dcrat | 78ef720a295f0a09aa9c02eddc8f7ebdcfa5dc6355a3732b9dd5ab3e0d20e6c2

Analysis

max time kernel
37s
max time network
35s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
Size

1.9MB
MD5

39dac645fb473abe88ebf3bb28e360b0
SHA1

e2b8488b672d5765b404dc44f1ee6e0e005a2932
SHA256

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7
SHA512

1f6d438429d1e7268fd9e757e2ae2af3a4418a700059cd69c712ed6dd0304bafc76400334a1a44fb45683908ec39bbfacfc2bf83e15ff2221de087e168dce6e2
SSDEEP

24576:dCNqlizzN4yGwrXLoamoWvXa7IwfvoMODACOfCW2lPy1A9Qsy2lPy1A9QnG:UwgKyGwHthIwf7gOqW2wKQsy2wKQnG

Score

10^/10

dcrat evasion infostealer rat themida trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	360	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	296	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1808	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1136	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	608	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1908	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	572	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	572	schtasks.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1056-54-0x0000000000F00000-0x00000000010F6000-memory.dmp	dcrat
C:\Program Files\Reference Assemblies\Microsoft\explorer.exe	dcrat
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RCX2225.tmp	dcrat
behavioral1/memory/1056-227-0x0000000000C20000-0x0000000000CA0000-memory.dmp	dcrat
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe	dcrat
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe	dcrat

Executes dropped EXE 1 IoCs

Processes:

lsass.exe

pid process

2368 lsass.exe

pid	process
2368	lsass.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1056-54-0x0000000000F00000-0x00000000010F6000-memory.dmp	themida
C:\Program Files\Reference Assemblies\Microsoft\explorer.exe	themida
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RCX2225.tmp	themida
behavioral1/memory/1056-227-0x0000000000C20000-0x0000000000CA0000-memory.dmp	themida
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe	themida
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

Drops file in Program Files directory 20 IoCs

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

description	ioc	process
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\explorer.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\explorer.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\75a57c1bdf437c	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\explorer.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCX34A3.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCX301F.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\lsass.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files (x86)\Google\CrashReports\6203df4a6bafc7	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\explorer.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\7a0fd90576e088	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX26F6.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\RCX2707.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\WMIADAP.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCX34B3.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\WMIADAP.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files (x86)\Google\CrashReports\lsass.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\7a0fd90576e088	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCX2FFF.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCX4B58.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ja-JP\RCX4B68.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

Drops file in Windows directory 5 IoCs

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

description	ioc	process
File opened for modification	C:\Windows\Web\Wallpaper\wininit.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Windows\Web\Wallpaper\wininit.exe	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File created	C:\Windows\Web\Wallpaper\56085415360792	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Windows\Web\Wallpaper\RCX2B7B.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
File opened for modification	C:\Windows\Web\Wallpaper\RCX2B8B.tmp	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
1488	schtasks.exe
916	schtasks.exe
1560	schtasks.exe
1596	schtasks.exe
1516	schtasks.exe
296	schtasks.exe
1852	schtasks.exe
608	schtasks.exe
1548	schtasks.exe
1808	schtasks.exe
1820	schtasks.exe
1672	schtasks.exe
1792	schtasks.exe
2036	schtasks.exe
1632	schtasks.exe
1136	schtasks.exe
1892	schtasks.exe
1872	schtasks.exe
360	schtasks.exe
1192	schtasks.exe
1476	schtasks.exe
1940	schtasks.exe
976	schtasks.exe
788	schtasks.exe
1716	schtasks.exe
1484	schtasks.exe
892	schtasks.exe
548	schtasks.exe
1600	schtasks.exe
1908	schtasks.exe
1752	schtasks.exe
1956	schtasks.exe
1336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
112	powershell.exe
1476	powershell.exe
1480	powershell.exe
608	powershell.exe
1484	powershell.exe
524	powershell.exe
1764	powershell.exe
1952	powershell.exe
1192	powershell.exe
788	powershell.exe
1312	powershell.exe
1752	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exelsass.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
Token: SeDebugPrivilege	2368	lsass.exe
Token: SeDebugPrivilege	112	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	524	powershell.exe
Token: SeDebugPrivilege	1764	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeDebugPrivilege	1312	powershell.exe
Token: SeDebugPrivilege	1752	powershell.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

description	pid	process	target process
PID 1056 wrote to memory of 1752	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1752	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1752	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 608	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 608	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 608	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1952	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1952	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1952	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1312	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1312	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1312	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 112	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 112	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 112	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1484	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1484	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1484	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 524	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 524	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 524	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 788	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 788	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 788	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1480	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1480	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1480	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1764	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1764	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1764	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1476	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1476	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1476	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1192	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1192	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 1192	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	powershell.exe
PID 1056 wrote to memory of 2368	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	lsass.exe
PID 1056 wrote to memory of 2368	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	lsass.exe
PID 1056 wrote to memory of 2368	1056	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe	lsass.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe
"C:\Users\Admin\AppData\Local\Temp\7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\WMIADAP.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\WMIADAP.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\smss.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\csrss.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\ja-JP\explorer.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\WmiPrvSE.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\explorer.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\lsass.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\Wallpaper\wininit.exe'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe
"C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Windows\Web\Wallpaper\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Web\Wallpaper\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\CrashReports\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\CrashReports\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e77" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7" /sc ONLOGON /tr "'C:\MSOCache\All Users\7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e77" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\48dcfae2-b1a4-11ed-9bb2-cee1c2fbb193\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\RCX2225.tmp
Filesize
1.9MB

MD5
a96934f049e3249c508d90060edc994f

SHA1
b1e466068ec97a87ae678230eac198955dfa57a4

SHA256
115cd7e94b7d91c51d1f3e10762295b74ed14410edd9269efbb4b00789828556

SHA512
8d2623a4b28811fdc5662b7f995d01e7df954af00c7897adefc1ecb6c3ae386e77f9cf6e00a02a1f217bff64bee18af10f2d94ea1575f0b42543118c23e32562

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe
Filesize
1.9MB

MD5
39dac645fb473abe88ebf3bb28e360b0

SHA1
e2b8488b672d5765b404dc44f1ee6e0e005a2932

SHA256
7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7

SHA512
1f6d438429d1e7268fd9e757e2ae2af3a4418a700059cd69c712ed6dd0304bafc76400334a1a44fb45683908ec39bbfacfc2bf83e15ff2221de087e168dce6e2

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\lsass.exe
Filesize
1.9MB

MD5
39dac645fb473abe88ebf3bb28e360b0

SHA1
e2b8488b672d5765b404dc44f1ee6e0e005a2932

SHA256
7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7

SHA512
1f6d438429d1e7268fd9e757e2ae2af3a4418a700059cd69c712ed6dd0304bafc76400334a1a44fb45683908ec39bbfacfc2bf83e15ff2221de087e168dce6e2

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\explorer.exe
Filesize
1.9MB

MD5
39dac645fb473abe88ebf3bb28e360b0

SHA1
e2b8488b672d5765b404dc44f1ee6e0e005a2932

SHA256
7e65b2962bce542404085d763315b31a8d766410fa7bceeafb21f168024dd3e7

SHA512
1f6d438429d1e7268fd9e757e2ae2af3a4418a700059cd69c712ed6dd0304bafc76400334a1a44fb45683908ec39bbfacfc2bf83e15ff2221de087e168dce6e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JYG398R9GXTKYFHNPSQX.temp
Filesize
7KB

MD5
42ad806f6f54e53ef0f2d2c3ec09c8b8

SHA1
7568ec381917d5d5a49645bf9017b764cdbce25a

SHA256
ebfbab024b70bbe2d031272700defc6f4fbac6a1df5ec6fb4cadb191aca95ed9

SHA512
91db7ad34d3d9ce225e8be099534efa049321753c4d739fca1fa5606fbbb2893d60ea78e30559f8d3ba18b208b777540677b969ccaf1b89141e3f2abf08c2951

Download Submit
memory/112-290-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/112-330-0x00000000028EB000-0x0000000002922000-memory.dmp

Filesize
220KB

Download
memory/112-314-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/112-302-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/112-301-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/524-305-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/524-320-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/524-304-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/524-328-0x000000000297B000-0x00000000029B2000-memory.dmp

Filesize
220KB

Download
memory/608-292-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/608-291-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/608-329-0x000000000243B000-0x0000000002472000-memory.dmp

Filesize
220KB

Download
memory/608-315-0x0000000002430000-0x00000000024B0000-memory.dmp

Filesize
512KB

Download
memory/788-323-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/788-308-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/788-309-0x0000000002560000-0x00000000025E0000-memory.dmp

Filesize
512KB

Download
memory/788-337-0x000000000256B000-0x00000000025A2000-memory.dmp

Filesize
220KB

Download
memory/1056-66-0x000000001BC10000-0x000000001BC1C000-memory.dmp

Filesize
48KB

Download
memory/1056-62-0x000000001AE90000-0x000000001AE9C000-memory.dmp

Filesize
48KB

Download
memory/1056-69-0x0000000000C20000-0x0000000000CA0000-memory.dmp

Filesize
512KB

Download
memory/1056-55-0x00000000005D0000-0x00000000005EC000-memory.dmp

Filesize
112KB

Download
memory/1056-65-0x000000001BC00000-0x000000001BC0E000-memory.dmp

Filesize
56KB

Download
memory/1056-54-0x0000000000F00000-0x00000000010F6000-memory.dmp

Filesize
2.0MB

Download
memory/1056-64-0x000000001BA30000-0x000000001BA38000-memory.dmp

Filesize
32KB

Download
memory/1056-56-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/1056-57-0x000000001AE50000-0x000000001AE66000-memory.dmp

Filesize
88KB

Download
memory/1056-58-0x0000000000A30000-0x0000000000A42000-memory.dmp

Filesize
72KB

Download
memory/1056-63-0x000000001AEA0000-0x000000001AEB2000-memory.dmp

Filesize
72KB

Download
memory/1056-227-0x0000000000C20000-0x0000000000CA0000-memory.dmp

Filesize
512KB

Download
memory/1056-59-0x000000001AE70000-0x000000001AE80000-memory.dmp

Filesize
64KB

Download
memory/1056-61-0x000000001AE80000-0x000000001AE8C000-memory.dmp

Filesize
48KB

Download
memory/1056-60-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/1192-303-0x00000000027A0000-0x0000000002820000-memory.dmp

Filesize
512KB

Download
memory/1192-326-0x00000000027A0000-0x0000000002820000-memory.dmp

Filesize
512KB

Download
memory/1192-332-0x00000000027AB000-0x00000000027E2000-memory.dmp

Filesize
220KB

Download
memory/1312-327-0x000000000252B000-0x0000000002562000-memory.dmp

Filesize
220KB

Download
memory/1312-298-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1312-319-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1312-296-0x0000000002520000-0x00000000025A0000-memory.dmp

Filesize
512KB

Download
memory/1476-318-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1476-310-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1476-331-0x00000000028BB000-0x00000000028F2000-memory.dmp

Filesize
220KB

Download
memory/1476-313-0x00000000028B0000-0x0000000002930000-memory.dmp

Filesize
512KB

Download
memory/1480-306-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/1480-334-0x000000000283B000-0x0000000002872000-memory.dmp

Filesize
220KB

Download
memory/1480-316-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/1480-307-0x0000000002830000-0x00000000028B0000-memory.dmp

Filesize
512KB

Download
memory/1484-300-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/1484-295-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/1484-333-0x00000000029AB000-0x00000000029E2000-memory.dmp

Filesize
220KB

Download
memory/1484-317-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/1752-335-0x000000000298B000-0x00000000029C2000-memory.dmp

Filesize
220KB

Download
memory/1752-299-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/1752-297-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/1752-322-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/1764-311-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/1764-325-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/1764-312-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/1764-289-0x000000001B210000-0x000000001B4F2000-memory.dmp

Filesize
2.9MB

Download
memory/1952-294-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/1952-321-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/1952-293-0x0000000002720000-0x00000000027A0000-memory.dmp

Filesize
512KB

Download
memory/1952-336-0x000000000272B000-0x0000000002762000-memory.dmp

Filesize
220KB

Download
memory/2368-324-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads