dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Size

2.5MB
MD5

3dbf7d9fdfd5a0151f1003095ba9655c
SHA1

4f5de06a720298a5e32660fd0f56733ad611060f
SHA256

86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26
SHA512

3405c202bad0e95f18341f8c664f94626bec55db6ef9c15ff9a5b6cb2632e73375fec802d64e5ca3b924829ec1729c06f01fcb9a5013ac22d5b5b437812eb2ef
SSDEEP

49152:qGVFTkAxSKOfsx79ZnGGHMgVj2x+0XrSqWsn+fz+pV6ZKvTYnp:qGVyWNGGN2sqWs+fz+pVZTYp

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat 5 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

pid	Process
4744	schtasks.exe
2140	schtasks.exe
5408	schtasks.exe
4684	schtasks.exe
4768	schtasks.exe

Dcrat family
dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	2108	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2108	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5408	2108	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	2108	schtasks.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	2108	schtasks.exe	90

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3208	powershell.exe
5988	powershell.exe
1056	powershell.exe
5624	powershell.exe
5620	powershell.exe
212	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 16 IoCs

pid	Process
4724	RuntimeBroker.exe
3056	RuntimeBroker.exe
5200	RuntimeBroker.exe
644	RuntimeBroker.exe
1364	RuntimeBroker.exe
1432	RuntimeBroker.exe
2944	RuntimeBroker.exe
5296	RuntimeBroker.exe
3680	RuntimeBroker.exe
5464	RuntimeBroker.exe
5620	RuntimeBroker.exe
5444	RuntimeBroker.exe
2544	RuntimeBroker.exe
6068	RuntimeBroker.exe
1552	RuntimeBroker.exe
3700	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\7e20f84d5244aba7145631d4073af8\\SearchApp.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Windows NT\\SearchApp.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\vssadmin\\RuntimeBroker.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\\RuntimeBroker.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\SearchApp.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\vssadmin\RCXA1E4.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\vssadmin\RuntimeBroker.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RCXA3F9.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\vssadmin\RuntimeBroker.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\vssadmin\9e8d7a4ca61bd9	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\9e8d7a4ca61bd9	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\vssadmin\RCXA1E3.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RCXA3FA.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXA60E.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Program Files\Windows NT\SearchApp.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\38384e6a620884	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Program Files\Windows NT\RCX9FBE.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Program Files\Windows NT\SearchApp.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXA68C.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\SearchApp.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Program Files\Windows NT\38384e6a620884	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\SearchApp.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Program Files\Windows NT\RCX9FCF.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\CSC\dllhost.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4744	schtasks.exe
2140	schtasks.exe
5408	schtasks.exe
4684	schtasks.exe
4768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
3208	powershell.exe
3208	powershell.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
5988	powershell.exe
5988	powershell.exe
1056	powershell.exe
1056	powershell.exe
212	powershell.exe
212	powershell.exe
5620	powershell.exe
5620	powershell.exe
5624	powershell.exe
5624	powershell.exe
5988	powershell.exe
3208	powershell.exe
1056	powershell.exe
5620	powershell.exe
212	powershell.exe
5624	powershell.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
4724	RuntimeBroker.exe
4724	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe
3056	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeDebugPrivilege	5620	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	4724	RuntimeBroker.exe
Token: SeDebugPrivilege	3056	RuntimeBroker.exe
Token: SeDebugPrivilege	5200	RuntimeBroker.exe
Token: SeDebugPrivilege	644	RuntimeBroker.exe
Token: SeDebugPrivilege	1364	RuntimeBroker.exe
Token: SeDebugPrivilege	1432	RuntimeBroker.exe
Token: SeDebugPrivilege	2944	RuntimeBroker.exe
Token: SeDebugPrivilege	5296	RuntimeBroker.exe
Token: SeDebugPrivilege	3680	RuntimeBroker.exe
Token: SeDebugPrivilege	5464	RuntimeBroker.exe
Token: SeDebugPrivilege	5620	RuntimeBroker.exe
Token: SeDebugPrivilege	5444	RuntimeBroker.exe
Token: SeDebugPrivilege	2544	RuntimeBroker.exe
Token: SeDebugPrivilege	6068	RuntimeBroker.exe
Token: SeDebugPrivilege	1552	RuntimeBroker.exe
Token: SeDebugPrivilege	3700	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3208	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	102
PID 2500 wrote to memory of 3208	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	102
PID 2500 wrote to memory of 5988	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	103
PID 2500 wrote to memory of 5988	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	103
PID 2500 wrote to memory of 1056	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	104
PID 2500 wrote to memory of 1056	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	104
PID 2500 wrote to memory of 5624	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	105
PID 2500 wrote to memory of 5624	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	105
PID 2500 wrote to memory of 5620	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	106
PID 2500 wrote to memory of 5620	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	106
PID 2500 wrote to memory of 212	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	107
PID 2500 wrote to memory of 212	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	107
PID 2500 wrote to memory of 4724	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	114
PID 2500 wrote to memory of 4724	2500	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	114
PID 4724 wrote to memory of 1028	4724	RuntimeBroker.exe	116
PID 4724 wrote to memory of 1028	4724	RuntimeBroker.exe	116
PID 4724 wrote to memory of 324	4724	RuntimeBroker.exe	117
PID 4724 wrote to memory of 324	4724	RuntimeBroker.exe	117
PID 1028 wrote to memory of 3056	1028	WScript.exe	119
PID 1028 wrote to memory of 3056	1028	WScript.exe	119
PID 3056 wrote to memory of 5076	3056	RuntimeBroker.exe	121
PID 3056 wrote to memory of 5076	3056	RuntimeBroker.exe	121
PID 3056 wrote to memory of 1644	3056	RuntimeBroker.exe	122
PID 3056 wrote to memory of 1644	3056	RuntimeBroker.exe	122
PID 5076 wrote to memory of 5200	5076	WScript.exe	123
PID 5076 wrote to memory of 5200	5076	WScript.exe	123
PID 5200 wrote to memory of 5552	5200	RuntimeBroker.exe	124
PID 5200 wrote to memory of 5552	5200	RuntimeBroker.exe	124
PID 5200 wrote to memory of 4280	5200	RuntimeBroker.exe	125
PID 5200 wrote to memory of 4280	5200	RuntimeBroker.exe	125
PID 5552 wrote to memory of 644	5552	WScript.exe	129
PID 5552 wrote to memory of 644	5552	WScript.exe	129
PID 644 wrote to memory of 5288	644	RuntimeBroker.exe	130
PID 644 wrote to memory of 5288	644	RuntimeBroker.exe	130
PID 644 wrote to memory of 1352	644	RuntimeBroker.exe	131
PID 644 wrote to memory of 1352	644	RuntimeBroker.exe	131
PID 5288 wrote to memory of 1364	5288	WScript.exe	133
PID 5288 wrote to memory of 1364	5288	WScript.exe	133
PID 1364 wrote to memory of 5452	1364	RuntimeBroker.exe	134
PID 1364 wrote to memory of 5452	1364	RuntimeBroker.exe	134
PID 1364 wrote to memory of 6056	1364	RuntimeBroker.exe	135
PID 1364 wrote to memory of 6056	1364	RuntimeBroker.exe	135
PID 5452 wrote to memory of 1432	5452	WScript.exe	139
PID 5452 wrote to memory of 1432	5452	WScript.exe	139
PID 1432 wrote to memory of 5148	1432	RuntimeBroker.exe	140
PID 1432 wrote to memory of 5148	1432	RuntimeBroker.exe	140
PID 1432 wrote to memory of 448	1432	RuntimeBroker.exe	141
PID 1432 wrote to memory of 448	1432	RuntimeBroker.exe	141
PID 2944 wrote to memory of 1976	2944	RuntimeBroker.exe	143
PID 2944 wrote to memory of 1976	2944	RuntimeBroker.exe	143
PID 2944 wrote to memory of 1516	2944	RuntimeBroker.exe	144
PID 2944 wrote to memory of 1516	2944	RuntimeBroker.exe	144
PID 1976 wrote to memory of 5296	1976	WScript.exe	145
PID 1976 wrote to memory of 5296	1976	WScript.exe	145
PID 5296 wrote to memory of 5876	5296	RuntimeBroker.exe	146
PID 5296 wrote to memory of 5876	5296	RuntimeBroker.exe	146
PID 5296 wrote to memory of 508	5296	RuntimeBroker.exe	147
PID 5296 wrote to memory of 508	5296	RuntimeBroker.exe	147
PID 5876 wrote to memory of 3680	5876	WScript.exe	148
PID 5876 wrote to memory of 3680	5876	WScript.exe	148
PID 3680 wrote to memory of 5200	3680	RuntimeBroker.exe	150
PID 3680 wrote to memory of 5200	3680	RuntimeBroker.exe	150
PID 3680 wrote to memory of 1756	3680	RuntimeBroker.exe	151
PID 3680 wrote to memory of 1756	3680	RuntimeBroker.exe	151

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
"C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\7e20f84d5244aba7145631d4073af8\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\vssadmin\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
  "C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61fd4756-0ca4-4c2b-8ca3-172f43a4f026.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
      C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdcf13ee-a92f-4a7c-b27b-5d58598b8c80.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5076
      - C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2356431c-f38b-41a0-abec-7a4ffa68f772.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e2584a7-e0d1-48b4-9747-3f5ebebd3286.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5288
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3128e8b-ccfc-4cb5-9f11-aa779d321655.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5452
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd256aa9-f4bf-45d8-ad5f-70ee5d69b4db.vbs"
        13⤵
        
        PID:5148
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4bf602ca-f920-44ce-95a8-a4b1b154e113.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5296
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c966b3b-6d76-44f1-b8fc-bd3dceca1e7d.vbs"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:5876
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d6972e2-9365-44f7-90af-a9016136a6a2.vbs"
        19⤵
        
        PID:5200
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a5e8af6-d44c-4417-ac21-cba27f1d7c05.vbs"
        21⤵
        
        PID:3016
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5cc81e8-70af-4114-a6e5-7c8998c8cdf6.vbs"
        23⤵
        
        PID:5976
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5444
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\027d7104-9a47-4771-84fd-abb8fb4e961f.vbs"
        25⤵
        
        PID:5900
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f58ebb2-d12d-461d-ac95-739a00ad26f0.vbs"
        27⤵
        
        PID:5604
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:6068
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa6c1c9e-54a8-4878-9cd1-56ce97e44df5.vbs"
        29⤵
        
        PID:5280
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d33664be-0740-43f7-8084-ddf26d3ddfcf.vbs"
        31⤵
        
        PID:1072
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        
        C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64fb4090-5aa7-4e85-9276-668cfa1b2300.vbs"
        33⤵
        
        PID:5004
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4eccc4e7-200a-4e66-9713-1b437cd9fcda.vbs"
        33⤵
        
        PID:4884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e6444fe0-1ee1-4cf0-a980-892896867709.vbs"
        31⤵
        
        PID:1464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\632f7e37-7a43-4bb3-b0d7-1770f0c5cabb.vbs"
        29⤵
        
        PID:5944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fbbf364-6388-4c73-b353-7e4e813491dd.vbs"
        27⤵
        
        PID:368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37d6443b-191b-486f-bfef-5581eb85931f.vbs"
        25⤵
        
        PID:6064
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f12be17-f830-4100-a6f0-f236d2c0f27f.vbs"
        23⤵
        
        PID:5560
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\742a35d7-0a72-414f-bb70-a17776eac76e.vbs"
        21⤵
        
        PID:4848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66b66de1-30c6-4ca4-8ed4-d30f51bb3692.vbs"
        19⤵
        
        PID:1756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dbfaabd0-aa45-4b44-b2be-724ab2458cf2.vbs"
        17⤵
        
        PID:508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2591bdbb-0ce7-4c05-80c2-146d3da61756.vbs"
        15⤵
        
        PID:1516
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af2b192d-58fd-4cb3-93a5-bdf6f4c6f7e9.vbs"
        13⤵
        
        PID:448
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\140434b3-e116-4bfe-befb-1f2aea3c0c6b.vbs"
        11⤵
        
        PID:6056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\927fd30b-8f81-4736-91b8-4cd406bb0cec.vbs"
        9⤵
        
        PID:1352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d250946-0db1-4405-b004-cf84b5a01ecb.vbs"
        7⤵
        
        PID:4280
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47479d6e-ba88-4021-9160-6625f3d202e6.vbs"
        5⤵
        
        PID:1644
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f71cf4fd-58f5-4a3f-a5e4-d57da2550c9d.vbs"
    3⤵
    PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\7e20f84d5244aba7145631d4073af8\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows NT\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\vssadmin\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\SearchApp.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office 15\ClientX64\SearchApp.exe

Filesize
2.5MB

MD5
3dbf7d9fdfd5a0151f1003095ba9655c

SHA1
4f5de06a720298a5e32660fd0f56733ad611060f

SHA256
86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26

SHA512
3405c202bad0e95f18341f8c664f94626bec55db6ef9c15ff9a5b6cb2632e73375fec802d64e5ca3b924829ec1729c06f01fcb9a5013ac22d5b5b437812eb2ef

Download Submit
C:\Program Files\Microsoft Office 15\ClientX64\SearchApp.exe

Filesize
2.5MB

MD5
5eac18c6f3befb0ca1ed5017d43824bb

SHA1
a6eaa7e3db2fe2c13eb284bf29411cac68ffc570

SHA256
d9f90f9bfd6f3d9b8a97f2e241ffef32cd413c24380021bafc6e2b0d77b33951

SHA512
33ed4a750ae390ec40ca51bd816d3ceea4c24f55d6b637a149ef88dc74fc5c4fbdf20e36c161c667d3241fd697ce22e7ac8cf9dd1c27b806b8e91ac3d7d51a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
9699cf9bb24ebbc9b1035710e92b7bd2

SHA1
73f0f26db57ea306970a76f42c647bbce02a3f23

SHA256
fd35f3609663bec79a5254866d1c47342fbde3f94808acff8c3eaa19b24f67e5

SHA512
3a433f40f25b5a5c09f8de45ebd0b5485b3b54eb0c1c08a1dbae776629710b8d8f5fee21329d146867e49b5d35108bba6eff3995fb7c6246dbe6fe475eadf0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
93771c301aacc738330a66a7e48b0c1b

SHA1
f7d7ac01f1f13620b1642d1638c1d212666abbae

SHA256
5512157a9ea31f455e244922910fcdb2b8116288d968b0e5e26c91b266d4de7c

SHA512
a51f43e335c8c6da130866115ee6d890f808379548b129e20e563c5ee0234cca186ecde4fd6bc609f0eba6e32b10d080f4f67483461cdd58ef0a60db78324309

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
44ae12563d9f97ac1136baee629673df

SHA1
38790549497302c43bd3ff6c5225e8c7054829e2

SHA256
b09202e29f036511a075523ebcaecef0a43ceeb4f2c8029e5c7931a8e2e72beb

SHA512
07cf8ed791245485aae4ee05cd6b77eb0a36c8a839da6eae1554dc0487559c270241733ae8ed184c8d38a956452a2255169a3adeb40a0da1d9e2e487864a35e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\027d7104-9a47-4771-84fd-abb8fb4e961f.vbs

Filesize
766B

MD5
afe433d6a20dc9ba1c7b5d17fb5680f0

SHA1
3a5bb42477a37b96c92de0cfc53b2190cd2fd1e0

SHA256
0cde8a4a881c6337d0407d3030c4fa4dfb88f61cae42785ae3b882c6fbb96950

SHA512
89a1fce383ea567f9a86871f2e72b2367d89e3cf91fcf01ab1ba1c69597f2e39724b583c77cb5c181184960d15a016e7332ecf9bed51c7420db936c354534d59

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d6972e2-9365-44f7-90af-a9016136a6a2.vbs

Filesize
766B

MD5
8bfa56e71ad6553548e8e40e0add4392

SHA1
7d0089373bed2de44b35aff6f8fe6753e900c637

SHA256
a44919616954e307d4e5d0c1a33d37b976fe11f5416e051c1a1c57cb5c607112

SHA512
8d0662a899bb98dae68d978916eb7901b154c6e704679dc3b5ed3b02d0443408410238b13d15533b1ed545a82629dde79f2f28af869a4e61dbfeb93702689f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\0e2584a7-e0d1-48b4-9747-3f5ebebd3286.vbs

Filesize
765B

MD5
e5442cde77e390ea4155f764f018aad4

SHA1
0b37217e81aecf9dba8bad61d10b4dac689a59f2

SHA256
dc05021de3a6a0481c695b62aea34602789fce8cb6a491abf10fa858058fd3b8

SHA512
7a24d03645771370f4bcf4096f751861bdf1527d279b06affc0cca37448c2335aee2f04ef2b03441804acedc98340f349d0e5b4252194525b0996941963a09dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\2356431c-f38b-41a0-abec-7a4ffa68f772.vbs

Filesize
766B

MD5
d6ab79e07c8395ae336d8a95c8f69dc7

SHA1
c6453290ede31068e2866088c3f2d4e4f060e0f7

SHA256
2d6e120970c2eac820eb4da143e70c798a8e32fa219db591aff5f0f87a303aba

SHA512
09d397ee6218d6aba59a40f1df9e30edcf55af30efd56669e263aa67009f5a22fc4324291664c0b83d0bf8209dec033c546ebbdd8eb3ba3cafb03b0909e301f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\4a5e8af6-d44c-4417-ac21-cba27f1d7c05.vbs

Filesize
766B

MD5
4c86677526336af6efad54864bf14942

SHA1
c6d1da00903e9633c5b519050239e62f7f75b3e1

SHA256
cfc4f2e9df12298cd1602186b6c4be5800b67b9213b62fb59ec4fbf498bb464d

SHA512
56488ba6c8b2cd523827e2ef6f0c67f9f0c69d281608cc80bc4a646cc7961a0fff8b27446960fde238ebf791c8291191128572e1a05ec0c95622c58fc6f7036e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4bf602ca-f920-44ce-95a8-a4b1b154e113.vbs

Filesize
766B

MD5
fd227a0e2588e47faa28f157e0bf97e5

SHA1
7fa7ab88d1ae368072faaf3f4c2b8fac2e575c81

SHA256
c0e9d94e129876f9870f8db73c68375bb81710210caf0fe4e6cff23834506a75

SHA512
c9316dd2efc6995d0c6a36982d7887c38abe47d2f9069508ecdf8e77bcad3cfca47998f2ee87b8aa0ccb834ca75124474c9db4f84c62837eee761df5090ec7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\61fd4756-0ca4-4c2b-8ca3-172f43a4f026.vbs

Filesize
766B

MD5
002bc2577abf86e5bf33020100d4a733

SHA1
2e26f9cd5b887d9fc85ee4ae05a568614d881595

SHA256
3d45d19ae06c6000523979eb0e1adf6bcdf5aba92f85c6e1ffffd34f9c241672

SHA512
0b051f6a1ba8713a3a306d800a77ecf90f06a4c22ec1ace2bd3290cac14a6f1f561e122c763d8a20dcbfd71143fa743afd20328c5374cc4a8cbfa837020e3b69

Download Submit
C:\Users\Admin\AppData\Local\Temp\8f58ebb2-d12d-461d-ac95-739a00ad26f0.vbs

Filesize
766B

MD5
2782b3e4c20609c6b4e5cd77210837c6

SHA1
1332186a4f790a4b2ab8ea1ec313f0240cc758cb

SHA256
999cacafcc8bcf829b08656c979a2cbbca01b6ede97fd31547d406bda26b83fe

SHA512
f4383ee97ebdf7329302f7c72efd7a57f31b9956622e8984614c2467922d70be0b6c8563d12b0e10801b1ab158dae88b78959d226c411accf256531595641be3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9c966b3b-6d76-44f1-b8fc-bd3dceca1e7d.vbs

Filesize
766B

MD5
93ab147f34845ea25cd507f7e91da139

SHA1
e3b9644bce73c68869bd7d79291adc9fcf5eae03

SHA256
80ee06765d221eeed45afe1e79167e01e4fe83b07fd2b238445f05a308c56b3b

SHA512
101f5fb28997260ce5756da159cab206c5f4c55d3f15ad43b3d6dce518fad70b58e4be91737a7f9db1085f5b68900bae5f937ec44557764e6f7404ec3e3f327f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_400pyrcw.xi5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d5cc81e8-70af-4114-a6e5-7c8998c8cdf6.vbs

Filesize
766B

MD5
e9822818865830db06728d32ff505754

SHA1
af545fc17cdb588b0e30b2715bd1efcd4abd5768

SHA256
8e7e9b92882da38411f9072b22194725f033bb873a9eea002bfbf560df3e9ed1

SHA512
7f955700a8a6068a09691c887957fb6f00436c1474cd699657892ea4774bc19ad2061d99532d77c7184ecddeaaa76f20da3bb567ca6e5d2b2c0197f6b6b27d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\f3128e8b-ccfc-4cb5-9f11-aa779d321655.vbs

Filesize
766B

MD5
d48131d04a3cba500acf8239f1fadfbd

SHA1
1f837c2fed875a20e82964a3189ff86a994fbfe9

SHA256
5e1c088f4d9abbb0210f1afcec8b722292cffcbfd53f8ee59471525f4509dda9

SHA512
0e88ca068d804f805a5c27dd5c07680d8458398ee933f4a6369fce690f56cacea9951c98312ace30566f88cd2b2229f60b5991d1538f5e5fb74d0df33d81b4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\f71cf4fd-58f5-4a3f-a5e4-d57da2550c9d.vbs

Filesize
542B

MD5
f6e6a6a22494dbd7eb42df0782297c9c

SHA1
1325edaf5dd0e19f48fd2f1f93b91bef0fcb2b0f

SHA256
9708d8c8bc8e06e7f9fae66659278d6bb5b0f4997c4e90d0a2faadf6e5251fec

SHA512
14dc954362c3c592d827d73bd897682ccfc49aacab1b4b7379680899f344b03dbad673e4ee4989ac9a1cbb9245fd372142cd627821de22c7e4c2fee779c9bfe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fa6c1c9e-54a8-4878-9cd1-56ce97e44df5.vbs

Filesize
766B

MD5
5ec5ca47fd138c272626c7cfd33ba682

SHA1
d0ae779daaa7ea45d0d214a7285a6e9335480e0d

SHA256
03f79a50df12d57c88efe7d2cabcb5ad0ceaf578b4b63b4e90d2fdb6b722ae99

SHA512
0d36dad2316b5954474139a91eed7d5c763804f6e5fa295a46631c9bb8ea7c6fb110fe513b47a6fc6d2dc54b14bc5a790d8d89607bab86c749c9e12221e1b1fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdcf13ee-a92f-4a7c-b27b-5d58598b8c80.vbs

Filesize
766B

MD5
d41c96d11860eb7261078e6f03fa99b4

SHA1
9de4f8401ec38dd92986449edac8e7a0a8f87adb

SHA256
438365c896cd04b2aae5b01645c0eb517a15d41e1bd888dbb5c55424a1772529

SHA512
ea1b622fc8f24ec43ad614bdd4a9b7f443d613961daf9b2bf8305489a42f2cc3e74cdd718cb26b62cab305141bd17039c905241047a1e10f857e1dc3804e8f93

Download Submit
memory/1552-387-0x000000001D500000-0x000000001D602000-memory.dmp

Filesize
1.0MB

Download
memory/2500-9-0x000000001BF20000-0x000000001BF28000-memory.dmp

Filesize
32KB

Download
memory/2500-5-0x000000001BED0000-0x000000001BF20000-memory.dmp

Filesize
320KB

Download
memory/2500-13-0x000000001BF70000-0x000000001BF7A000-memory.dmp

Filesize
40KB

Download
memory/2500-12-0x000000001BF60000-0x000000001BF6A000-memory.dmp

Filesize
40KB

Download
memory/2500-11-0x000000001C840000-0x000000001CD68000-memory.dmp

Filesize
5.2MB

Download
memory/2500-18-0x000000001C1C0000-0x000000001C1CA000-memory.dmp

Filesize
40KB

Download
memory/2500-10-0x000000001BF30000-0x000000001BF42000-memory.dmp

Filesize
72KB

Download
memory/2500-0-0x00007FF888153000-0x00007FF888155000-memory.dmp

Filesize
8KB

Download
memory/2500-15-0x000000001C090000-0x000000001C09A000-memory.dmp

Filesize
40KB

Download
memory/2500-17-0x000000001C0B0000-0x000000001C0B8000-memory.dmp

Filesize
32KB

Download
memory/2500-8-0x000000001BE80000-0x000000001BED6000-memory.dmp

Filesize
344KB

Download
memory/2500-208-0x00007FF888150000-0x00007FF888C11000-memory.dmp

Filesize
10.8MB

Download
memory/2500-14-0x000000001BF80000-0x000000001BF8C000-memory.dmp

Filesize
48KB

Download
memory/2500-1-0x00000000008E0000-0x0000000000B66000-memory.dmp

Filesize
2.5MB

Download
memory/2500-7-0x000000001B820000-0x000000001B830000-memory.dmp

Filesize
64KB

Download
memory/2500-6-0x000000001B750000-0x000000001B760000-memory.dmp

Filesize
64KB

Download
memory/2500-4-0x0000000002C40000-0x0000000002C5C000-memory.dmp

Filesize
112KB

Download
memory/2500-2-0x00007FF888150000-0x00007FF888C11000-memory.dmp

Filesize
10.8MB

Download
memory/2500-3-0x0000000002BD0000-0x0000000002BDC000-memory.dmp

Filesize
48KB

Download
memory/2500-16-0x000000001C0A0000-0x000000001C0AC000-memory.dmp

Filesize
48KB

Download
memory/2944-289-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/4724-222-0x000000001CFE0000-0x000000001D036000-memory.dmp

Filesize
344KB

Download
memory/5464-323-0x000000001BDF0000-0x000000001BE02000-memory.dmp

Filesize
72KB

Download
memory/5988-147-0x0000025EF0170000-0x0000025EF0192000-memory.dmp

Filesize
136KB

Download