dcrat | fab9726534078808667e3e330bf24152919f74893067ec8cc40f21b0d025fbb8

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/09/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fb35c4ae7f69057974364351375bfb9.exe
Size 750KB
Sample260927-eelw4ayble
SHA256 fab9726534078808667e3e330bf24152919f74893067ec8cc40f21b0d025fbb8
MD5 2fb35c4ae7f69057974364351375bfb9
SHA1 a06345f53795736da97151d45fee3cb402f61ec0
SHA512 cfe55d90b259c9f54841c7cef04a75c225f15ea91bb27f0b1c4c4164a63a5ea6c82b196f41cd172c25b8a0c953cec47a39cb34a7fcabecb8b018487c37be0364
SSDEEP 12288:hpoIY///1UFyp4JfHkKR4amAY/ehKTXERL3L4/8pUs5QcEtov6N:kIY//yJDSamL7TX+Lm83+W
TLSH
T11BF423235C9E54F3ED9844FB3C5A1B763B6E02C92E442FB6497C7C491B919B238709AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x00080000000244ff-7.dat	dcrat
behavioral1/files/0x0007000000024505-20.dat	dcrat
behavioral1/memory/3792-22-0x0000000000470000-0x0000000000566000-memory.dmp	dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5896	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6132	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5848	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3772	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5764	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5700	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5352	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4212	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5328	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5996	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2512	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5480	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5828	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2332	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4100	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5548	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	4940	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5492	4940	schtasks.exe	94

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	builds_store.json.cmd
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	driverPerf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2fb35c4ae7f69057974364351375bfb9.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\All Users\Documents\conhost.exe	conhost.exe

Executes dropped EXE 16 IoCs

pid	Process
564	builds_store.json.cmd
3792	driverPerf.exe
5796	csrss.exe
3240	RuntimeBroker.exe
5928	SearchApp.exe
1292	RuntimeBroker.exe
3688	conhost.exe
2956	services.exe
864	Registry.exe
5904	driverPerf.exe
5552	wininit.exe
5844	explorer.exe
4428	conhost.exe
2692	RuntimeBroker.exe
6132	RuntimeBroker.exe
1508	sppsvc.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4276	WScript.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\csrss.exe	driverPerf.exe
File created	C:\Program Files\Uninstall Information\886983d96e3d3e	driverPerf.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\Registry.exe	driverPerf.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\ee2ad38f3d4382	driverPerf.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RuntimeBroker.exe	driverPerf.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\9e8d7a4ca61bd9	driverPerf.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	driverPerf.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\RuntimeBroker.exe	driverPerf.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\9e8d7a4ca61bd9	driverPerf.exe
File created	C:\Program Files\ModifiableWindowsApps\System.exe	driverPerf.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	driverPerf.exe
File created	C:\Program Files\edge_BITS_4364_855943310\sppsvc.exe	driverPerf.exe
File created	C:\Program Files\edge_BITS_4364_855943310\0a1fd5f707cd16	driverPerf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\schemas\RuntimeBroker.exe	driverPerf.exe
File opened for modification	C:\Windows\schemas\RuntimeBroker.exe	driverPerf.exe
File created	C:\Windows\schemas\9e8d7a4ca61bd9	driverPerf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5696	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	driverPerf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	driverPerf.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builds_store.json.cmd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	builds_store.json.cmd
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	2fb35c4ae7f69057974364351375bfb9.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
6128	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5088	schtasks.exe
5492	schtasks.exe
1104	schtasks.exe
4212	schtasks.exe
4504	schtasks.exe
5896	schtasks.exe
6132	schtasks.exe
5700	schtasks.exe
2332	schtasks.exe
1240	schtasks.exe
5548	schtasks.exe
4528	schtasks.exe
2028	schtasks.exe
5328	schtasks.exe
5996	schtasks.exe
2860	schtasks.exe
4100	schtasks.exe
5848	schtasks.exe
5000	schtasks.exe
1032	schtasks.exe
4908	schtasks.exe
4188	schtasks.exe
2692	schtasks.exe
2156	schtasks.exe
2436	schtasks.exe
4000	schtasks.exe
4456	schtasks.exe
4208	schtasks.exe
4368	schtasks.exe
5480	schtasks.exe
2848	schtasks.exe
5352	schtasks.exe
2512	schtasks.exe
5828	schtasks.exe
2704	schtasks.exe
2420	schtasks.exe
3772	schtasks.exe
5764	schtasks.exe
1708	schtasks.exe
392	schtasks.exe
3280	schtasks.exe
3308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3792	driverPerf.exe
3792	driverPerf.exe
3792	driverPerf.exe
3792	driverPerf.exe
3792	driverPerf.exe
3792	driverPerf.exe
3792	driverPerf.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	driverPerf.exe
Token: SeDebugPrivilege	5796	csrss.exe
Token: SeDebugPrivilege	3240	RuntimeBroker.exe
Token: SeDebugPrivilege	5928	SearchApp.exe
Token: SeDebugPrivilege	2956	services.exe
Token: SeDebugPrivilege	1292	RuntimeBroker.exe
Token: SeDebugPrivilege	5904	driverPerf.exe
Token: SeDebugPrivilege	3688	conhost.exe
Token: SeDebugPrivilege	864	Registry.exe
Token: SeDebugPrivilege	5552	wininit.exe
Token: SeDebugPrivilege	5844	explorer.exe
Token: SeDebugPrivilege	4428	conhost.exe
Token: SeDebugPrivilege	2692	RuntimeBroker.exe
Token: SeDebugPrivilege	6132	RuntimeBroker.exe
Token: SeDebugPrivilege	1508	sppsvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5640	OpenWith.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 564	996	2fb35c4ae7f69057974364351375bfb9.exe	91
PID 564 wrote to memory of 4276	564	builds_store.json.cmd	92
PID 4276 wrote to memory of 5696	4276	WScript.exe	96
PID 5696 wrote to memory of 3792	5696	cmd.exe	98
PID 3792 wrote to memory of 3240	3792	driverPerf.exe	156
PID 5696 wrote to memory of 6128	5696	cmd.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2fb35c4ae7f69057974364351375bfb9.exe
"C:\Users\Admin\AppData\Local\Temp\2fb35c4ae7f69057974364351375bfb9.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\builds_store.json.cmd
  "C:\Users\Admin\AppData\Local\Temp\builds_store.json.cmd"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\fontwin\XfnlBm.vbe"
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\fontwin\pWv5P.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5696
    - - C:\Users\Admin\AppData\Roaming\fontwin\driverPerf.exe
        
        "C:\Users\Admin\AppData\Roaming\fontwin\driverPerf.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3792
      - C:\Windows\schemas\RuntimeBroker.exe
        
        "C:\Windows\schemas\RuntimeBroker.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:6128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\schemas\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\schemas\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Documents\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverPerfd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\driverPerf.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverPerf" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\driverPerf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "driverPerfd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\driverPerf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Application Data\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Application Data\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\SoftwareDistribution\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\SoftwareDistribution\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\edge_BITS_4364_855943310\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4364_855943310\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\edge_BITS_4364_855943310\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5492

C:\Program Files\Uninstall Information\csrss.exe
"C:\Program Files\Uninstall Information\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Recovery\WindowsRE\SearchApp.exe
"C:\Recovery\WindowsRE\SearchApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RuntimeBroker.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Users\All Users\Documents\conhost.exe
"C:\Users\All Users\Documents\conhost.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Recovery\WindowsRE\services.exe
"C:\Recovery\WindowsRE\services.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956

C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\Registry.exe
"C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Recovery\WindowsRE\driverPerf.exe
"C:\Recovery\WindowsRE\driverPerf.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5904

C:\Recovery\WindowsRE\wininit.exe
"C:\Recovery\WindowsRE\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Users\Admin\Application Data\explorer.exe
"C:\Users\Admin\Application Data\explorer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Users\All Users\SoftwareDistribution\conhost.exe
"C:\Users\All Users\SoftwareDistribution\conhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Program Files (x86)\Windows NT\TableTextService\RuntimeBroker.exe
"C:\Program Files (x86)\Windows NT\TableTextService\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe
"C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Program Files\edge_BITS_4364_855943310\sppsvc.exe
"C:\Program Files\edge_BITS_4364_855943310\sppsvc.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

driverPerf.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\driverPerf.exe.log
Size 1KB
SHA256 519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
MD5 7f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1 d58622bf6b5071beacf3b35bb505bde2000983e3
SHA512 8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
TLSH
T10131BE7123B6F1D989163F472C6D26C003BF4329B6A0EE4CB598625EE9270175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

builds_store.json.cmd

Path C:\Users\Admin\AppData\Local\Temp\builds_store.json.cmd
Size 1.2MB
SHA256 3292329c64143a3021cd35cbdd57ab9b1eaf0a36113deae7cd0c0a4731be76ca
MD5 70f951d8d3d4538db88ad11d6a2727c7
SHA1 62f0bd0f65e880062928797d6eed6ff9efc48636
SHA512 41d7ed6d8cfe4d7d612f260d5425f8004ea19ff05bc61f4acbfc36274703f2fea19c63173f7e00959a15403fd93c46aa71e6e655e684a6430eb951da7aa747b9
SSDEEP 24576:U2G/nvxW3Ww0tXSDwwwp6HKya3iX/tA/UhXZDXOEDs:UbA30CDwAKFAFASXOEg
TLSH
T1DE556A027F44DA21F0191233C2FF490447B4AC50AAA6E72B7EB9376E55223977C5DACB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XfnlBm.vbe

Path C:\Users\Admin\AppData\Roaming\fontwin\XfnlBm.vbe
Size 196B
SHA256 b06bedcf846a9d231e329014e0aa4fd38800666977270a99aaebe8c419ce5f2f
MD5 3853e56f7a2d261c7abef31ed9d67b89
SHA1 e0f14bc6031f1dc530e108e09aa067ccb06270d0
SHA512 cc94f65872c6bd4fd11c7d3f23477044b9126f878002a5e84e1419d3e4cda10a33388573f893b556156f2a24027e3187f38e32c60a151d8fc6316198d0f611f1
TLSH
T191D02388515FB3948D184886D384C42C5D95EF5487404695845C9541200457B3C1C355
MD5 SHA1 SHA512 TLSH

Submit Download

driverPerf.exe

Path C:\Users\Admin\AppData\Roaming\fontwin\driverPerf.exe
Size 952KB
SHA256 bdc36e540db68e53969b5d277acce0464ffcaa3e2bf3e9bc96d1f54573c085ae
MD5 5943e3387fcf59fb8dfde219b9b1a316
SHA1 4341e082d681c6b1140ad30d34040c5e6c8ab15b
SHA512 8291a5f3990c83c25f038782c4754bd083bbf8f4f0bc39287eb46bf76fb9a846c491c7ae5c633f7943b00db1b17eae80df536661dd75b82a5889c8c817d27262
SSDEEP 12288:YSQiwwwpQY2HKyaLrVst17blHA+YjUhzoIFZDtws5Q2Er+v0G:YSDwwwp6HKya3iX/tA/UhXZDXOED
TLSH
T1FF2507027F489E11F0091233C2EF494847B49D51AAA6E72B7DBA376E15123AB7C4D9CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pWv5P.bat

Path C:\Users\Admin\AppData\Roaming\fontwin\pWv5P.bat
Size 146B
SHA256 928fcfe2245e4cc3b2556d8cf50871e35d8ab36bcaea69382a5add7546494148
MD5 97eea595ee9aab410c0274c9fa06189b
SHA1 722f5bfcc5f6b232473cd50dbb05c472462e9682
SHA512 78f94fffafe71f8641ee1289b2e8b9f749b094eade2dffd0c517573cf0c9bc8846d6606db38b70bd819f2bc4ee40268033911edff7d591467798bd8703bc4c92
TLSH
T184C08C30201698A2E5A0AA24288FAD02972B124B6050A2540D9A102F814A48DC17C6C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/996-0-0x0000000000AF0000-0x0000000000BB2000-memory.dmp

Download

memory/996-1-0x00000000014D0000-0x00000000014E0000-memory.dmp

Download

memory/3792-22-0x0000000000470000-0x0000000000566000-memory.dmp

Download

memory/3792-23-0x0000000002680000-0x000000000268E000-memory.dmp

Download

memory/3792-24-0x0000000002690000-0x0000000002698000-memory.dmp

Download

memory/3792-25-0x00000000026A0000-0x00000000026AC000-memory.dmp

Download