf\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\3ac54ddf2ad44faa6035cf\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\0154351536fc379faee1\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\0154351536fc379faee1\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\0154351536fc379faee1\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Saved Games\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Saved Games\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\dotnet\swidtag\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\swidtag\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Windows\security\database\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\security\database\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\security\database\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\0154351536fc379faee1\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\0154351536fc379faee1\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\0154351536fc379faee1\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\3ac54ddf2ad44faa6035cf\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\3ac54ddf2ad44faa6035cf\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\3ac54ddf2ad44faa6035cf\services.exe
Size 1.6MB
SHA256 0e00c5db203f64518554bf2e1766cb6a5c97fc99c04891731c1ea80a4fe1f90e
MD5 c66de00ef9054c4e5a6dec91440300b6
SHA1 28e0672ef9da2ff9b2263cddba24aefbb7347d31
SHA512 330c9bd735d97193f0386796352f75e8af3eb161d8770d1e67856a7df28a2bc43c1aaec1fbd8ab4d7bfd93ceed98a6ecb210ac39439d9016fcee50e27afb23c7
SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\3ac54ddf2ad44faa6035cf\services.exe
Size 1.6MB
SHA256 85c94c7c76edef200af7308df08946171efa15cc64e34da0235a6582538fe75f
MD5 c87ae2c7c0c0a77294bdf61219b952f5
SHA1 009d29952e3cec0966402de8b8ffeb264c78a956
SHA512 b7477f968f2356dd08991668b6feb01bb878bad59a6b3857b0a226b1e246852ba0c40214c502e757b01bbd9fc130f9e0cad033a12ada3f1c6f42767b9b813c7c
SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Program Files\7-Zip\Lang\lsass.exe
Size 1.6MB
SHA256 772678f0db5c88ab13950bd2e1db50f28a0db90c0d0ccb04176f4e936c44cb00
MD5 928fc754151e07c6115aa9d608bc323e
SHA1 74f6746eeef67b5c3bf6f18129bb6f6fae851150
SHA512 ba9d9e1bba3481d5aad9d8a9d4d294cfe0384865f9ad2bdb06a18b47daad45beb64be4c16c4b80820456dccc194936b3992d7f8eb87080222b05bb23f8d19d62
SSDEEP 24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Program Files\dotnet\swidtag\csrss.exe
Size 1.6MB
SHA256 98dde9fd626c27f00ca42cdd75c3ab0e04da2edea39771b28c40890839420f82
MD5 cd474a64d8a331a8753ab74f85508f01
SHA1 30e992487b336d8b3cf7fc32237d6e16244b1fcd
SHA512 26add5f28ef2bcaabe21a5c889ed47865f53fa37ae77347da7d75756488ed774f1e0b70c2cef243105f232ba46cabf9f9c530ff73ae29c8edac6318b2b95d35a
SSDEEP 24576:qsm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:qD8Jijt+xpS/ekYmLGdhEAf7bCcjE
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\lsass.exe.log
Size 1KB
SHA256 2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73
MD5 3690a1c3b695227a38625dcf27bd6dac
SHA1 c2ed91e98b120681182904fa2c7cd504e5c4b2f5
SHA512 15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
MD5 a43e653ffb5ab07940f4bdd9cc8fade4
SHA1 af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA512 62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
MD5 SHA1 SHA512

Submit Download