dcrat | 2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd

Analysis

max time kernel
149s
max time network
74s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Size 1.1MB
Sample261014-thk7asfv3z
SHA256 2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd
MD5 800dc6c4133d24b925066e921c8ae97f
SHA1 2be85e23c3e71d86c214f88c9bfa37c92a485d16
SHA512 f671498bd2e07e9cdfb619ace14b435fd5fce2a6c95110ec8b103043e4ec696caad59eecdf087b5f7df0bcedc494cdd2b7bb720191cf27f9e821d0f0685148aa
SSDEEP 24576:nhNn3o3a0KaMVCcOozk9H+pOQUc4+F6Ly++cUVF1ouhK0XfC:nhJokBVCcHzYH+pOQUxRLy+vUr1bN
TLSH
T17C459C3D9D742FD5E132F6740A65E091F6D082FAB300CB561FE68A485279735A2EF02E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2380-13-0x0000000000400000-0x0000000000528000-memory.dmp	dcrat
behavioral2/memory/2380-13-0x0000000000400000-0x0000000000528000-memory.dmp	family_dcrat_v2

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5696	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6108	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3400	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3236	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5552	4104	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	4104	schtasks.exe	91

UAC bypass 3 TTPs 9 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ctfmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ctfmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ctfmon.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4200	powershell.exe
5656	powershell.exe
2012	powershell.exe
5872	powershell.exe

Executes dropped EXE 10 IoCs

pid	Process
1604	fontdrvhost.exe
5928	wininit.exe
5524	ctfmon.exe
2808	ctfmon.exe
5636	fontdrvhost.exe
4168	fontdrvhost.exe
2996	wininit.exe
4828	ctfmon.exe
5720	ctfmon.exe
676	ctfmon.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ctfmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ctfmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2380-18-0x0000000005F00000-0x0000000005F10000-memory.dmp	SmartAssembly
behavioral2/memory/2380-23-0x0000000006090000-0x000000000609A000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 5280 set thread context of 2380	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	90
PID 1604 set thread context of 4168	1604	fontdrvhost.exe	122
PID 5928 set thread context of 2996	5928	wininit.exe	123
PID 5524 set thread context of 4828	5524	ctfmon.exe	124
PID 2808 set thread context of 676	2808	ctfmon.exe	126

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\RCX87A8.tmp	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\56085415360792	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\RCX8749.tmp	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\UUS\x86\de-DE\sppsvc.exe	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1008	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w32tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1868	schtasks.exe
1836	schtasks.exe
3236	schtasks.exe
3400	schtasks.exe
5552	schtasks.exe
2452	schtasks.exe
5696	schtasks.exe
3312	schtasks.exe
6108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
4200	powershell.exe
4200	powershell.exe
5656	powershell.exe
5656	powershell.exe
2012	powershell.exe
2012	powershell.exe
5872	powershell.exe
5872	powershell.exe
4200	powershell.exe
2012	powershell.exe
5656	powershell.exe
5872	powershell.exe
1604	fontdrvhost.exe
1604	fontdrvhost.exe
4168	fontdrvhost.exe
4168	fontdrvhost.exe
2808	ctfmon.exe
2808	ctfmon.exe
676	ctfmon.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Token: SeDebugPrivilege	2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	5872	powershell.exe
Token: SeIncreaseQuotaPrivilege	4200	powershell.exe
Token: SeSecurityPrivilege	4200	powershell.exe
Token: SeTakeOwnershipPrivilege	4200	powershell.exe
Token: SeLoadDriverPrivilege	4200	powershell.exe
Token: SeSystemProfilePrivilege	4200	powershell.exe
Token: SeSystemtimePrivilege	4200	powershell.exe
Token: SeProfSingleProcessPrivilege	4200	powershell.exe
Token: SeIncBasePriorityPrivilege	4200	powershell.exe
Token: SeCreatePagefilePrivilege	4200	powershell.exe
Token: SeBackupPrivilege	4200	powershell.exe
Token: SeRestorePrivilege	4200	powershell.exe
Token: SeShutdownPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeSystemEnvironmentPrivilege	4200	powershell.exe
Token: SeRemoteShutdownPrivilege	4200	powershell.exe
Token: SeUndockPrivilege	4200	powershell.exe
Token: SeManageVolumePrivilege	4200	powershell.exe
Token: 33	4200	powershell.exe
Token: 34	4200	powershell.exe
Token: 35	4200	powershell.exe
Token: 36	4200	powershell.exe
Token: SeIncreaseQuotaPrivilege	2012	powershell.exe
Token: SeSecurityPrivilege	2012	powershell.exe
Token: SeTakeOwnershipPrivilege	2012	powershell.exe
Token: SeLoadDriverPrivilege	2012	powershell.exe
Token: SeSystemProfilePrivilege	2012	powershell.exe
Token: SeSystemtimePrivilege	2012	powershell.exe
Token: SeProfSingleProcessPrivilege	2012	powershell.exe
Token: SeIncBasePriorityPrivilege	2012	powershell.exe
Token: SeCreatePagefilePrivilege	2012	powershell.exe
Token: SeBackupPrivilege	2012	powershell.exe
Token: SeRestorePrivilege	2012	powershell.exe
Token: SeShutdownPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeSystemEnvironmentPrivilege	2012	powershell.exe
Token: SeRemoteShutdownPrivilege	2012	powershell.exe
Token: SeUndockPrivilege	2012	powershell.exe
Token: SeManageVolumePrivilege	2012	powershell.exe
Token: 33	2012	powershell.exe
Token: 34	2012	powershell.exe
Token: 35	2012	powershell.exe
Token: 36	2012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5656	powershell.exe
Token: SeSecurityPrivilege	5656	powershell.exe
Token: SeTakeOwnershipPrivilege	5656	powershell.exe
Token: SeLoadDriverPrivilege	5656	powershell.exe
Token: SeSystemProfilePrivilege	5656	powershell.exe
Token: SeSystemtimePrivilege	5656	powershell.exe
Token: SeProfSingleProcessPrivilege	5656	powershell.exe
Token: SeIncBasePriorityPrivilege	5656	powershell.exe
Token: SeCreatePagefilePrivilege	5656	powershell.exe
Token: SeBackupPrivilege	5656	powershell.exe
Token: SeRestorePrivilege	5656	powershell.exe
Token: SeShutdownPrivilege	5656	powershell.exe
Token: SeDebugPrivilege	5656	powershell.exe
Token: SeSystemEnvironmentPrivilege	5656	powershell.exe
Token: SeRemoteShutdownPrivilege	5656	powershell.exe
Token: SeUndockPrivilege	5656	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 5208	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	89
PID 5280 wrote to memory of 2380	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	90
PID 5280 wrote to memory of 2380	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	90
PID 5280 wrote to memory of 2380	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	90
PID 5280 wrote to memory of 2380	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	90
PID 5280 wrote to memory of 2380	5280	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	90
PID 2380 wrote to memory of 5656	2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	107
PID 2380 wrote to memory of 2012	2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	108
PID 2380 wrote to memory of 5872	2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	109
PID 2380 wrote to memory of 4200	2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	110
PID 2380 wrote to memory of 1008	2380	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe	115
PID 1008 wrote to memory of 2800	1008	cmd.exe	117
PID 2800 wrote to memory of 3264	2800	w32tm.exe	118
PID 1008 wrote to memory of 2808	1008	cmd.exe	120
PID 1604 wrote to memory of 5636	1604	fontdrvhost.exe	121
PID 1604 wrote to memory of 4168	1604	fontdrvhost.exe	122
PID 1604 wrote to memory of 4168	1604	fontdrvhost.exe	122
PID 1604 wrote to memory of 4168	1604	fontdrvhost.exe	122
PID 1604 wrote to memory of 4168	1604	fontdrvhost.exe	122
PID 1604 wrote to memory of 4168	1604	fontdrvhost.exe	122
PID 5928 wrote to memory of 2996	5928	wininit.exe	123
PID 5928 wrote to memory of 2996	5928	wininit.exe	123
PID 5928 wrote to memory of 2996	5928	wininit.exe	123
PID 5928 wrote to memory of 2996	5928	wininit.exe	123
PID 5928 wrote to memory of 2996	5928	wininit.exe	123
PID 5524 wrote to memory of 4828	5524	ctfmon.exe	124
PID 5524 wrote to memory of 4828	5524	ctfmon.exe	124
PID 5524 wrote to memory of 4828	5524	ctfmon.exe	124
PID 5524 wrote to memory of 4828	5524	ctfmon.exe	124
PID 5524 wrote to memory of 4828	5524	ctfmon.exe	124
PID 2808 wrote to memory of 5720	2808	ctfmon.exe	125
PID 2808 wrote to memory of 676	2808	ctfmon.exe	126
PID 2808 wrote to memory of 676	2808	ctfmon.exe	126
PID 2808 wrote to memory of 676	2808	ctfmon.exe	126
PID 2808 wrote to memory of 676	2808	ctfmon.exe	126
PID 2808 wrote to memory of 676	2808	ctfmon.exe	126

System policy modification 1 TTPs 9 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ctfmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ctfmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ctfmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
"C:\Users\Admin\AppData\Local\Temp\2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Users\Admin\AppData\Local\Temp\2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
  "{path}"
  2⤵
  PID:5208
- C:\Users\Admin\AppData\Local\Temp\2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe
  "{path}"
  2⤵
  - UAC bypass
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows.old\ctfmon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2jWrKESR9g.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\SysWOW64\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:3264
  - - C:\Windows.old\ctfmon.exe
      "C:\Windows.old\ctfmon.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows.old\ctfmon.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        
        PID:5720
    - - C:\Windows.old\ctfmon.exe
        
        "{path}"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        System policy modification
        
        PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 5 /tr "'C:\Windows.old\ctfmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmon" /sc ONLOGON /tr "'C:\Windows.old\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 11 /tr "'C:\Windows.old\ctfmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Recovery\WindowsRE\fontdrvhost.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  PID:5636
- C:\Recovery\WindowsRE\fontdrvhost.exe
  "{path}"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:4168

C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe
"C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Program Files (x86)\Windows Defender\it-IT\wininit.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2996

C:\Windows.old\ctfmon.exe
"C:\Windows.old\ctfmon.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Windows.old\ctfmon.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fontdrvhost.exe

Path C:\Recovery\WindowsRE\fontdrvhost.exe
Size 1.1MB
SHA256 2fbb29a74a5a403d826bc71d9ba3c934702ce3c936d192ba2e21a4f2b5994ccd
MD5 800dc6c4133d24b925066e921c8ae97f
SHA1 2be85e23c3e71d86c214f88c9bfa37c92a485d16
SHA512 f671498bd2e07e9cdfb619ace14b435fd5fce2a6c95110ec8b103043e4ec696caad59eecdf087b5f7df0bcedc494cdd2b7bb720191cf27f9e821d0f0685148aa
SSDEEP 24576:nhNn3o3a0KaMVCcOozk9H+pOQUc4+F6Ly++cUVF1ouhK0XfC:nhJokBVCcHzYH+pOQUxRLy+vUr1bN
TLSH
T17C459C3D9D742FD5E132F6740A65E091F6D082FAB300CB561FE68A485279735A2EF02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 865eda015cc813f57e0c819e3909f647e94be482b754b951d1690d40bc968e14
MD5 56869f7c192f62864a26d709cb4246d7
SHA1 22b7adf55220618d2fa103b01fecadff83ab4574
SHA512 1b68424b9ee54ed36f65a356553020004512fd9969bf5ea70920831081aa1d17afad6ba4a556961b5733eab9f90941923b69d67b753cfefe79d6bb4a2f418c86
SSDEEP 384:/8mboT1iBGSGW14bHew3H/9gejrr2PnZIAXr48+dW7VIzKwYvYbhNaPMWRtXZRfq:R0Z6GJWiLtH/9B6RIAXrX++o3bhNaPlg
TLSH
T16BA2B578213F6DC7D8D216B010D10AE7FBE4E489DAB65198BF1BDA2F4C90EB74A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 8234f7efbf01d43945df792bb3ef595ebc95eaf2fd0c5e5d63d820a22b88eefa
MD5 8003bf083007d5fc204dcdcb89527b97
SHA1 4706282894cd7f0eeb5fa1d4f3872526bc8634f2
SHA512 b1f62179e0d12ecd484df4c73d3effc6b9862a463f6265df7409e2fc866f194a19ae0e41ef6aa90fe63bce8987f7e89d0b197734762d37679a141bad14c702b2
SSDEEP 384:/SEboT1iBGSGW14bl7xdq/zyPIg3r2PJhHIAXr48+dW7VIzKwYvYbhNaPMWRtXZU:t0Z6GJWih1dq/z+v6XIAXrX++o3bhNay
TLSH
T12DA2B678213F6DC7D8D226B010D10AF7FBE4D489DAB65198AF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 3d95bcdc701276cdeadba51af97c66236241e9a7a24a80b0eb39ba441fcf1f5f
MD5 fc1a0e450dd7ae50fc741bc7c831b1b9
SHA1 912fda2ec3e1ac560964f2f8679f56dac87b7aee
SHA512 8bbb8a26b096b0991bd2adc2cc812736cb2a26dc4b73061cdd16f40ecec276489e2967343b279189a98cb829da928f07406cc1987cb10f3ee360930d55e67ba6
SSDEEP 384:/1eBaoT1iBGSGW14bl8/74q09/+yZ/r2P7ZIAXr48+dW7WtzKwYvYbhNaPMlRtXq:dexZ6GJWih8/nw/+M69IAXrX+1V3bhN6
TLSH
T1CEA2C578213F6DC7D8D226B410D20AE7FBE4D489DAF611D4BF1BDE2F4C90AB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2jWrKESR9g.bat

Path C:\Users\Admin\AppData\Local\Temp\2jWrKESR9g.bat
Size 190B
SHA256 61eb996a529d620e551a4d018b70b4073b6d54cf11ce854dcc860ca2e78571e4
MD5 02548c646c46069ff35d1bd9e72d2f92
SHA1 335138ad8562ea5770a2d550d5d1724030564208
SHA512 c8ada6873436a3f828dd0f7f37104fe2b99e8f8a91913151f81f2b5bfb8036205a1297cf1fb9de637a98e097dc9ccbc1a8b94b98b791a2ded1ccaecb4be8af04
TLSH
T1C5C0C0038000CB6904130C331C4B018CD0533C5875C43A2002D5DD7929CB4BB754A1C2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b04m0cb2.rdd.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b04m0cb2.rdd.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

RCX8A3A.tmp

Path C:\Windows.old\RCX8A3A.tmp
Size 1.1MB
SHA256 51afed63e9b933fc6257db34bf428e8b037f46985d4a3452b28fae89b7f77c63
MD5 75cf3b02bc95191f01fae7f98f37b953
SHA1 88abb8a80cdfff1f6b8d9f1306ff0d7992be7643
SHA512 8d7fa22e8f0c65c01e231432852922c711798a2a07784f38c9656b5bf216bc606020120000e3f93850df53a06ed983de035388c5e9dee06af3cc3d3d76e22f71
SSDEEP 24576:HhNn3o3a0KaMVCcOozk9H+pOQUc4+F6Ly++cUVF1ouhK0XfC:HhJokBVCcHzYH+pOQUxRLy+vUr1bN
TLSH
T1A0459C3D9D742FD5E132F6740A65E091F6D082FAB300CB561FE68A485279735A2EF02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2012-81-0x000000006F5B0000-0x000000006F5FC000-memory.dmp

Download

memory/2012-57-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Download

memory/2012-56-0x0000000005BA0000-0x0000000005BC2000-memory.dmp

Download

memory/2380-27-0x0000000006A60000-0x0000000006A6E000-memory.dmp

Download

memory/2380-28-0x0000000006A70000-0x0000000006A7C000-memory.dmp

Download

memory/2380-14-0x00000000743E0000-0x0000000074B9C000-memory.dmp

Download

memory/2380-15-0x00000000743E0000-0x0000000074B9C000-memory.dmp

Download

memory/2380-16-0x0000000005ED0000-0x0000000005EEC000-memory.dmp

Download

memory/2380-18-0x0000000005F00000-0x0000000005F10000-memory.dmp

Download

memory/2380-74-0x00000000743E0000-0x0000000074B9C000-memory.dmp

Download

memory/2380-30-0x0000000006B20000-0x0000000006B86000-memory.dmp

Download

memory/2380-13-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/2380-17-0x0000000005F50000-0x0000000005FA0000-memory.dmp

Download

memory/2380-20-0x0000000005F30000-0x0000000005F46000-memory.dmp

Download

memory/2380-21-0x0000000005FE0000-0x0000000005FF2000-memory.dmp

Download

memory/2380-23-0x0000000006090000-0x000000000609A000-memory.dmp

Download

memory/2380-22-0x0000000006050000-0x0000000006060000-memory.dmp

Download

memory/2380-24-0x00000000062F0000-0x00000000062FC000-memory.dmp

Download

memory/2380-25-0x0000000006310000-0x000000000631C000-memory.dmp

Download

memory/2380-26-0x0000000006330000-0x0000000006338000-memory.dmp

Download

memory/4200-79-0x0000000006C70000-0x0000000006C90000-memory.dmp

Download

memory/4200-67-0x0000000005A80000-0x0000000005A9E000-memory.dmp

Download

memory/4200-90-0x0000000007050000-0x00000000070E6000-memory.dmp

Download

memory/4200-89-0x0000000006E50000-0x0000000006E5A000-memory.dmp

Download

memory/4200-85-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

Download

memory/4200-84-0x0000000007420000-0x0000000007A9C000-memory.dmp

Download

memory/4200-80-0x0000000006CA0000-0x0000000006D43000-memory.dmp

Download

memory/4200-76-0x000000006F5B0000-0x000000006F5FC000-memory.dmp

Download

memory/4200-75-0x0000000006A30000-0x0000000006A66000-memory.dmp

Download

memory/4200-62-0x00000000055E0000-0x000000000593B000-memory.dmp

Download

memory/4200-68-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

Download

memory/5280-2-0x0000000005130000-0x00000000051CC000-memory.dmp

Download

memory/5280-12-0x000000000B5D0000-0x000000000B6F8000-memory.dmp

Download

memory/5280-0-0x00000000743F2000-0x00000000743F3000-memory.dmp

Download

memory/5280-11-0x0000000008EB0000-0x0000000008FA0000-memory.dmp

Download

memory/5280-19-0x00000000743E0000-0x0000000074B9C000-memory.dmp

Download

memory/5280-3-0x0000000005790000-0x0000000005D4A000-memory.dmp

Download

memory/5280-7-0x00000000743E0000-0x0000000074B9C000-memory.dmp

Download

memory/5280-5-0x00000000051D0000-0x00000000051DA000-memory.dmp

Download

memory/5280-10-0x00000000743E0000-0x0000000074B9C000-memory.dmp

Download

memory/5280-8-0x0000000005770000-0x000000000577E000-memory.dmp

Download

memory/5280-4-0x0000000005270000-0x0000000005302000-memory.dmp

Download

memory/5280-9-0x00000000743F2000-0x00000000743F3000-memory.dmp

Download

memory/5280-6-0x0000000005370000-0x00000000053C6000-memory.dmp

Download

memory/5280-1-0x00000000004F0000-0x000000000061C000-memory.dmp

Download

memory/5656-86-0x000000006F5B0000-0x000000006F5FC000-memory.dmp

Download

memory/5656-54-0x0000000005080000-0x00000000050B6000-memory.dmp

Download

memory/5656-55-0x00000000057B0000-0x0000000005DFA000-memory.dmp

Download

memory/5872-91-0x000000006F5B0000-0x000000006F5FC000-memory.dmp

Download