dcrat | 7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
Size 3.0MB
Sample240628-3hlmhaveqf
SHA256 7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186
MD5 928ecce66fd72ab40f23f14a840515b0
SHA1 adbe03efb92018024bdc0adf824dc64005937522
SHA512 3c2d2f4bd31e7a15cf64b667bf63cebd3e934ba05aa264570136b0042276cc47f278190b1b4d930fdba2daea83fc1993f943419b216d130c11d3389866f53213
SSDEEP 49152:hIL9erMYbvYZgn9U0qGmaEY9zvHPH+LhnTJLyYg/Hv9QfokM9JaQplq:KUrMMign9UhG6YeLhnYYg/tkOpf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4724	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3820	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3952	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	616	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2184	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4936	4720	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3092	4720	schtasks.exe	83

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4708-1-0x00000000009A0000-0x0000000000CB2000-memory.dmp	dcrat
behavioral2/files/0x00070000000233fc-39.dat	dcrat

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe

Executes dropped EXE 11 IoCs

pid	Process
1604	RuntimeBroker.exe
1816	RuntimeBroker.exe
220	RuntimeBroker.exe
2508	RuntimeBroker.exe
4604	RuntimeBroker.exe
5080	RuntimeBroker.exe
1632	RuntimeBroker.exe
1292	RuntimeBroker.exe
2184	RuntimeBroker.exe
4368	RuntimeBroker.exe
856	RuntimeBroker.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\66fc9ff0ee96c2	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\wininit.exe	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\wininit.exe	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\56085415360792	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\f3b6ecef712a24	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Program Files\Internet Explorer\sihost.exe	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ShellExperiences\RuntimeBroker.exe	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Windows\ShellExperiences\9e8d7a4ca61bd9	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Windows\schemas\AvailableNetwork\fontdrvhost.exe	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
File created	C:\Windows\schemas\AvailableNetwork\5b884080fd4f94	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4880	schtasks.exe
2908	schtasks.exe
1996	schtasks.exe
1008	schtasks.exe
1732	schtasks.exe
408	schtasks.exe
4724	schtasks.exe
4564	schtasks.exe
1984	schtasks.exe
4324	schtasks.exe
616	schtasks.exe
4928	schtasks.exe
3820	schtasks.exe
2972	schtasks.exe
368	schtasks.exe
4280	schtasks.exe
1660	schtasks.exe
3228	schtasks.exe
3600	schtasks.exe
4552	schtasks.exe
1448	schtasks.exe
4304	schtasks.exe
1284	schtasks.exe
4276	schtasks.exe
1656	schtasks.exe
4864	schtasks.exe
3952	schtasks.exe
2184	schtasks.exe
4936	schtasks.exe
3092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
1604	RuntimeBroker.exe
1816	RuntimeBroker.exe
220	RuntimeBroker.exe
2508	RuntimeBroker.exe
4604	RuntimeBroker.exe
5080	RuntimeBroker.exe
1632	RuntimeBroker.exe
1292	RuntimeBroker.exe
2184	RuntimeBroker.exe
4368	RuntimeBroker.exe
856	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
Token: SeDebugPrivilege	1604	RuntimeBroker.exe
Token: SeDebugPrivilege	1816	RuntimeBroker.exe
Token: SeDebugPrivilege	220	RuntimeBroker.exe
Token: SeDebugPrivilege	2508	RuntimeBroker.exe
Token: SeDebugPrivilege	4604	RuntimeBroker.exe
Token: SeDebugPrivilege	5080	RuntimeBroker.exe
Token: SeDebugPrivilege	1632	RuntimeBroker.exe
Token: SeDebugPrivilege	1292	RuntimeBroker.exe
Token: SeDebugPrivilege	2184	RuntimeBroker.exe
Token: SeDebugPrivilege	4368	RuntimeBroker.exe
Token: SeDebugPrivilege	856	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4916	4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe	114
PID 4708 wrote to memory of 4916	4708	7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe	114
PID 4916 wrote to memory of 2768	4916	cmd.exe	116
PID 4916 wrote to memory of 2768	4916	cmd.exe	116
PID 4916 wrote to memory of 1604	4916	cmd.exe	117
PID 4916 wrote to memory of 1604	4916	cmd.exe	117
PID 1604 wrote to memory of 2164	1604	RuntimeBroker.exe	118
PID 1604 wrote to memory of 2164	1604	RuntimeBroker.exe	118
PID 1604 wrote to memory of 2700	1604	RuntimeBroker.exe	119
PID 1604 wrote to memory of 2700	1604	RuntimeBroker.exe	119
PID 2164 wrote to memory of 1816	2164	WScript.exe	120
PID 2164 wrote to memory of 1816	2164	WScript.exe	120
PID 1816 wrote to memory of 1004	1816	RuntimeBroker.exe	122
PID 1816 wrote to memory of 1004	1816	RuntimeBroker.exe	122
PID 1816 wrote to memory of 2776	1816	RuntimeBroker.exe	123
PID 1816 wrote to memory of 2776	1816	RuntimeBroker.exe	123
PID 1004 wrote to memory of 220	1004	WScript.exe	124
PID 1004 wrote to memory of 220	1004	WScript.exe	124
PID 220 wrote to memory of 3068	220	RuntimeBroker.exe	125
PID 220 wrote to memory of 3068	220	RuntimeBroker.exe	125
PID 220 wrote to memory of 1448	220	RuntimeBroker.exe	126
PID 220 wrote to memory of 1448	220	RuntimeBroker.exe	126
PID 3068 wrote to memory of 2508	3068	WScript.exe	131
PID 3068 wrote to memory of 2508	3068	WScript.exe	131
PID 2508 wrote to memory of 4952	2508	RuntimeBroker.exe	133
PID 2508 wrote to memory of 4952	2508	RuntimeBroker.exe	133
PID 2508 wrote to memory of 3808	2508	RuntimeBroker.exe	134
PID 2508 wrote to memory of 3808	2508	RuntimeBroker.exe	134
PID 4952 wrote to memory of 4604	4952	WScript.exe	135
PID 4952 wrote to memory of 4604	4952	WScript.exe	135
PID 4604 wrote to memory of 896	4604	RuntimeBroker.exe	136
PID 4604 wrote to memory of 896	4604	RuntimeBroker.exe	136
PID 4604 wrote to memory of 3620	4604	RuntimeBroker.exe	137
PID 4604 wrote to memory of 3620	4604	RuntimeBroker.exe	137
PID 896 wrote to memory of 5080	896	WScript.exe	138
PID 896 wrote to memory of 5080	896	WScript.exe	138
PID 5080 wrote to memory of 4140	5080	RuntimeBroker.exe	139
PID 5080 wrote to memory of 4140	5080	RuntimeBroker.exe	139
PID 5080 wrote to memory of 3216	5080	RuntimeBroker.exe	140
PID 5080 wrote to memory of 3216	5080	RuntimeBroker.exe	140
PID 4140 wrote to memory of 1632	4140	WScript.exe	141
PID 4140 wrote to memory of 1632	4140	WScript.exe	141
PID 1632 wrote to memory of 3232	1632	RuntimeBroker.exe	142
PID 1632 wrote to memory of 3232	1632	RuntimeBroker.exe	142
PID 1632 wrote to memory of 940	1632	RuntimeBroker.exe	143
PID 1632 wrote to memory of 940	1632	RuntimeBroker.exe	143
PID 3232 wrote to memory of 1292	3232	WScript.exe	144
PID 3232 wrote to memory of 1292	3232	WScript.exe	144
PID 1292 wrote to memory of 1324	1292	RuntimeBroker.exe	145
PID 1292 wrote to memory of 1324	1292	RuntimeBroker.exe	145
PID 1292 wrote to memory of 400	1292	RuntimeBroker.exe	146
PID 1292 wrote to memory of 400	1292	RuntimeBroker.exe	146
PID 1324 wrote to memory of 2184	1324	WScript.exe	147
PID 1324 wrote to memory of 2184	1324	WScript.exe	147
PID 2184 wrote to memory of 2996	2184	RuntimeBroker.exe	148
PID 2184 wrote to memory of 2996	2184	RuntimeBroker.exe	148
PID 2184 wrote to memory of 1756	2184	RuntimeBroker.exe	149
PID 2184 wrote to memory of 1756	2184	RuntimeBroker.exe	149
PID 2996 wrote to memory of 4368	2996	WScript.exe	150
PID 2996 wrote to memory of 4368	2996	WScript.exe	150
PID 4368 wrote to memory of 4604	4368	RuntimeBroker.exe	151
PID 4368 wrote to memory of 4604	4368	RuntimeBroker.exe	151
PID 4368 wrote to memory of 4524	4368	RuntimeBroker.exe	152
PID 4368 wrote to memory of 4524	4368	RuntimeBroker.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe
"C:\Users\Admin\AppData\Local\Temp\7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QfLJ25UQ42.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2768
- - C:\Windows\ShellExperiences\RuntimeBroker.exe
    "C:\Windows\ShellExperiences\RuntimeBroker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e4b75be-a8d1-43f5-9382-5d423344b407.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1816
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53a3d221-0f88-4295-aac5-32f519e1cc25.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36ffcc67-5e23-47ad-be4b-faeb8e5d95d4.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5fcb8cb5-baa0-47bb-bd2e-38c4574d8098.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7cbccac2-7b5a-4032-bfee-de67945f7e61.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:896
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3deeb706-2f8e-4fc5-98c8-f26f9553739e.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84ba3c55-264d-495c-95c0-f1fee17eb395.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36e87e38-c0ac-46db-873c-bd45409fc62a.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\040802ec-d396-42a8-b59c-f2545d8f7c50.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\973ba832-2520-47d7-9629-af76b5c92604.vbs"
        22⤵
        
        PID:4604
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        
        C:\Windows\ShellExperiences\RuntimeBroker.exe
        23⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9744beb-810b-427b-8303-2831105c7192.vbs"
        22⤵
        
        PID:4524
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5333e6e-8659-4231-8668-f76b93cac294.vbs"
        20⤵
        
        PID:1756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7fdf7531-3672-4773-b96c-20a7ebe508db.vbs"
        18⤵
        
        PID:400
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27f1d85e-6957-4c07-ba64-3f793ac9b258.vbs"
        16⤵
        
        PID:940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a99e752-53ce-49f2-aa66-ddcaac8d5dae.vbs"
        14⤵
        
        PID:3216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bdaf953-450f-4b67-af74-c45556ed7521.vbs"
        12⤵
        
        PID:3620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a69c5e08-1510-4b0d-b55d-c77b590556ba.vbs"
        10⤵
        
        PID:3808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c09c0baf-75ad-4baf-b242-a715819c60f8.vbs"
        8⤵
        
        PID:1448
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f8c9be0-d88e-404e-96c1-e62a2d239370.vbs"
        6⤵
        
        PID:2776
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\916e786d-9062-4697-b12f-cbca4838a8a4.vbs"
      4⤵
      PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\uninstall\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellExperiences\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellExperiences\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\schemas\AvailableNetwork\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\schemas\AvailableNetwork\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
MD5 4a667f150a4d1d02f53a9f24d89d53d1
SHA1 306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA512 4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
MD5 SHA1 SHA512

Submit Download

040802ec-d396-42a8-b59c-f2545d8f7c50.vbs

Path C:\Users\Admin\AppData\Local\Temp\040802ec-d396-42a8-b59c-f2545d8f7c50.vbs
Size 721B
SHA256 0ed68d9a876a5b1f2f4171487c4b68f324bebe67fcf7a24832b02fce54c81c6b
MD5 8e719d34aba1fba01a2a617ea3e186bf
SHA1 12c2458631b6e7307228457ec8c613672dae771a
SHA512 25b2e349785e5e1bd59e78ca3a6f47c9fe444232c11da2472f269cf5955e8c6d5f6d25f9b60024b4a843b5b24726484a19bd9ffe026675f795ea68c196116c43
MD5 SHA1 SHA512

Submit Download

0e4b75be-a8d1-43f5-9382-5d423344b407.vbs

Path C:\Users\Admin\AppData\Local\Temp\0e4b75be-a8d1-43f5-9382-5d423344b407.vbs
Size 721B
SHA256 8df96f1bc34c1d7f2b75300d12bd4cd8b100076dadb05ec6619ab961dcf795b1
MD5 e94c1ca6defddb2469a74ccebae257be
SHA1 430146cf9edfdfef75db9431d78eca2b4b45c7c7
SHA512 3f60dbdf82376980362a03909d3d36c54fb002684dbf7b29d88ed77fc908449a6315ca9e6d654edb5d514c8f526d0d2fcd2d03d58aaf08620800f39015a8c03f
MD5 SHA1 SHA512

Submit Download

36e87e38-c0ac-46db-873c-bd45409fc62a.vbs

Path C:\Users\Admin\AppData\Local\Temp\36e87e38-c0ac-46db-873c-bd45409fc62a.vbs
Size 721B
SHA256 07911696e2c10dd5c437a2a0c8b8b3ac05788a99f37a4cc7565a106d190dcbd6
MD5 864a93446c14032ed2c0a798cb08955a
SHA1 709ab7ebd9dafff10789bcd500efa33aedfe2b47
SHA512 f6288c90d5bb5d1fd600784f608014e64cac5307fa9792eb0034ddcfb127baa7a0f0c94b34d434c11c0ecf4c7a8df501bdb24855ed6ae36e266019cda371b14d
MD5 SHA1 SHA512

Submit Download

36ffcc67-5e23-47ad-be4b-faeb8e5d95d4.vbs

Path C:\Users\Admin\AppData\Local\Temp\36ffcc67-5e23-47ad-be4b-faeb8e5d95d4.vbs
Size 720B
SHA256 9257f0c1100e90bfa7b2b1c8a02a611d569a132f00ce683c9854147a21ba30c9
MD5 4a04e9bb6dbf8b06a4cdd06bf26bd9d8
SHA1 34e7460745717e0d98ac2e7101e99cc57dd8c78e
SHA512 ae128a8054bafbc1341422afac4d78fc69d68a4b79494911fac486d33153e15f77da989d98a85926831e0c7f0931e9c96acde10acb862adeb3f46b275168b202
MD5 SHA1 SHA512

Submit Download

3deeb706-2f8e-4fc5-98c8-f26f9553739e.vbs

Path C:\Users\Admin\AppData\Local\Temp\3deeb706-2f8e-4fc5-98c8-f26f9553739e.vbs
Size 721B
SHA256 da5112223250a07509dabb2a00876a87585bda3405584bfb0bed58c793480fe7
MD5 5f731eab174b0e2a1ae94ad67bfd9b8f
SHA1 a0fd98034c58b26f6ed5a8b375c8b568321b90d5
SHA512 2a0960ce08c0324154088dd356d09b7615e323add58bc78515f4929e24ffe6158fc93c555e68c65ecb1ca9e78688f510553429e6d68f03588ecdd769eaaba30d
MD5 SHA1 SHA512

Submit Download

53a3d221-0f88-4295-aac5-32f519e1cc25.vbs

Path C:\Users\Admin\AppData\Local\Temp\53a3d221-0f88-4295-aac5-32f519e1cc25.vbs
Size 721B
SHA256 e3452a2ed6fca0c5c1a1d53228bab83967f1280dac636a14a5739c0b00030186
MD5 8bf368fb0d1d6ce7fe636566110aec01
SHA1 5a49e718a2024754fc135f3cbfd42b2e2ef4aa54
SHA512 f7c85d38e75cddfd83b0f38d957f579df36c2a678767e459de27d2aca3ab808dcc8ec17d0949b5a1ab17efe56d2d929236e93029a000cf04d6a9964659334599
MD5 SHA1 SHA512

Submit Download

5fcb8cb5-baa0-47bb-bd2e-38c4574d8098.vbs

Path C:\Users\Admin\AppData\Local\Temp\5fcb8cb5-baa0-47bb-bd2e-38c4574d8098.vbs
Size 721B
SHA256 bdddbcb1408bcda3dec032d19b8145019f779a4b6748bd75f3b6a3212e9b79ea
MD5 e389e8274f3c6bfc4ee77f8129e79633
SHA1 6dce0524984f871008cb957ee0c8ba088c4840ee
SHA512 78b63bb1f8e75a95dbad29b681b8707ffff0b186c026314905a42216c40583c7a69719ad94fee4bbc75842a28d2c8f696674923b1681173338f54d1789fe8958
MD5 SHA1 SHA512

Submit Download

7cbccac2-7b5a-4032-bfee-de67945f7e61.vbs

Path C:\Users\Admin\AppData\Local\Temp\7cbccac2-7b5a-4032-bfee-de67945f7e61.vbs
Size 721B
SHA256 29dc64938614fce5dc807b80ac104e72944915ab6b302d905d88ed8027a5c9c8
MD5 63ede95465126996b4dec1f642a683a9
SHA1 9c3cad873acc215925adea60d95285e1bb0f24ae
SHA512 17ac70b64c94c1fbffca325804069122bdc51256c6df9a32031619a3a363c3455d776bf9da7e3c285c70a93eb967796549173e357833bf0c4f86cb9f534e3f57
MD5 SHA1 SHA512

Submit Download

84ba3c55-264d-495c-95c0-f1fee17eb395.vbs

Path C:\Users\Admin\AppData\Local\Temp\84ba3c55-264d-495c-95c0-f1fee17eb395.vbs
Size 721B
SHA256 7c23e9341adb3c73a0b8321ae706b29d4fd77d033b97b40aef5c5b192cb95616
MD5 43b3aa8f7f7cdd9175dbf916a1fe0ebe
SHA1 c4c79ae0bc8d5af758f0002beb9acce28302334a
SHA512 40f4b2f3d2bb87a4e1bcd5b543bab5b002eb2864cab65da402f58caa7e60171c6ea3059f7d70738b3d5bf9a2274823ce65c87a41fcd129cd1986495d90f12eef
MD5 SHA1 SHA512

Submit Download

916e786d-9062-4697-b12f-cbca4838a8a4.vbs

Path C:\Users\Admin\AppData\Local\Temp\916e786d-9062-4697-b12f-cbca4838a8a4.vbs
Size 497B
SHA256 608ba373875d3adf6a6b1b8d33d9a15ee7fd7fa660a8dc2c23897cd81eddeb7b
MD5 955772e79daf8332cfb432d432437c91
SHA1 00225515ad3d086139ba158cb97e6a7cd0516e15
SHA512 ace3f0aea1f2003305a26f3c1a2fa49e6273bde69169820989f8f3c91c55853c0a63a8de51efc97af0d889e58d9a0977b8efce5c3e11e6e7b9df96b5abb7dca8
MD5 SHA1 SHA512

Submit Download

973ba832-2520-47d7-9629-af76b5c92604.vbs

Path C:\Users\Admin\AppData\Local\Temp\973ba832-2520-47d7-9629-af76b5c92604.vbs
Size 721B
SHA256 eedc39444951b562e87a460a525159db2c8296cec0669a74c7503b3d9f8a2f50
MD5 b44b608ff3e844c3536fbac70df8e068
SHA1 972a21292767b39701b925e15a3630ff02668199
SHA512 c741557bdd671fdd0895efd652fede25f90ff3a672808f3e97477463f77be0327bd1d75da67a61aa8a25b2531d000ef64fd3b7fbb1fcd7e456e2b79786d43666
MD5 SHA1 SHA512

Submit Download

QfLJ25UQ42.bat

Path C:\Users\Admin\AppData\Local\Temp\QfLJ25UQ42.bat
Size 210B
SHA256 811aa7b70ca4107e0ed12d22ec229a1469bc875d1b0571b43511d4e261bca5bf
MD5 362739a80951fd0d7d21b76fd83c5fe0
SHA1 eb9e28ca90e7d6c916dd69ba9b46ad2d1e0dbe57
SHA512 1e21dccba856bf32f0510d58567f165d516984378bf66ef6440ddfb75dad7902117bc5bc355d2dc7a904308e26acf853632bb0bb22a1ea18d06a874530863f0f
MD5 SHA1 SHA512

Submit Download

RuntimeBroker.exe

Path C:\Windows\ShellExperiences\RuntimeBroker.exe
Size 3.0MB
SHA256 7de2d87d10d8c8db189278847f7155fb1b943d5768fd2708bdf79a65f0d74186
MD5 928ecce66fd72ab40f23f14a840515b0
SHA1 adbe03efb92018024bdc0adf824dc64005937522
SHA512 3c2d2f4bd31e7a15cf64b667bf63cebd3e934ba05aa264570136b0042276cc47f278190b1b4d930fdba2daea83fc1993f943419b216d130c11d3389866f53213
SSDEEP 49152:hIL9erMYbvYZgn9U0qGmaEY9zvHPH+LhnTJLyYg/Hv9QfokM9JaQplq:KUrMMign9UhG6YeLhnYYg/tkOpf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-95-0x000000001C670000-0x000000001C6A5000-memory.dmp

Download

memory/856-174-0x000000001CDB0000-0x000000001CE06000-memory.dmp

Download

memory/1604-61-0x000000001D7E0000-0x000000001D7F2000-memory.dmp

Download

memory/4708-6-0x000000001B980000-0x000000001B9D0000-memory.dmp

Download

memory/4708-18-0x000000001C300000-0x000000001C312000-memory.dmp

Download

memory/4708-20-0x000000001C330000-0x000000001C33C000-memory.dmp

Download

memory/4708-19-0x000000001C930000-0x000000001CE58000-memory.dmp

Download

memory/4708-22-0x000000001C350000-0x000000001C35C000-memory.dmp

Download

memory/4708-25-0x000000001C380000-0x000000001C38E000-memory.dmp

Download

memory/4708-24-0x000000001C370000-0x000000001C37E000-memory.dmp

Download

memory/4708-23-0x000000001C360000-0x000000001C36A000-memory.dmp

Download

memory/4708-26-0x000000001C390000-0x000000001C398000-memory.dmp

Download

memory/4708-30-0x000000001C3D0000-0x000000001C3DC000-memory.dmp

Download

memory/4708-29-0x000000001C3C0000-0x000000001C3CA000-memory.dmp

Download

memory/4708-28-0x000000001C3B0000-0x000000001C3B8000-memory.dmp

Download

memory/4708-27-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

Download

memory/4708-21-0x000000001C340000-0x000000001C348000-memory.dmp

Download

memory/4708-17-0x000000001C2F0000-0x000000001C2F8000-memory.dmp

Download

memory/4708-15-0x000000001C2E0000-0x000000001C2E8000-memory.dmp

Download

memory/4708-57-0x00007FFE444A0000-0x00007FFE44F61000-memory.dmp

Download

memory/4708-16-0x000000001C3F0000-0x000000001C3FC000-memory.dmp

Download

memory/4708-14-0x000000001BB80000-0x000000001BB8C000-memory.dmp

Download

memory/4708-5-0x0000000002DF0000-0x0000000002E0C000-memory.dmp

Download

memory/4708-0-0x00007FFE444A3000-0x00007FFE444A5000-memory.dmp

Download

memory/4708-13-0x000000001BB30000-0x000000001BB86000-memory.dmp

Download

memory/4708-7-0x0000000002E10000-0x0000000002E18000-memory.dmp

Download

memory/4708-8-0x000000001B9D0000-0x000000001B9E6000-memory.dmp

Download

memory/4708-9-0x0000000002E90000-0x0000000002EA2000-memory.dmp

Download

memory/4708-12-0x000000001BB10000-0x000000001BB20000-memory.dmp

Download

memory/4708-11-0x000000001B9F0000-0x000000001B9F8000-memory.dmp

Download

memory/4708-10-0x000000001BB20000-0x000000001BB2C000-memory.dmp

Download

memory/4708-4-0x0000000001630000-0x0000000001638000-memory.dmp

Download

memory/4708-3-0x0000000001620000-0x000000000162E000-memory.dmp

Download

memory/4708-2-0x00007FFE444A0000-0x00007FFE44F61000-memory.dmp

Download

memory/4708-1-0x00000000009A0000-0x0000000000CB2000-memory.dmp

Download