dcrat | 2bde6786b2837e12bed22cd99f9f83fa1cb4623163e2e38c6792821246d31362

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/04/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
096c637245d50eccfae8f11c34cc1015.exe
Size 1.7MB
Sample260411-e19kaahs2l
SHA256 2bde6786b2837e12bed22cd99f9f83fa1cb4623163e2e38c6792821246d31362
MD5 096c637245d50eccfae8f11c34cc1015
SHA1 6a85d571d30f75fd3babc3d4868351bf0714cf4b
SHA512 b6dceb69c855fce2038fa24c66e74208a822df43e2ec33d920467d6a6abc21ffc342337e6cc59db1a0e1d71afd7c6e692c90d5f97f8c4cf8df15ec7900cf09b8
SSDEEP 24576:7D4H1uuwc5P2a7pAORLa/SmubpEB9dw1W0vNb0pnsIprmrkEDYyGGM58cbwyQSv9:781XP2qmu9KWW0lOnVarjLMXxv3cn5
TLSH
T187859D027E44CE11F0191233C2EF594887B49D516AA6E32B7DBE37AD15523AB7C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution dcrat infostealer persistence rat

Malware Config

Signatures

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/5872-0-0x0000000000530000-0x00000000006E4000-memory.dmp	dcrat
behavioral2/files/0x000c00000002ad99-26.dat	dcrat

DcRat 59 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2476	schtasks.exe
		2680	schtasks.exe
		3088	schtasks.exe
		5260	schtasks.exe
		1176	schtasks.exe
		244	schtasks.exe
		5208	schtasks.exe
		3948	schtasks.exe
		3544	schtasks.exe
		5672	schtasks.exe
File created	C:\Program Files\Windows NT\Accessories\e1ef82546f0b02		096c637245d50eccfae8f11c34cc1015.exe
		1140	schtasks.exe
		2552	schtasks.exe
		3908	schtasks.exe
		3256	schtasks.exe
		4568	schtasks.exe
		2528	schtasks.exe
		2376	schtasks.exe
		2508	schtasks.exe
		3716	schtasks.exe
		6000	schtasks.exe
		4724	schtasks.exe
		4144	schtasks.exe
		5216	schtasks.exe
		3092	schtasks.exe
		5408	schtasks.exe
		4680	schtasks.exe
		3852	schtasks.exe
		5964	schtasks.exe
		3700	schtasks.exe
		5480	schtasks.exe
		4564	schtasks.exe
		1412	schtasks.exe
File created	C:\Program Files\Windows NT\Accessories\SppExtComObj.exe		096c637245d50eccfae8f11c34cc1015.exe
		2172	schtasks.exe
		5348	schtasks.exe
		5616	schtasks.exe
		1128	schtasks.exe
		5440	schtasks.exe
		2796	schtasks.exe
		1832	schtasks.exe
		432	schtasks.exe
		5232	schtasks.exe
		2620	schtasks.exe
		2280	schtasks.exe
		4784	schtasks.exe
		5528	schtasks.exe
		5088	schtasks.exe
		32	schtasks.exe
		3444	schtasks.exe
		3164	schtasks.exe
		5260	schtasks.exe
		5728	schtasks.exe
		1992	schtasks.exe
		3252	schtasks.exe
		5244	schtasks.exe
		2728	schtasks.exe
		3184	schtasks.exe
		3828	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 19 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Program Files\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\Registry.exe\", \"C:\\Users\\Public\\Music\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Program Files\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\Registry.exe\", \"C:\\Users\\Public\\Music\\dllhost.exe\", \"C:\\Users\\Admin\\PrintHood\\dllhost.exe\", \"C:\\Program Files (x86)\\Common Files\\System\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Program Files\\Reference Assemblies\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Program Files\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\Registry.exe\", \"C:\\Users\\Public\\Music\\dllhost.exe\", \"C:\\Users\\Admin\\PrintHood\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\", \"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\", \"C:\\Users\\All Users\\Desktop\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Templates\\spoolsv.exe\", \"C:\\Users\\Default\\explorer.exe\", \"C:\\Windows\\Fonts\\lsass.exe\", \"C:\\Windows\\Branding\\Basebrd\\wininit.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\", \"C:\\Program Files\\Reference Assemblies\\Registry.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5440	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3544	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6000	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4568	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5232	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5728	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5244	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5216	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3252	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5208	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5408	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5528	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5964	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5348	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	32	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	244	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5672	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5480	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5260	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5616	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3908	1136	schtasks.exe	79
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	1136	schtasks.exe	79

Executes dropped EXE 20 IoCs

pid	Process
2264	SppExtComObj.exe
4860	wininit.exe
3324	StartMenuExperienceHost.exe
4364	wininit.exe
2512	explorer.exe
5532	lsass.exe
768	Registry.exe
2032	spoolsv.exe
6064	dllhost.exe
2476	fontdrvhost.exe
2528	Registry.exe
4784	SppExtComObj.exe
4468	dwm.exe
2384	Registry.exe
5568	fontdrvhost.exe
3980	Idle.exe
388	dllhost.exe
5696	dllhost.exe
5564	dllhost.exe
5488	dwm.exe

Adds Run key to start application 2 TTPs 38 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\PrintHood\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default\\explorer.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\PrintHood\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Common Files\\System\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\Reference Assemblies\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Common Files\\System\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default\\Templates\\spoolsv.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Fonts\\lsass.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Desktop\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default\\Templates\\spoolsv.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default\\explorer.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\Fonts\\lsass.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Branding\\Basebrd\\wininit.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Branding\\Basebrd\\wininit.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\SppExtComObj.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files\\Reference Assemblies\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Users\\All Users\\Desktop\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\fontdrvhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\Registry.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows NT\\Accessories\\SppExtComObj.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files\\Windows Media Player\\Skins\\wininit.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Recovery\\WindowsRE\\StartMenuExperienceHost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dwm.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Music\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Music\\dllhost.exe\""	096c637245d50eccfae8f11c34cc1015.exe

SmartAssembly .NET packer 4 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5872-12-0x000000001B420000-0x000000001B42C000-memory.dmp	SmartAssembly
behavioral2/memory/5872-13-0x000000001B430000-0x000000001B43C000-memory.dmp	SmartAssembly
behavioral2/memory/5872-17-0x000000001B480000-0x000000001B48C000-memory.dmp	SmartAssembly
behavioral2/memory/5872-18-0x000000001B490000-0x000000001B49A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\Skins\wininit.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\Reference Assemblies\ee2ad38f3d4382	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\WindowsApps\services.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\Registry.exe	096c637245d50eccfae8f11c34cc1015.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\SppExtComObj.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\Windows Media Player\Skins\56085415360792	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\fontdrvhost.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\Reference Assemblies\Registry.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files (x86)\Common Files\System\dllhost.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\Windows NT\Accessories\SppExtComObj.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\Windows NT\Accessories\e1ef82546f0b02	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\5b884080fd4f94	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\e1ef82546f0b02	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\ee2ad38f3d4382	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6cb0b6c459d5d3	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Program Files (x86)\Common Files\System\5940a34987c991	096c637245d50eccfae8f11c34cc1015.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Performance\WinSAT\DataStore\dllhost.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Windows\Performance\WinSAT\DataStore\5940a34987c991	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Windows\Fonts\lsass.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Windows\Fonts\6203df4a6bafc7	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Windows\Branding\Basebrd\wininit.exe	096c637245d50eccfae8f11c34cc1015.exe
File created	C:\Windows\Branding\Basebrd\56085415360792	096c637245d50eccfae8f11c34cc1015.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings	096c637245d50eccfae8f11c34cc1015.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6000	schtasks.exe
1140	schtasks.exe
5440	schtasks.exe
2528	schtasks.exe
4784	schtasks.exe
3700	schtasks.exe
1176	schtasks.exe
2680	schtasks.exe
3828	schtasks.exe
5260	schtasks.exe
3252	schtasks.exe
32	schtasks.exe
2620	schtasks.exe
2796	schtasks.exe
3908	schtasks.exe
5232	schtasks.exe
2508	schtasks.exe
5408	schtasks.exe
3164	schtasks.exe
5244	schtasks.exe
3444	schtasks.exe
4144	schtasks.exe
3544	schtasks.exe
1832	schtasks.exe
5728	schtasks.exe
3184	schtasks.exe
3092	schtasks.exe
5964	schtasks.exe
2552	schtasks.exe
3716	schtasks.exe
1128	schtasks.exe
5260	schtasks.exe
5216	schtasks.exe
5616	schtasks.exe
3948	schtasks.exe
5672	schtasks.exe
4564	schtasks.exe
5480	schtasks.exe
432	schtasks.exe
5208	schtasks.exe
5088	schtasks.exe
2280	schtasks.exe
3256	schtasks.exe
1412	schtasks.exe
2376	schtasks.exe
4724	schtasks.exe
3852	schtasks.exe
2172	schtasks.exe
244	schtasks.exe
4568	schtasks.exe
2476	schtasks.exe
2728	schtasks.exe
1992	schtasks.exe
5528	schtasks.exe
5348	schtasks.exe
3088	schtasks.exe
4680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe
5872	096c637245d50eccfae8f11c34cc1015.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	096c637245d50eccfae8f11c34cc1015.exe
Token: SeDebugPrivilege	2264	SppExtComObj.exe
Token: SeDebugPrivilege	4860	wininit.exe
Token: SeDebugPrivilege	4364	wininit.exe
Token: SeDebugPrivilege	3324	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2512	explorer.exe
Token: SeDebugPrivilege	5532	lsass.exe
Token: SeDebugPrivilege	768	Registry.exe
Token: SeDebugPrivilege	2032	spoolsv.exe
Token: SeDebugPrivilege	6064	dllhost.exe
Token: SeDebugPrivilege	2476	fontdrvhost.exe
Token: SeDebugPrivilege	2528	Registry.exe
Token: SeDebugPrivilege	4784	SppExtComObj.exe
Token: SeDebugPrivilege	4468	dwm.exe
Token: SeDebugPrivilege	2384	Registry.exe
Token: SeDebugPrivilege	5568	fontdrvhost.exe
Token: SeDebugPrivilege	3980	Idle.exe
Token: SeDebugPrivilege	388	dllhost.exe
Token: SeDebugPrivilege	5696	dllhost.exe
Token: SeDebugPrivilege	5564	dllhost.exe
Token: SeDebugPrivilege	5488	dwm.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 1712	5872	096c637245d50eccfae8f11c34cc1015.exe	192
PID 1712 wrote to memory of 788	1712	cmd.exe	196
PID 1712 wrote to memory of 5488	1712	cmd.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\096c637245d50eccfae8f11c34cc1015.exe
"C:\Users\Admin\AppData\Local\Temp\096c637245d50eccfae8f11c34cc1015.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VKVtGEKgDq.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:788
- - C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\Accessories\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\Accessories\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\Skins\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Desktop\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Program Files\Windows NT\Accessories\SppExtComObj.exe
"C:\Program Files\Windows NT\Accessories\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Program Files\Windows Media Player\Skins\wininit.exe
"C:\Program Files\Windows Media Player\Skins\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Templates\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Default\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Default\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Fonts\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\Branding\Basebrd\wininit.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Branding\Basebrd\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\Branding\Basebrd\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5348

C:\Recovery\WindowsRE\StartMenuExperienceHost.exe
"C:\Recovery\WindowsRE\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\Branding\Basebrd\wininit.exe
"C:\Windows\Branding\Basebrd\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620

C:\Windows\Fonts\lsass.exe
"C:\Windows\Fonts\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5672

C:\Users\Default\explorer.exe
"C:\Users\Default\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Users\All Users\Desktop\Registry.exe
"C:\Users\All Users\Desktop\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Users\Default\Templates\spoolsv.exe
"C:\Users\Default\Templates\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\Performance\WinSAT\DataStore\dllhost.exe
"C:\Windows\Performance\WinSAT\DataStore\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5480

C:\Program Files\VideoLAN\VLC\skins\fonts\fontdrvhost.exe
"C:\Program Files\VideoLAN\VLC\skins\fonts\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Music\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Program Files\Reference Assemblies\Registry.exe
"C:\Program Files\Reference Assemblies\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe
"C:\Program Files\Reference Assemblies\Microsoft\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\Registry.exe
"C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\PrintHood\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Common Files\System\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3908

C:\Users\Default User\fontdrvhost.exe
"C:\Users\Default User\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5568

C:\Recovery\WindowsRE\Idle.exe
"C:\Recovery\WindowsRE\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\System\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\System\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3716

C:\Users\Public\Music\dllhost.exe
"C:\Users\Public\Music\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:388

C:\Users\Admin\PrintHood\dllhost.exe
"C:\Users\Admin\PrintHood\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Program Files (x86)\Common Files\System\dllhost.exe
"C:\Program Files (x86)\Common Files\System\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SppExtComObj.exe

Path C:\Program Files\Windows NT\Accessories\SppExtComObj.exe
Size 1.7MB
SHA256 2bde6786b2837e12bed22cd99f9f83fa1cb4623163e2e38c6792821246d31362
MD5 096c637245d50eccfae8f11c34cc1015
SHA1 6a85d571d30f75fd3babc3d4868351bf0714cf4b
SHA512 b6dceb69c855fce2038fa24c66e74208a822df43e2ec33d920467d6a6abc21ffc342337e6cc59db1a0e1d71afd7c6e692c90d5f97f8c4cf8df15ec7900cf09b8
SSDEEP 24576:7D4H1uuwc5P2a7pAORLa/SmubpEB9dw1W0vNb0pnsIprmrkEDYyGGM58cbwyQSv9:781XP2qmu9KWW0lOnVarjLMXxv3cn5
TLSH
T187859D027E44CE11F0191233C2EF594887B49D516AA6E32B7DBE37AD15523AB7C0DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

VKVtGEKgDq.bat

Path C:\Users\Admin\AppData\Local\Temp\VKVtGEKgDq.bat
Size 228B
SHA256 78b7c19d3676e75e77fee917c013a37662a53569ea89e659d626b45e1131ce64
MD5 c01a56abf990f7ef7ba24b69c7878cc7
SHA1 dd65f14ffa2f71cdb814f085dc801bd41f7c9fc0
SHA512 37e29dac8bf7f91a6311b0df3d157c56a88c2528f8fa52078d7ddc2e7c686181730366096711be7bc423487ce339939d40140a5f75d7f5d248a4ee5b66071b5f
TLSH
T114D023038101CBD028034C432D6E13CD70530C2832C8613003D55D2D02C7D75B1EE1C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/388-135-0x00000000016E0000-0x00000000016EC000-memory.dmp

Download

memory/768-118-0x00000000031A0000-0x00000000031AC000-memory.dmp

Download

memory/2032-116-0x000000001B7E0000-0x000000001B7EC000-memory.dmp

Download

memory/2264-103-0x0000000002EE0000-0x0000000002EEC000-memory.dmp

Download

memory/2384-128-0x00000000028B0000-0x00000000028BC000-memory.dmp

Download

memory/2476-122-0x0000000002630000-0x000000000263C000-memory.dmp

Download

memory/2512-109-0x0000000003100000-0x000000000310C000-memory.dmp

Download

memory/2528-126-0x00000000024B0000-0x00000000024BC000-memory.dmp

Download

memory/3324-111-0x000000001B390000-0x000000001B39C000-memory.dmp

Download

memory/3980-133-0x00000000017D0000-0x00000000017DC000-memory.dmp

Download

memory/4364-110-0x000000001B5B0000-0x000000001B5BC000-memory.dmp

Download

memory/4468-129-0x000000001C8D0000-0x000000001C8DC000-memory.dmp

Download

memory/4784-124-0x00000000015D0000-0x00000000015DC000-memory.dmp

Download

memory/4860-105-0x000000001B7E0000-0x000000001B7EC000-memory.dmp

Download

memory/5488-139-0x000000001C600000-0x000000001C60C000-memory.dmp

Download

memory/5532-114-0x00000000013F0000-0x00000000013FC000-memory.dmp

Download

memory/5564-137-0x00000000023E0000-0x00000000023EC000-memory.dmp

Download

memory/5568-131-0x0000000000F90000-0x0000000000F9C000-memory.dmp

Download

memory/5696-136-0x0000000000DE0000-0x0000000000DEC000-memory.dmp

Download

memory/5872-15-0x000000001B450000-0x000000001B45E000-memory.dmp

Download

memory/5872-0-0x0000000000530000-0x00000000006E4000-memory.dmp

Download

memory/5872-7-0x00000000029E0000-0x00000000029F0000-memory.dmp

Download

memory/5872-94-0x0000000000F10000-0x0000000000F1C000-memory.dmp

Download

memory/5872-8-0x00000000029D0000-0x00000000029DC000-memory.dmp

Download

memory/5872-19-0x000000001B4A0000-0x000000001B4AC000-memory.dmp

Download

memory/5872-5-0x0000000000FF0000-0x0000000001006000-memory.dmp

Download

memory/5872-18-0x000000001B490000-0x000000001B49A000-memory.dmp

Download

memory/5872-4-0x000000001BAC0000-0x000000001BB10000-memory.dmp

Download

memory/5872-3-0x0000000000FD0000-0x0000000000FEC000-memory.dmp

Download

memory/5872-10-0x000000001B3F0000-0x000000001B402000-memory.dmp

Download

memory/5872-6-0x00000000029C0000-0x00000000029C8000-memory.dmp

Download

memory/5872-9-0x0000000002A00000-0x0000000002A08000-memory.dmp

Download

memory/5872-16-0x000000001B460000-0x000000001B468000-memory.dmp

Download

memory/5872-17-0x000000001B480000-0x000000001B48C000-memory.dmp

Download

memory/5872-2-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

Download

memory/5872-14-0x000000001B440000-0x000000001B448000-memory.dmp

Download

memory/5872-13-0x000000001B430000-0x000000001B43C000-memory.dmp

Download

memory/5872-1-0x000000001B470000-0x000000001B480000-memory.dmp

Download

memory/5872-12-0x000000001B420000-0x000000001B42C000-memory.dmp

Download

memory/5872-11-0x000000001C040000-0x000000001C568000-memory.dmp

Download

memory/6064-120-0x00000000026E0000-0x00000000026EC000-memory.dmp

Download