dcrat | 90f985d62db63646b12c29fa073ddcf685fa3118e6fe1ac7b6ea7f5c240e9594

Analysis

max time kernel
2s
max time network
124s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Size

1.7MB
MD5

6a8dc0383ff9426d3cd10e686ea8af6e
SHA1

bee7864ec1d04b30f37d46da8e7ec5fe240ae3fc
SHA256

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa
SHA512

f0d96a682995d5d8e965aea6efc041ea26d57b50de7e8d8c36d03a5b74c68321574ac955a7be70d1436cdeba94dacee41e0269308e799770aa064a0d7d29ddfa
SSDEEP

24576:WwtlgjpoyMl1W9Rl/3XF9R95g9f53Lv+6gJUHGHhuf9QkGuW+4HcWb1JB4nS:xtyotW9RN+f53i1JUHG4xGuDkcY1JB

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsass.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Users\\Default\\Templates\\winlogon.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Users\\Default\\Templates\\winlogon.exe\", \"C:\\Program Files\\Internet Explorer\\en-US\\spoolsv.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2592	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1480	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2736	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2736	schtasks.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1136-1-0x0000000000E90000-0x0000000001042000-memory.dmp	dcrat
C:\Program Files (x86)\Windows Portable Devices\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe	dcrat
C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dwm.exe	dcrat
behavioral1/memory/1568-169-0x0000000000FE0000-0x0000000001192000-memory.dmp	dcrat
behavioral1/memory/2524-203-0x0000000000B30000-0x0000000000CE2000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
672	powershell.exe
1072	powershell.exe
2032	powershell.exe
844	powershell.exe
852	powershell.exe
628	powershell.exe
1964	powershell.exe
1772	powershell.exe
1860	powershell.exe
1332	powershell.exe
1084	powershell.exe
1596	powershell.exe
1720	powershell.exe
1972	powershell.exe

Drops file in Drivers directory 1 IoCs

Processes:

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsass.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\lsass.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default\\Templates\\winlogon.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default\\Templates\\winlogon.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Internet Explorer\\en-US\\spoolsv.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Internet Explorer\\en-US\\spoolsv.exe\""	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

Drops file in Program Files directory 2 IoCs

Processes:

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

description	ioc	process
File created	C:\Program Files\Internet Explorer\en-US\f3b6ecef712a24	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
File created	C:\Program Files\Internet Explorer\en-US\spoolsv.exe	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	process
2724	schtasks.exe
2504	schtasks.exe
2592	schtasks.exe
2924	schtasks.exe
2492	schtasks.exe
1820	schtasks.exe
2864	schtasks.exe
1568	schtasks.exe
2392	schtasks.exe
2244	schtasks.exe
3032	schtasks.exe
1480	schtasks.exe
2532	schtasks.exe
2464	schtasks.exe
468	schtasks.exe
2860	schtasks.exe
2768	schtasks.exe
2844	schtasks.exe
728	schtasks.exe
2996	schtasks.exe
2980	schtasks.exe
1864	schtasks.exe
2808	schtasks.exe
2576	schtasks.exe
1480	schtasks.exe
2660	schtasks.exe
2084	schtasks.exe
1292	schtasks.exe
2600	schtasks.exe
2152	schtasks.exe
1688	schtasks.exe
1088	schtasks.exe
2836	schtasks.exe
592	schtasks.exe
2224	schtasks.exe
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

pid	process
1136	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
1136	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
1136	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

description pid process

Token: SeDebugPrivilege 1136 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

description	pid	process
Token: SeDebugPrivilege	1136	258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe

C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
"C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:2032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\winlogon.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\en-US\spoolsv.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\lsass.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\services.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\dllhost.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dwm.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\explorer.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:852

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\services.exe'
2⤵
- Command and Scripting Interpreter: PowerShell
PID:1720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eFR6a9mIY7.bat"
2⤵
PID:2096

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
"C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe"
3⤵
PID:1568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:1084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:1972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\en-US\audiodg.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3sv2RA7Y5G.bat"
4⤵
PID:2332

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
5⤵
PID:2352

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe"
5⤵
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Templates\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Templates\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\en-US\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\en-US\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Documents\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Documents\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa2" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa2" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Favorites\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Favorites\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Windows\en-US\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\en-US\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\en-US\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Portable Devices\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Filesize
1.7MB

MD5
6a8dc0383ff9426d3cd10e686ea8af6e

SHA1
bee7864ec1d04b30f37d46da8e7ec5fe240ae3fc

SHA256
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa

SHA512
f0d96a682995d5d8e965aea6efc041ea26d57b50de7e8d8c36d03a5b74c68321574ac955a7be70d1436cdeba94dacee41e0269308e799770aa064a0d7d29ddfa

Download Submit
C:\Recovery\0f2bee02-28a9-11ef-983f-46d84c032646\dwm.exe
Filesize
1.7MB

MD5
e007b3f78e57188672a1e8d3c66fa555

SHA1
4264d60b38c31dc8231622b1b58aa2f5e3e312e7

SHA256
cded48fdb6587ea32158132bf407bcb359907d289646597d7d1fdb1e2a3dc517

SHA512
be7d98b96f60e8a449a0592fec2d59d947bd34eaadef6bd7ddce989012a584464708ca3333ab385411dca6dc62472f331b09ca659f830b8df98914a596d56d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\3sv2RA7Y5G.bat
Filesize
240B

MD5
630b6cdfeb2d384222dc8f1b63d6cbc3

SHA1
2d9c003074966ffeb09be2606958165b98af493b

SHA256
ebe1ac6ed26c619bdedf6fb7929b5536f7f2b899712219b9b45ec072dfe50c27

SHA512
81578963ac7390f01154e8c9608a9cb429b10a97005b3d94ce7231fa19ad16d470c2ad98fd6b3fc185c82d0d78a2bb340ee8bca6b2b377608480c61563f76a83

Download Submit
C:\Users\Admin\AppData\Local\Temp\eFR6a9mIY7.bat
Filesize
267B

MD5
27c25826977cd6a38b949b8feb3ebed1

SHA1
29713100c56f6715d7b8a1f13c105b2d3009680a

SHA256
b0af117270765a82ca262459817a83179cb8d70b1dcb6a01777e30382b9dfea9

SHA512
5ad5b5ab9f81c6cc66bb007c8887bf663e9ef37cb0ddef49c2aa3fab7745a561e7fafd69ad01e67e187226ab22637a5171c80d5eef375b7610c7e509dcd8d69d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
606d6edeb5f15040b61e028eaed2abd8

SHA1
528ed4a3880f58ddf79337d40f1ddc1ff618c74e

SHA256
37914e59d6fbf3b070d4b7b8391d440299af45890e9bf76b8c1d26866301e8c3

SHA512
569234550ca940d79b0a22b99a0c1707b114b255dae35fca3c9b3901372182cb5ab59f34a18a5b33a97682cd6fe11746051b619d4ebc08bb286f33d3f16682bc

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1072-146-0x0000000002490000-0x0000000002498000-memory.dmp

Filesize
32KB

Download
memory/1084-188-0x000000001B130000-0x000000001B412000-memory.dmp

Filesize
2.9MB

Download
memory/1084-189-0x0000000002620000-0x0000000002628000-memory.dmp

Filesize
32KB

Download
memory/1136-7-0x0000000000510000-0x0000000000526000-memory.dmp

Filesize
88KB

Download
memory/1136-0-0x000007FEF5A13000-0x000007FEF5A14000-memory.dmp

Filesize
4KB

Download
memory/1136-17-0x0000000000940000-0x000000000094C000-memory.dmp

Filesize
48KB

Download
memory/1136-15-0x0000000000680000-0x0000000000688000-memory.dmp

Filesize
32KB

Download
memory/1136-14-0x0000000000710000-0x000000000071E000-memory.dmp

Filesize
56KB

Download
memory/1136-20-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/1136-12-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/1136-9-0x0000000000640000-0x0000000000648000-memory.dmp

Filesize
32KB

Download
memory/1136-13-0x0000000000670000-0x000000000067C000-memory.dmp

Filesize
48KB

Download
memory/1136-4-0x0000000000150000-0x000000000016C000-memory.dmp

Filesize
112KB

Download
memory/1136-11-0x0000000000650000-0x000000000065C000-memory.dmp

Filesize
48KB

Download
memory/1136-16-0x0000000000930000-0x000000000093E000-memory.dmp

Filesize
56KB

Download
memory/1136-8-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/1136-152-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/1136-5-0x0000000000270000-0x0000000000278000-memory.dmp

Filesize
32KB

Download
memory/1136-1-0x0000000000E90000-0x0000000001042000-memory.dmp

Filesize
1.7MB

Download
memory/1136-2-0x000007FEF5A10000-0x000007FEF63FC000-memory.dmp

Filesize
9.9MB

Download
memory/1136-6-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/1136-3-0x0000000000140000-0x000000000014E000-memory.dmp

Filesize
56KB

Download
memory/1568-169-0x0000000000FE0000-0x0000000001192000-memory.dmp

Filesize
1.7MB

Download
memory/2032-140-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/2524-203-0x0000000000B30000-0x0000000000CE2000-memory.dmp

Filesize
1.7MB

Download