Overview

overview

10

Static

static

10

040a4ba0cf...bc.exe

windows7-x64

10

040a4ba0cf...bc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 18:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    040a4ba0cfc777c7b3983233cc8ab510783f135166d4d80d83d29080ca65c0bc.exe
  • Size 3.2MB
  • Sample240608-wxf71afa97
  • SHA256 040a4ba0cfc777c7b3983233cc8ab510783f135166d4d80d83d29080ca65c0bc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasionexecutioninfostealerrattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Process spawned unexpected child process 45 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 24 IoCs
    evasiontrojan
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Detects executables packed with SmartAssembly 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 16 IoCs
    evasiontrojan
  • Drops file in Program Files directory 36 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 45 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 24 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\040a4ba0cfc777c7b3983233cc8ab510783f135166d4d80d83d29080ca65c0bc.exe
    "C:\Users\Admin\AppData\Local\Temp\040a4ba0cfc777c7b3983233cc8ab510783f135166d4d80d83d29080ca65c0bc.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3652
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3960
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3708
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4424
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:1504
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3396
    • C:\Program Files\Windows Mail\RuntimeBroker.exe
      "C:\Program Files\Windows Mail\RuntimeBroker.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4532
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e61b919-d787-4289-9e58-2dadda446ee5.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Program Files\Windows Mail\RuntimeBroker.exe
          "C:\Program Files\Windows Mail\RuntimeBroker.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4384
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be9ad97d-9b15-41a0-bfef-e332369864c8.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2828
            • C:\Program Files\Windows Mail\RuntimeBroker.exe
              "C:\Program Files\Windows Mail\RuntimeBroker.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4748
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\334633ab-f973-459f-afaf-5c9b381f9150.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5048
                • C:\Program Files\Windows Mail\RuntimeBroker.exe
                  "C:\Program Files\Windows Mail\RuntimeBroker.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2400
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9dfdf066-7da5-4c63-b6e7-d6db6572d3a6.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4936
                    • C:\Program Files\Windows Mail\RuntimeBroker.exe
                      "C:\Program Files\Windows Mail\RuntimeBroker.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:1600
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c579c361-42e7-4d74-9659-ffca756c325c.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1380
                        • C:\Program Files\Windows Mail\RuntimeBroker.exe
                          "C:\Program Files\Windows Mail\RuntimeBroker.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4428
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\242120d2-c1e9-48a7-8b1e-48bd9c35aa64.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3480
                            • C:\Program Files\Windows Mail\RuntimeBroker.exe
                              "C:\Program Files\Windows Mail\RuntimeBroker.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4868
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a00527d7-6c16-4d55-ae69-c04926d8a6d8.vbs"
                                15⤵
                                  PID:4424
                                • C:\Windows\System32\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc48681e-03b3-4f3c-b8b1-d3dc15bcc444.vbs"
                                  15⤵
                                    PID:1040
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4048df2b-de19-440f-922d-7f2f226b2f9e.vbs"
                                13⤵
                                  PID:3032
                            • C:\Windows\System32\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ced0dcff-609f-4d2d-a65b-02bdf1e7bc5d.vbs"
                              11⤵
                                PID:2276
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c61dce16-246f-466b-a7a0-94b27867f955.vbs"
                            9⤵
                              PID:856
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\efc7b9cc-10e5-427c-8946-b7e54de6669b.vbs"
                          7⤵
                            PID:64
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ca21154-0010-481d-bfca-d0cfdced7f9d.vbs"
                        5⤵
                          PID:952
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\018005b3-f6dd-467e-ac17-5c48a68a319c.vbs"
                      3⤵
                        PID:2544
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellExperiences\SppExtComObj.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4068
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4748
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellExperiences\SppExtComObj.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4036
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Registry.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3528
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2832
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1112
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\taskhostw.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4496
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\taskhostw.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1388
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\taskhostw.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:5108
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\OneDrive\dllhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1372
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\dllhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4812
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\OneDrive\dllhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4360
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\NetHood\wininit.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4028
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\wininit.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1344
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\wininit.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4728
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1716
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4816
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1424
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3140
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2276
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2388
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\3D Objects\explorer.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1704
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1192
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\3D Objects\explorer.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3480
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:468
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1556
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2400
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\spoolsv.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:824
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:948
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\spoolsv.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4740
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\wininit.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2328
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\wininit.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4420
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\wininit.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4044
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\smss.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4312
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4564
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2024
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\Application\Idle.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:368
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:5040
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\Idle.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4084
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\LanguageModels\csrss.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:592
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\csrss.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:4480
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\SKB\LanguageModels\csrss.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2232
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe'" /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:1868
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:2228
                  • C:\Windows\system32\schtasks.exe
                    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\OfficeClickToRun.exe'" /rl HIGHEST /f
                    1⤵
                    • Process spawned unexpected child process
                    • Creates scheduled task(s)
                    PID:3504

                  Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        sihost.exe
                        • Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\sihost.exe
                        • Size 3.2MB
                        • SHA256 6a84b5be35530b6db6fddb6b8bae130472c0b3572428bb0abae87e7b7ead8b58
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        fontdrvhost.exe
                        • Path C:\Program Files (x86)\Windows Mail\fontdrvhost.exe
                        • Size 3.2MB
                        • SHA256 95bf9e1cf8bbeae640280cd801c4956156f5ba342c0c9a4530fe5486d938d25f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        spoolsv.exe
                        • Path C:\ProgramData\spoolsv.exe
                        • Size 3.2MB
                        • SHA256 21e622c2f3e4ce026163571c6456897580eec6412e153a311eee8fb0dba99da1
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        explorer.exe
                        • Path C:\Users\Admin\3D Objects\explorer.exe
                        • Size 3.2MB
                        • SHA256 a270dd8b74114e8d2945a0d7c1463f75988c875579f4bece970a0f13bd879e50
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        RuntimeBroker.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
                        • Size 1KB
                        • SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
                        • MD5 SHA1 SHA512
                        Submit Download

                        powershell.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        • Size 2KB
                        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
                        • MD5 SHA1 SHA512
                        Submit Download

                        018005b3-f6dd-467e-ac17-5c48a68a319c.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\018005b3-f6dd-467e-ac17-5c48a68a319c.vbs
                        • Size 499B
                        • SHA256 761855d2f9ad3b1a9f2b30d9310904aef9a808908833bcfcd9ca843a2d66e80e
                        • MD5 SHA1 SHA512
                        Submit Download

                        0e61b919-d787-4289-9e58-2dadda446ee5.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\0e61b919-d787-4289-9e58-2dadda446ee5.vbs
                        • Size 723B
                        • SHA256 e97c104a99035e89fd0c41e3d7cf8130b4cb5228db3aaf9edac15eeef32db6a2
                        • MD5 SHA1 SHA512
                        Submit Download

                        242120d2-c1e9-48a7-8b1e-48bd9c35aa64.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\242120d2-c1e9-48a7-8b1e-48bd9c35aa64.vbs
                        • Size 723B
                        • SHA256 65673fece0822b20ba7221ae14fd790d363a27ef7f4d269969eacc90eae53755
                        • MD5 SHA1 SHA512
                        Submit Download

                        334633ab-f973-459f-afaf-5c9b381f9150.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\334633ab-f973-459f-afaf-5c9b381f9150.vbs
                        • Size 723B
                        • SHA256 45887d475f3001faf212d91c0637df3b31ac3a36b2c1f68fc09b754c1e38c9a0
                        • MD5 SHA1 SHA512
                        Submit Download

                        9dfdf066-7da5-4c63-b6e7-d6db6572d3a6.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\9dfdf066-7da5-4c63-b6e7-d6db6572d3a6.vbs
                        • Size 723B
                        • SHA256 8783359e7a6ca586182b72474ec90f465b2b48fa9fd04995f45bee23b69cf4d2
                        • MD5 SHA1 SHA512
                        Submit Download

                        __PSScriptPolicyTest_ippr4nn2.dsb.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ippr4nn2.dsb.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512
                        Submit Download

                        a00527d7-6c16-4d55-ae69-c04926d8a6d8.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\a00527d7-6c16-4d55-ae69-c04926d8a6d8.vbs
                        • Size 723B
                        • SHA256 f84ffc3dc3a7af1db61924407d49448ef4a07db3f4973fd15c1745f1697bfe90
                        • MD5 SHA1 SHA512
                        Submit Download

                        be9ad97d-9b15-41a0-bfef-e332369864c8.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\be9ad97d-9b15-41a0-bfef-e332369864c8.vbs
                        • Size 723B
                        • SHA256 d1599375bd0804d11cd51d6761a2413f1415c8b705e96594473582954f0f1841
                        • MD5 SHA1 SHA512
                        Submit Download

                        c579c361-42e7-4d74-9659-ffca756c325c.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\c579c361-42e7-4d74-9659-ffca756c325c.vbs
                        • Size 723B
                        • SHA256 d922f99dca73995c137d397e8d79cc9122d103147f382d16bf4794026c63bac3
                        • MD5 SHA1 SHA512
                        Submit Download

                        wininit.exe
                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\wininit.exe
                        • Size 3.2MB
                        • SHA256 040a4ba0cfc777c7b3983233cc8ab510783f135166d4d80d83d29080ca65c0bc
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        smss.exe
                        • Path C:\Users\Public\Music\smss.exe
                        • Size 3.2MB
                        • SHA256 13b625cb027f8cc6448dbaab9b02749fb37575263fb32149973e69c5ac8f948a
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        csrss.exe
                        • Path C:\Windows\SKB\LanguageModels\csrss.exe
                        • Size 3.2MB
                        • SHA256 ef7bab954f1a90a7d8bfad91f73ad66aecf43925f9ba514ab2611d2e16c091e0
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        memory/1104-17-0x000000001BA30000-0x000000001BA3C000-memory.dmp
                        Download

                        memory/1104-403-0x00007FFF8D2A0000-0x00007FFF8DD61000-memory.dmp
                        Download

                        memory/1104-27-0x000000001B9D0000-0x000000001B9DE000-memory.dmp
                        Download

                        memory/1104-26-0x000000001B9C0000-0x000000001B9CA000-memory.dmp
                        Download

                        memory/1104-31-0x000000001BA10000-0x000000001BA18000-memory.dmp
                        Download

                        memory/1104-33-0x000000001BA20000-0x000000001BA2A000-memory.dmp
                        Download

                        memory/1104-34-0x000000001BC80000-0x000000001BC8C000-memory.dmp
                        Download

                        memory/1104-35-0x00007FFF8D2A0000-0x00007FFF8DD61000-memory.dmp
                        Download

                        memory/1104-30-0x000000001BA00000-0x000000001BA0C000-memory.dmp
                        Download

                        memory/1104-32-0x00007FFF8D2A0000-0x00007FFF8DD61000-memory.dmp
                        Download

                        memory/1104-29-0x000000001B9F0000-0x000000001B9FE000-memory.dmp
                        Download

                        memory/1104-25-0x000000001B9B0000-0x000000001B9B8000-memory.dmp
                        Download

                        memory/1104-23-0x000000001B990000-0x000000001B99C000-memory.dmp
                        Download

                        memory/1104-24-0x000000001B9A0000-0x000000001B9AC000-memory.dmp
                        Download

                        memory/1104-22-0x000000001B980000-0x000000001B98C000-memory.dmp
                        Download

                        memory/1104-21-0x000000001B970000-0x000000001B97C000-memory.dmp
                        Download

                        memory/1104-20-0x000000001BF70000-0x000000001C498000-memory.dmp
                        Download

                        memory/1104-1-0x0000000000260000-0x000000000059C000-memory.dmp
                        Download

                        memory/1104-16-0x000000001B920000-0x000000001B928000-memory.dmp
                        Download

                        memory/1104-28-0x000000001B9E0000-0x000000001B9E8000-memory.dmp
                        Download

                        memory/1104-18-0x000000001B930000-0x000000001B938000-memory.dmp
                        Download

                        memory/1104-19-0x000000001B940000-0x000000001B952000-memory.dmp
                        Download

                        memory/1104-0-0x00007FFF8D2A3000-0x00007FFF8D2A5000-memory.dmp
                        Download

                        memory/1104-15-0x000000001B910000-0x000000001B91C000-memory.dmp
                        Download

                        memory/1104-14-0x000000001B8C0000-0x000000001B916000-memory.dmp
                        Download

                        memory/1104-13-0x000000001B8B0000-0x000000001B8BA000-memory.dmp
                        Download

                        memory/1104-10-0x000000001B820000-0x000000001B836000-memory.dmp
                        Download

                        memory/1104-12-0x000000001B850000-0x000000001B860000-memory.dmp
                        Download

                        memory/1104-11-0x000000001B840000-0x000000001B848000-memory.dmp
                        Download

                        memory/1104-7-0x000000001B860000-0x000000001B8B0000-memory.dmp
                        Download

                        memory/1104-8-0x000000001B1F0000-0x000000001B1F8000-memory.dmp
                        Download

                        memory/1104-9-0x000000001B810000-0x000000001B820000-memory.dmp
                        Download

                        memory/1104-6-0x000000001B1D0000-0x000000001B1EC000-memory.dmp
                        Download

                        memory/1104-5-0x000000001B1C0000-0x000000001B1C8000-memory.dmp
                        Download

                        memory/1104-4-0x000000001B1B0000-0x000000001B1BE000-memory.dmp
                        Download

                        memory/1104-2-0x00007FFF8D2A0000-0x00007FFF8DD61000-memory.dmp
                        Download

                        memory/1104-3-0x0000000002720000-0x000000000272E000-memory.dmp
                        Download

                        memory/1600-472-0x000000001D7F0000-0x000000001D802000-memory.dmp
                        Download

                        memory/4852-302-0x00000131624C0000-0x00000131624E2000-memory.dmp
                        Download