dcrat | 291d5441b266bfbd219043a3b9ac484525e79911792fba2d8401cba0207d9d0e

Analysis

max time kernel
128s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinAuthx32.exe
Size

1.1MB
MD5

d2f9a2c6cecae6184fd12f0fca835433
SHA1

81030ac06f16d76cb4204963923cdf2f27913714
SHA256

291d5441b266bfbd219043a3b9ac484525e79911792fba2d8401cba0207d9d0e
SHA512

93392e8c1f7fb5b1e3cfab92ec1eceee3eabc3db73eadcbfb9c0cc2bef87ea5fb0f035c389b7af243df9020673156b0473cb6edc8d5c71ce3e9c4e2110e08150
SSDEEP

24576:u2G/nvxW3WieCqgt5UOOs7sxXfmRm+vBhx5dv:ubA3j75JsK3x3

Score

10^/10

dcrat discovery infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3868	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3104	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2952	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	464	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4556	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1392	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2144	schtasks.exe	93
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	2144	schtasks.exe	93

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000700000002421d-10.dat	dcrat
behavioral2/memory/1556-13-0x0000000000AB0000-0x0000000000B86000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	WinAuthx32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	Bridgereviewruntime.exe

Executes dropped EXE 2 IoCs

pid	Process
1556	Bridgereviewruntime.exe
4356	TrustedInstaller.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
57	ipinfo.io
58	ipinfo.io

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe	Bridgereviewruntime.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\22eafd247d37c3	Bridgereviewruntime.exe
File created	C:\Program Files\Windows Sidebar\smss.exe	Bridgereviewruntime.exe
File created	C:\Program Files\Windows Sidebar\69ddcba757bf72	Bridgereviewruntime.exe
File created	C:\Program Files (x86)\Windows Mail\csrss.exe	Bridgereviewruntime.exe
File created	C:\Program Files (x86)\Windows Mail\886983d96e3d3e	Bridgereviewruntime.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe	Bridgereviewruntime.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\5b884080fd4f94	Bridgereviewruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinAuthx32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings	WinAuthx32.exe
Key created	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000_Classes\Local Settings	Bridgereviewruntime.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2112	schtasks.exe
2952	schtasks.exe
2468	schtasks.exe
4080	schtasks.exe
5040	schtasks.exe
3440	schtasks.exe
2020	schtasks.exe
4540	schtasks.exe
4632	schtasks.exe
3280	schtasks.exe
3400	schtasks.exe
1956	schtasks.exe
1392	schtasks.exe
3084	schtasks.exe
4368	schtasks.exe
2320	schtasks.exe
1352	schtasks.exe
1700	schtasks.exe
464	schtasks.exe
3868	schtasks.exe
2000	schtasks.exe
4536	schtasks.exe
2880	schtasks.exe
2368	schtasks.exe
628	schtasks.exe
3044	schtasks.exe
2884	schtasks.exe
4556	schtasks.exe
3532	schtasks.exe
4508	schtasks.exe
4200	schtasks.exe
4168	schtasks.exe
3656	schtasks.exe
4184	schtasks.exe
864	schtasks.exe
2160	schtasks.exe
3104	schtasks.exe
4700	schtasks.exe
4852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
1556	Bridgereviewruntime.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe
4356	TrustedInstaller.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	Bridgereviewruntime.exe
Token: SeDebugPrivilege	4356	TrustedInstaller.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4900	4676	WinAuthx32.exe	87
PID 4676 wrote to memory of 4900	4676	WinAuthx32.exe	87
PID 4676 wrote to memory of 4900	4676	WinAuthx32.exe	87
PID 4900 wrote to memory of 2224	4900	WScript.exe	107
PID 4900 wrote to memory of 2224	4900	WScript.exe	107
PID 4900 wrote to memory of 2224	4900	WScript.exe	107
PID 2224 wrote to memory of 1556	2224	cmd.exe	109
PID 2224 wrote to memory of 1556	2224	cmd.exe	109
PID 1556 wrote to memory of 5000	1556	Bridgereviewruntime.exe	149
PID 1556 wrote to memory of 5000	1556	Bridgereviewruntime.exe	149
PID 5000 wrote to memory of 4676	5000	cmd.exe	151
PID 5000 wrote to memory of 4676	5000	cmd.exe	151
PID 5000 wrote to memory of 4356	5000	cmd.exe	152
PID 5000 wrote to memory of 4356	5000	cmd.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinAuthx32.exe
"C:\Users\Admin\AppData\Local\Temp\WinAuthx32.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Surrogatewinhostmonitordhcp\wxRxOc10fSIm2kfzTZ.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Surrogatewinhostmonitordhcp\e606pqNPmR9Hil934yuQs.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Surrogatewinhostmonitordhcp\Bridgereviewruntime.exe
      "C:\Surrogatewinhostmonitordhcp\Bridgereviewruntime.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1556
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2rvDrhowJ1.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5000
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4676
      - C:\Recovery\WindowsRE\TrustedInstaller.exe
        
        "C:\Recovery\WindowsRE\TrustedInstaller.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Surrogatewinhostmonitordhcp\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Surrogatewinhostmonitordhcp\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Surrogatewinhostmonitordhcp\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Surrogatewinhostmonitordhcp\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Surrogatewinhostmonitordhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Surrogatewinhostmonitordhcp\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 7 /tr "'C:\Surrogatewinhostmonitordhcp\TiWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorker" /sc ONLOGON /tr "'C:\Surrogatewinhostmonitordhcp\TiWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TiWorkerT" /sc MINUTE /mo 14 /tr "'C:\Surrogatewinhostmonitordhcp\TiWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\95a9da8d6083c53f11d88fcfaf8c\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\95a9da8d6083c53f11d88fcfaf8c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\95a9da8d6083c53f11d88fcfaf8c\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\9067c5701a2f6bcc5b\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\9067c5701a2f6bcc5b\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\9067c5701a2f6bcc5b\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\95a9da8d6083c53f11d88fcfaf8c\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\95a9da8d6083c53f11d88fcfaf8c\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\95a9da8d6083c53f11d88fcfaf8c\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Surrogatewinhostmonitordhcp\Bridgereviewruntime.exe

Filesize
827KB

MD5
1c6f2d9bda0ad01bf683a195a72bf9d6

SHA1
16e05e73f2fddba756060dc70287a5985d9bb527

SHA256
bdfc59627f62057850059472392da389bc123cc4512b7044eddc353651e4d091

SHA512
c5a6e4140e549be700ddc49ea64ea70032f0db57ee0375531ceca6e4221e3b42ff590204121157798ec0999ba5ff818cca95986753035e1a06d7040960dea6ab

Download Submit
C:\Surrogatewinhostmonitordhcp\e606pqNPmR9Hil934yuQs.bat

Filesize
56B

MD5
ae6f7c1068acd39d235ad73709dda7c1

SHA1
423bb815f0515f8cb478bb557f9b093e9ec02b1c

SHA256
cfe295235fdb23a9af5a535a7d4cc2bde785caf9c73ba8ae1e7bf1ff45a460fa

SHA512
6a4829d4acd28faf755f2e1ff0bf6423aeae0b0b506812a694f19cba2449c49509ae4280bbcd1b0b31fa9bc48301ea42b42af2e3ccf3dd0433cb46ce97e32b76

Download Submit
C:\Surrogatewinhostmonitordhcp\wxRxOc10fSIm2kfzTZ.vbe

Filesize
226B

MD5
5ffd41cbec6a6d6a0ff79804df9e1e57

SHA1
b62f9545777a908b0b2134ebccae0ee788eb52d3

SHA256
c597e507bc0d72d57996850f3a8cd97b986fe032e1e1affb7789a4c00dd52e6d

SHA512
027da94ebd9b00790caa297bee9d2a5fc7156a9f2cae9866a5ddd3178eb344b20b3922ac78b693901e75ae4be9033459deba0f9a60154d826e13d1cb056f26fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\2rvDrhowJ1.bat

Filesize
207B

MD5
bbf3266ae6465a878e2a75b9eb4c28b5

SHA1
e8eb1318f3068f12bead941f83f74c862dd652ce

SHA256
731ea2af71e67e0b38ad54051ff34391c9ce5be71064c83d67df312e0d40b752

SHA512
657e64af6b363df5fd7b8c7eb3046682f3ef500d13b11474b5539b842d6f1361294ad622fce4db89dcf2d0f503eb4271c49c8838c04ee3f41a75c5192fbc46c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9385A.tmp

Filesize
1KB

MD5
9374c9ef3251d0d0395906ef6b4b85ab

SHA1
b522676dc48a449a21f87734847a3a4e05696b0a

SHA256
fb9de1233914083a1bf2afd40933131009a95da37abc9cd5828999de80631e8b

SHA512
260f5345bf419a4a7f9df7a6c7016c3ed4a634b7a11b70caf325921390606574f29fa3e5bb4564e84c770639fce244947c6473aae3d60f7c4f59e7f83eddab5b

Download Submit
memory/1556-12-0x00007FF86E893000-0x00007FF86E895000-memory.dmp

Filesize
8KB

Download
memory/1556-13-0x0000000000AB0000-0x0000000000B86000-memory.dmp

Filesize
856KB

Download