Overview

overview

10

Static

static

10

0a0a64f3c4...e8.exe

windows7-x64

10

0a0a64f3c4...e8.exe

windows10-2004-x64

10

Resubmissions

12/01/2023, 20:01

230112-yrh6hsae52 10

07/01/2023, 04:41

230107-fa3jqagb8t 10

07/01/2023, 04:21

230107-eynj2acf87 10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2023, 04:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a0a64f3c4fa7d960be983aa0a7d0ce8.exe

  • Size

    3.8MB

  • MD5

    0a0a64f3c4fa7d960be983aa0a7d0ce8

  • SHA1

    b597c7397ecaff7c5c1aa27f5124fc7b8a94e643

  • SHA256

    6d95012691b58c36574d4b1061b07e0a8340909664908e991fad91028777fdd1

  • SHA512

    ef04e3eb8f2b10dae6845b97fa66086c3d02c5508adcd1923a93975c88f1ad0f80f984b563c36c4868276670b1dee9e11ae3c57faf7b0509118d121d920df7d4

  • SSDEEP

    98304:F7b3a0t2TiPhx6Sp+ybfnDA4qo34n1oO:FH3Z8cp+gDZ4n1

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 49 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Process spawned unexpected child process 48 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 32 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 48 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe
    "C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2248
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0a0a64f3c4fa7d960be983aa0a7d0ce8.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2640
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\taskhostw.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2864
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4528
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1676
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\Registry.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3848
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\.NETFramework\040C\System.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4624
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\upfc.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\services.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5012
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1564
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1276
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\services.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1120
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Application Data\RuntimeBroker.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4680
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4432
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\System.exe'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3184
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WAYFjljOjk.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:5372
        • C:\Users\All Users\Desktop\services.exe
          "C:\Users\All Users\Desktop\services.exe"
          3⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks computer location settings
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5892
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a7c8142-69f2-4599-8e4c-78a3187fccff.vbs"
            4⤵
              PID:3004
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f96a65d-6056-4da4-89e7-0bbf7fbc86a2.vbs"
              4⤵
                PID:996
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4484
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4620
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4436
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1656
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4976
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:808
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Recent\taskhostw.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:5096
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\Recent\taskhostw.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4720
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Recent\taskhostw.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1492
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4652
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4612
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WmiPrvSE.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4580
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\SKB\Registry.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1776
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SKB\Registry.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2252
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\SKB\Registry.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4252
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1660
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4224
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4552
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1084
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4656
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4500
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\INF\.NETFramework\040C\System.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1136
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\INF\.NETFramework\040C\System.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1112
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\INF\.NETFramework\040C\System.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4572
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3268
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:876
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\Prefetch\ReadyBoot\upfc.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4856
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\odt\RuntimeBroker.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4752
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:2240
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1268
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\services.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:220
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\services.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1872
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\services.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3988
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4496
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:5100
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:4204
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Desktop\services.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:5088
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\services.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3336
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\services.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:976
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Application Data\RuntimeBroker.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1924
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:476
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3692
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3544
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3372
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\en-US\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:3444
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\System.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:748
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1104
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\System.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Creates scheduled task(s)
          PID:1948
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5200

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          ecceac16628651c18879d836acfcb062

          SHA1

          420502b3e5220a01586c59504e94aa1ee11982c9

          SHA256

          58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

          SHA512

          be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          ecceac16628651c18879d836acfcb062

          SHA1

          420502b3e5220a01586c59504e94aa1ee11982c9

          SHA256

          58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

          SHA512

          be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          e8ce785f8ccc6d202d56fefc59764945

          SHA1

          ca032c62ddc5e0f26d84eff9895eb87f14e15960

          SHA256

          d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

          SHA512

          66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          5f0ddc7f3691c81ee14d17b419ba220d

          SHA1

          f0ef5fde8bab9d17c0b47137e014c91be888ee53

          SHA256

          a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

          SHA512

          2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          3a6bad9528f8e23fb5c77fbd81fa28e8

          SHA1

          f127317c3bc6407f536c0f0600dcbcf1aabfba36

          SHA256

          986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

          SHA512

          846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          aaaac7c68d2b7997ed502c26fd9f65c2

          SHA1

          7c5a3731300d672bf53c43e2f9e951c745f7fbdf

          SHA256

          8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

          SHA512

          c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          aaaac7c68d2b7997ed502c26fd9f65c2

          SHA1

          7c5a3731300d672bf53c43e2f9e951c745f7fbdf

          SHA256

          8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

          SHA512

          c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\5f96a65d-6056-4da4-89e7-0bbf7fbc86a2.vbs
          Filesize

          491B

          MD5

          ee64068297bbe93860db86af6d8ebae2

          SHA1

          1db06ef996a08531235e25204751dc6eb5b6d05e

          SHA256

          39ec08b47ad14d11c65749b2033a59ae2e31a2f1cc6b67f02bf02084e483e4d3

          SHA512

          1d8e01b9437ed3ed77ae82c15c84e00cf0c47e86899c5d2a86fa6b8597f4d457d273df772239371a379f178ee42779f67dc83af285b712147ac988e115553f8c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\9a7c8142-69f2-4599-8e4c-78a3187fccff.vbs
          Filesize

          715B

          MD5

          18614fbb8ab9f52dc1bc6373c400c93c

          SHA1

          ec3e8d69312dbd39c8fa14642ac6fc73216c42d7

          SHA256

          98a4913c45cad021b41de91d8aa7361c17fd1604cc1505bd7f352b20555d7c14

          SHA512

          0c2a46d71ebb8432a71385dbe5c42e7d1a3a3b40e859f9e5954ae49321db4eb88acd84e2fefd364b2d5dd463888baa56cbbeae4a9f24e57153c7a87f2e1e9354

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\WAYFjljOjk.bat
          Filesize

          204B

          MD5

          09bc6f236ebbf6d5b794ce788cd4ae7b

          SHA1

          dcadc226a0a84bca2ce3af19ffe8a6c94b53ff74

          SHA256

          a8992b7942c730a630ae4defff09aaaa3ea898028ccf66322f8b82d5d127b959

          SHA512

          0f78ae6f8de1758704fe8b7be5faeda2043f3f138d0b4ea250cf0c4cd76d5e29f3d6caa385e97281119f8d01c5a764c93b3607a6b815f4e798a0adb62cfd2145

          Download Submit

        • C:\Users\All Users\Desktop\services.exe
          Filesize

          3.8MB

          MD5

          03b76d5b0761c7c9e09491a7aa8ac926

          SHA1

          0a328b78ea03445c401c7a2dced42c538baf2f6a

          SHA256

          31dffaee3196287c369a0e07ec35b9ecc95262ae9a4ef9c4b8a407312278a7ee

          SHA512

          3b8748d10f3981bc553b3b1a962cb33920a0a9a268b10c5c9638301ca22f44f3a0b9ce8490b68ee864c2347e65b6299aecaccda2df3cbc0e0f75d3584babc336

          Download Submit

        • C:\Users\Public\Desktop\services.exe
          Filesize

          3.8MB

          MD5

          03b76d5b0761c7c9e09491a7aa8ac926

          SHA1

          0a328b78ea03445c401c7a2dced42c538baf2f6a

          SHA256

          31dffaee3196287c369a0e07ec35b9ecc95262ae9a4ef9c4b8a407312278a7ee

          SHA512

          3b8748d10f3981bc553b3b1a962cb33920a0a9a268b10c5c9638301ca22f44f3a0b9ce8490b68ee864c2347e65b6299aecaccda2df3cbc0e0f75d3584babc336

          Download Submit

        • memory/744-162-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/744-197-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1120-208-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1120-166-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1132-195-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1132-174-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1276-191-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1276-173-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1564-196-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1564-164-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1676-180-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1676-155-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2248-133-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2248-134-0x000000001BCA0000-0x000000001BCF0000-memory.dmp

          Filesize

          320KB

          Download

        • memory/2248-136-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2248-135-0x000000001D960000-0x000000001DE88000-memory.dmp

          Filesize

          5.2MB

          Download

        • memory/2248-161-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2248-132-0x0000000000CC0000-0x000000000108A000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/2640-187-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2640-156-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2864-186-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2864-158-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3184-170-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3184-205-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3796-157-0x000001437D930000-0x000001437D952000-memory.dmp

          Filesize

          136KB

          Download

        • memory/3796-176-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3796-152-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3848-172-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3848-185-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4432-169-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4432-203-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4484-199-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4484-175-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4528-184-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4528-160-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4624-192-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4624-163-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4680-167-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4680-209-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/5012-165-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/5012-204-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/5892-213-0x0000000000600000-0x00000000009CA000-memory.dmp

          Filesize

          3.8MB

          Download

        • memory/5892-214-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/5892-219-0x00007FF905BB0000-0x00007FF906671000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/5892-220-0x000000001FAF0000-0x000000001FCB2000-memory.dmp

          Filesize

          1.8MB

          Download