dcrat | 223733ec708531603b51bf10fc3126cb4dfd47f4aaada4a75acd168eb06b9d50

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/04/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hardserialnumber.exe
Size 1.1MB
Sample260430-lt7wfac16w
SHA256 223733ec708531603b51bf10fc3126cb4dfd47f4aaada4a75acd168eb06b9d50
MD5 208477a99dd021397a883960d0115c6d
SHA1 7695a822cf67d5e8ea1a6a87e7a06dcef0548ee5
SHA512 e2737e49078db1e600bcccbac0f2aaa5aaf07349116294e58e4c91366c547d2639233feae61f84b6f049d761372da13ade40686db16222eeef36572a4ad5f399
SSDEEP 24576:U2G/nvxW3Ww0twMQNrHBXYjVzxYxEbtyXAjo7dcCHBPR2mpfmN:UbA30PQQV2XAUrR3fe
TLSH
T12D454A017E84CA12F0192633C2FF490847B8AC516BA6E71B7EBA376D55123937D1CADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0007000000024467-12.dat	dcrat
behavioral1/memory/3268-14-0x00000000008F0000-0x00000000009C6000-memory.dmp	dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3972	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1204	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2108	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1236	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4896	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	4092	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	4092	schtasks.exe	89

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	Hardserialnumber.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	chaincommonitor.exe

Executes dropped EXE 17 IoCs

pid	Process
3268	chaincommonitor.exe
1756	cmd.exe
4500	smss.exe
2348	upfc.exe
4640	fontdrvhost.exe
3560	winlogon.exe
4436	dllhost.exe
5072	dllhost.exe
2116	Registry.exe
1812	smss.exe
3548	fontdrvhost.exe
3056	csrss.exe
2480	SearchApp.exe
1700	WUDFHost.exe
4268	sihost.exe
4656	Idle.exe
2236	RuntimeBroker.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\it-IT\9e8d7a4ca61bd9	chaincommonitor.exe
File created	C:\Program Files\Windows Multimedia Platform\480b7989c529f6	chaincommonitor.exe
File created	C:\Program Files\Internet Explorer\ja-JP\SearchApp.exe	chaincommonitor.exe
File created	C:\Program Files\Internet Explorer\ja-JP\38384e6a620884	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\ee2ad38f3d4382	chaincommonitor.exe
File created	C:\Program Files\Windows Multimedia Platform\WUDFHost.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\dllhost.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\5940a34987c991	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe	chaincommonitor.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\5b884080fd4f94	chaincommonitor.exe
File created	C:\Program Files\Windows Defender\it-IT\RuntimeBroker.exe	chaincommonitor.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\CbsTemp\smss.exe	chaincommonitor.exe
File created	C:\Windows\CbsTemp\69ddcba757bf72	chaincommonitor.exe
File created	C:\Windows\WaaS\services\SearchApp.exe	chaincommonitor.exe
File created	C:\Windows\twain_32\upfc.exe	chaincommonitor.exe
File opened for modification	C:\Windows\twain_32\upfc.exe	chaincommonitor.exe
File created	C:\Windows\twain_32\ea1d8f6d871115	chaincommonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hardserialnumber.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings	Hardserialnumber.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1396	schtasks.exe
3064	schtasks.exe
1020	schtasks.exe
4800	schtasks.exe
2088	schtasks.exe
772	schtasks.exe
3364	schtasks.exe
4424	schtasks.exe
2172	schtasks.exe
3976	schtasks.exe
4108	schtasks.exe
3756	schtasks.exe
780	schtasks.exe
964	schtasks.exe
2428	schtasks.exe
3728	schtasks.exe
2596	schtasks.exe
1480	schtasks.exe
4976	schtasks.exe
1772	schtasks.exe
4896	schtasks.exe
1048	schtasks.exe
1952	schtasks.exe
3548	schtasks.exe
2484	schtasks.exe
5008	schtasks.exe
4860	schtasks.exe
3156	schtasks.exe
2040	schtasks.exe
3024	schtasks.exe
2392	schtasks.exe
1204	schtasks.exe
4656	schtasks.exe
3772	schtasks.exe
2964	schtasks.exe
2744	schtasks.exe
3972	schtasks.exe
2108	schtasks.exe
2176	schtasks.exe
3300	schtasks.exe
2712	schtasks.exe
4988	schtasks.exe
4804	schtasks.exe
1236	schtasks.exe
5036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe
3268	chaincommonitor.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	chaincommonitor.exe
Token: SeDebugPrivilege	1756	cmd.exe
Token: SeDebugPrivilege	4500	smss.exe
Token: SeDebugPrivilege	2348	upfc.exe
Token: SeDebugPrivilege	4640	fontdrvhost.exe
Token: SeDebugPrivilege	3560	winlogon.exe
Token: SeDebugPrivilege	4436	dllhost.exe
Token: SeDebugPrivilege	5072	dllhost.exe
Token: SeDebugPrivilege	2116	Registry.exe
Token: SeDebugPrivilege	1812	smss.exe
Token: SeDebugPrivilege	3548	fontdrvhost.exe
Token: SeDebugPrivilege	2480	SearchApp.exe
Token: SeDebugPrivilege	4268	sihost.exe
Token: SeDebugPrivilege	1700	WUDFHost.exe
Token: SeDebugPrivilege	3056	csrss.exe
Token: SeDebugPrivilege	4656	Idle.exe
Token: SeDebugPrivilege	2236	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 756	3832	Hardserialnumber.exe	84
PID 756 wrote to memory of 4496	756	WScript.exe	86
PID 4496 wrote to memory of 3268	4496	cmd.exe	88
PID 3268 wrote to memory of 3548	3268	chaincommonitor.exe	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Hardserialnumber.exe
"C:\Users\Admin\AppData\Local\Temp\Hardserialnumber.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\containercomponentsaves\oiF5KfJ33iaZc9bYA.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\containercomponentsaves\KRJsmLXE.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\containercomponentsaves\chaincommonitor.exe
      "C:\containercomponentsaves\chaincommonitor.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\twain_32\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\containercomponentsaves\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\containercomponentsaves\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\containercomponentsaves\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\containercomponentsaves\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\containercomponentsaves\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\containercomponentsaves\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\CbsTemp\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\CbsTemp\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\CbsTemp\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Libraries\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\ja-JP\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Recovery\WindowsRE\cmd.exe
"C:\Recovery\WindowsRE\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\ja-JP\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\CbsTemp\smss.exe
"C:\Windows\CbsTemp\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\it-IT\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040

C:\Windows\twain_32\upfc.exe
"C:\Windows\twain_32\upfc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe
"C:\Program Files (x86)\Windows Photo Viewer\uk-UA\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Recovery\WindowsRE\winlogon.exe
"C:\Recovery\WindowsRE\winlogon.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Users\Default User\dllhost.exe
"C:\Users\Default User\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\dllhost.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe
"C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\containercomponentsaves\smss.exe
"C:\containercomponentsaves\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Users\Public\Libraries\Idle.exe
"C:\Users\Public\Libraries\Idle.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Program Files\Internet Explorer\ja-JP\SearchApp.exe
"C:\Program Files\Internet Explorer\ja-JP\SearchApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Program Files\Windows Multimedia Platform\WUDFHost.exe
"C:\Program Files\Windows Multimedia Platform\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\containercomponentsaves\sihost.exe
"C:\containercomponentsaves\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Program Files\Windows Defender\it-IT\RuntimeBroker.exe
"C:\Program Files\Windows Defender\it-IT\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

KRJsmLXE.bat

Path C:\containercomponentsaves\KRJsmLXE.bat
Size 48B
SHA256 4f6aa2bca870021d2532b20ec7a93b9a752654a98d60c3c18e9089bcb288304a
MD5 ddfd14be9e337ab2068d0d69d11692ee
SHA1 41f09c7450c5abf17e89915a33b173cf2bc7dd94
SHA512 2bb6310cfe873d6c0f5fea81f18bc68d17b9ceeb8a137636b8b4523a3861b5ee694a9c709361ef2c23e8c979117ef918b517391934c21ec0ce0ba8c137e74588
MD5 SHA1 SHA512

Submit Download

chaincommonitor.exe

Path C:\containercomponentsaves\chaincommonitor.exe
Size 828KB
SHA256 de8396f4ba0b3291090fcd7f36ffb5fe2a966738fb9a2d2ed3d1732c76c25b38
MD5 e5bc800a6efdf560ee844d34598787c1
SHA1 a0d35d18304ef4eaea03ab87d9eaea8d35dce445
SHA512 d5b4ae2749d2156c63ba33a76310011cf9e1fef35fee0e4181b804f8d882d40cd29c9c1e6cda26e935727b893b540c7ab8a7861b6eca32ebede0e0d6f124fd83
SSDEEP 24576:4MQNrHBXYjVzxYxEbtyXAjo7dcCHBPR2mpfm:HQQV2XAUrR3f
TLSH
T1AF05F7017E84CE12F0192233C2EF494887B89D5166A6E32B7DBA377E55123A77C0D9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oiF5KfJ33iaZc9bYA.vbe

Path C:\containercomponentsaves\oiF5KfJ33iaZc9bYA.vbe
Size 209B
SHA256 aac6df1ae7767aedfb895f12388dab711af5f86187b60bdbe73e042e6abc44c9
MD5 afe3a300bd4612f93cec867a67af28e7
SHA1 fdbe3316468136b74559407b60455557fea3841b
SHA512 da73758c61eb56bdce719627eddc7888896a6ddf70b598703bf18b9bb2b2df7422898879914a84b1b0f2fba4f10965f4406d46889fc47eb567302211925a0ccd
TLSH
T102D0232C9026BF54009C150AF09088CDCC21C2C7B3B9734B5CDCCC124700346143C3D0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-9-0x0000000003790000-0x00000000037B1000-memory.dmp

Download

memory/756-10-0x00000000037C0000-0x00000000037DC000-memory.dmp

Download

memory/1700-101-0x0000000000F20000-0x0000000000F2C000-memory.dmp

Download

memory/1756-79-0x0000000002C60000-0x0000000002C6C000-memory.dmp

Download

memory/1812-95-0x000000001D410000-0x000000001D41C000-memory.dmp

Download

memory/2116-93-0x0000000002270000-0x000000000227C000-memory.dmp

Download

memory/2236-109-0x000000001B5F0000-0x000000001B5FC000-memory.dmp

Download

memory/2348-84-0x000000001AFA0000-0x000000001AFAC000-memory.dmp

Download

memory/2480-102-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Download

memory/3056-106-0x000000001C3F0000-0x000000001C3FC000-memory.dmp

Download

memory/3268-75-0x0000000001180000-0x000000000118C000-memory.dmp

Download

memory/3268-14-0x00000000008F0000-0x00000000009C6000-memory.dmp

Download

memory/3548-97-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

Download

memory/3560-87-0x0000000001190000-0x000000000119C000-memory.dmp

Download

memory/4268-103-0x000000001B010000-0x000000001B01C000-memory.dmp

Download

memory/4436-89-0x00000000010B0000-0x00000000010BC000-memory.dmp

Download

memory/4500-85-0x000000001B5E0000-0x000000001B5EC000-memory.dmp

Download

memory/4640-81-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Download

memory/4656-107-0x0000000002DC0000-0x0000000002DCC000-memory.dmp

Download

memory/5072-92-0x0000000002E30000-0x0000000002E3C000-memory.dmp

Download