dcrat | 1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3

General

Target

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
Size

4.9MB
MD5

37aa26e9208b0930fb1068d718d2e32e
SHA1

89a3c8a1f0288b0cb6797d0e17ddaa7961d65acc
SHA256

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3
SHA512

5c2645f16f8a0ba54c31128fc5f0f8b7b5e81ce208f42798904d39fd6de08e6f1378f9665e70412f5ba6b575dd90ca90191a8cbcdbf24511337a0ecf422d7fc8
SSDEEP

49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	360	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	512	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	544	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	432	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1128	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1916	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	932	1916	schtasks.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1720-55-0x000000001B460000-0x000000001B58E000-memory.dmp	dcrat

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

Drops file in Program Files directory 16 IoCs

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\Templates\lsass.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files\Google\Chrome\explorer.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\RCX4786.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\RCX60A4.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Program Files\DVD Maker\services.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files\Google\Chrome\RCX3F2B.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\lsass.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Program Files\DVD Maker\c5b4cb5e9653cc	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Program Files\Google\Chrome\explorer.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Program Files\Google\Chrome\7a0fd90576e088	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\sppsvc.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\6203df4a6bafc7	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files\DVD Maker\services.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Skins\sppsvc.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\0a1fd5f707cd16	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Program Files\DVD Maker\RCX210E.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

Drops file in Windows directory 17 IoCs

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description	ioc	process
File created	C:\Windows\Media\Cityscape\csrss.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\Web\Wallpaper\Architecture\RCX7FF.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\PLA\Reports\fr-FR\WMIADAP.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\es-ES\RCX584A.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\es-ES\dwm.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\servicing\it-IT\Idle.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\Media\Cityscape\886983d96e3d3e	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\PLA\Reports\fr-FR\WMIADAP.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\es-ES\6cb0b6c459d5d3	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\Media\Cityscape\RCX36C2.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\Media\Cityscape\csrss.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\Web\Wallpaper\Architecture\sppsvc.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\Web\Wallpaper\Architecture\sppsvc.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\Web\Wallpaper\Architecture\0a1fd5f707cd16	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\es-ES\dwm.exe	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File opened for modification	C:\Windows\PLA\Reports\fr-FR\RCX4FE0.tmp	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
File created	C:\Windows\PLA\Reports\fr-FR\75a57c1bdf437c	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
360	schtasks.exe
1620	schtasks.exe
1792	schtasks.exe
1044	schtasks.exe
1516	schtasks.exe
1300	schtasks.exe
1564	schtasks.exe
932	schtasks.exe
1772	schtasks.exe
1920	schtasks.exe
932	schtasks.exe
1644	schtasks.exe
544	schtasks.exe
1128	schtasks.exe
1624	schtasks.exe
1584	schtasks.exe
1016	schtasks.exe
1472	schtasks.exe
1404	schtasks.exe
1396	schtasks.exe
1984	schtasks.exe
1952	schtasks.exe
1956	schtasks.exe
1576	schtasks.exe
2044	schtasks.exe
592	schtasks.exe
512	schtasks.exe
1960	schtasks.exe
1640	schtasks.exe
1888	schtasks.exe
1484	schtasks.exe
1828	schtasks.exe
432	schtasks.exe
1068	schtasks.exe
1856	schtasks.exe
2012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

pid process

1720 1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description pid process

Token: SeDebugPrivilege 1720 1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

pid	process
1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description	pid	process
Token: SeDebugPrivilege	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description	pid	process	target process
PID 1720 wrote to memory of 1972	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1972	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1972	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1324	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1324	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1324	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1540	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1540	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1540	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1528	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1528	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1528	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1736	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1736	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1736	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1520	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1520	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1520	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1308	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1308	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1308	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 592	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 592	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 592	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1856	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1856	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1856	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 840	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 840	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 840	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1080	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1080	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1080	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1804	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1804	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe
PID 1720 wrote to memory of 1804	1720	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe	powershell.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe

C:\Users\Admin\AppData\Local\Temp\1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe
"C:\Users\Admin\AppData\Local\Temp\1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
PID:1972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
PID:1324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
PID:1540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
2⤵
PID:1528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
PID:1736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
PID:1520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
PID:1308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
PID:592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
PID:1856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
PID:840

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
PID:1080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Wallpaper\Architecture\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Architecture\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Web\Wallpaper\Architecture\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Start Menu\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Start Menu\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\DVD Maker\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\DVD Maker\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\Cityscape\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Media\Cityscape\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Media\Cityscape\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Reports\fr-FR\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Windows\PLA\Reports\fr-FR\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\Reports\fr-FR\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\es-ES\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Office\Templates\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Templates\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\Templates\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:932

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Bypass User Account Control

1

T1088

Scheduled Task

1

T1053

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
1cec5815fc17f874c042e17094c42eba

SHA1
94e76434beecd751f9d4a2bda16b4e64da228a2e

SHA256
492a448b083ccdf8784f41876baf5f6cdfcea8d726b1696612d61b78798f5ed7

SHA512
91d9e60c8e3527f9beb6b48319ea521b1a96492dbcdc7dc268bcc110e85b4a199544b0b8ba17641b12d1c04208aa30240291e3e291324fb0d8a61600f27fd0c5

Download Submit
memory/592-109-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/592-125-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/592-77-0x0000000000000000-mapping.dmp

Download
memory/592-119-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/840-123-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/840-105-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/840-128-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/840-80-0x0000000000000000-mapping.dmp

Download
memory/1080-107-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/1080-116-0x00000000028D4000-0x00000000028D7000-memory.dmp

Filesize
12KB

Download
memory/1080-112-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1080-83-0x0000000000000000-mapping.dmp

Download
memory/1308-108-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/1308-76-0x0000000000000000-mapping.dmp

Download
memory/1308-120-0x0000000002644000-0x0000000002647000-memory.dmp

Filesize
12KB

Download
memory/1308-126-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1324-122-0x0000000002514000-0x0000000002517000-memory.dmp

Filesize
12KB

Download
memory/1324-86-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/1324-70-0x0000000000000000-mapping.dmp

Download
memory/1324-129-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1520-106-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/1520-74-0x0000000000000000-mapping.dmp

Download
memory/1520-114-0x0000000002290000-0x0000000002310000-memory.dmp

Filesize
512KB

Download
memory/1520-130-0x0000000002290000-0x0000000002310000-memory.dmp

Filesize
512KB

Download
memory/1520-110-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1528-72-0x0000000000000000-mapping.dmp

Download
memory/1528-104-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/1528-115-0x00000000024F4000-0x00000000024F7000-memory.dmp

Filesize
12KB

Download
memory/1528-111-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1540-71-0x0000000000000000-mapping.dmp

Download
memory/1720-54-0x0000000000CF0000-0x00000000011E4000-memory.dmp

Filesize
5.0MB

Download
memory/1720-68-0x00000000004F0000-0x00000000004FC000-memory.dmp

Filesize
48KB

Download
memory/1720-58-0x0000000000430000-0x0000000000440000-memory.dmp

Filesize
64KB

Download
memory/1720-56-0x00000000002F0000-0x000000000030C000-memory.dmp

Filesize
112KB

Download
memory/1720-63-0x00000000004A0000-0x00000000004AA000-memory.dmp

Filesize
40KB

Download
memory/1720-59-0x0000000000440000-0x0000000000456000-memory.dmp

Filesize
88KB

Download
memory/1720-60-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/1720-57-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/1720-67-0x00000000004E0000-0x00000000004E8000-memory.dmp

Filesize
32KB

Download
memory/1720-55-0x000000001B460000-0x000000001B58E000-memory.dmp

Filesize
1.2MB

Download
memory/1720-66-0x00000000004D0000-0x00000000004D8000-memory.dmp

Filesize
32KB

Download
memory/1720-61-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/1720-62-0x0000000000480000-0x0000000000492000-memory.dmp

Filesize
72KB

Download
memory/1720-65-0x00000000004C0000-0x00000000004CE000-memory.dmp

Filesize
56KB

Download
memory/1720-64-0x00000000004B0000-0x00000000004BE000-memory.dmp

Filesize
56KB

Download
memory/1736-118-0x0000000002664000-0x0000000002667000-memory.dmp

Filesize
12KB

Download
memory/1736-124-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1736-103-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/1736-73-0x0000000000000000-mapping.dmp

Download
memory/1804-84-0x0000000000000000-mapping.dmp

Download
memory/1856-113-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1856-117-0x0000000002814000-0x0000000002817000-memory.dmp

Filesize
12KB

Download
memory/1856-78-0x0000000000000000-mapping.dmp

Download
memory/1856-102-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download
memory/1972-69-0x0000000000000000-mapping.dmp

Download
memory/1972-75-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download
memory/1972-121-0x0000000002734000-0x0000000002737000-memory.dmp

Filesize
12KB

Download
memory/1972-127-0x000007FEEA100000-0x000007FEEAC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1972-90-0x000007FEEB310000-0x000007FEEBD33000-memory.dmp

Filesize
10.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads