Analysis
- max time kernel
145s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
30/06/2024, 01:27
General
- Target ea6e4e54c6aa6df24c7a386a5ac3bd9a224d69ecd629a555744e72cde043cadd.exe
- Size 1.2MB
- Sample240630-bt6y2averq
- SHA256 ea6e4e54c6aa6df24c7a386a5ac3bd9a224d69ecd629a555744e72cde043cadd
Score
10/10
Malware Config
Signatures
- DcRat 16 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Modifies WinLogon for persistence 2 TTPs 5 IoCs
- Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 54 IoCs
- DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Detects executables packed with SmartAssembly 3 IoCs
- Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 17 IoCs
- Adds Run key to start application 2 TTPs 10 IoCs
- Checks whether UAC is enabled 1 TTPs 36 IoCs
- Drops file in Program Files directory 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 18 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 54 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea6e4e54c6aa6df24c7a386a5ac3bd9a224d69ecd629a555744e72cde043cadd.exe"C:\Users\Admin\AppData\Local\Temp\ea6e4e54c6aa6df24c7a386a5ac3bd9a224d69ecd629a555744e72cde043cadd.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4hp44X5ex.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e96e155-c8ce-4a7d-81c9-006271997627.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54ae4cc2-931e-4021-86c2-2035e28b128c.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd0d52bb-13b0-4963-a625-76a7604e7dff.vbs"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1a37145-01d2-412f-b4a4-e1d1bfb89d59.vbs"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1bff9a5-b396-4d9f-b319-1405e8c05f5c.vbs"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\67bfcd21-9b81-4dbb-a4d9-09e2ad9f519c.vbs"14⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff47180f-2cd0-4b03-aea8-c1c80a8b1f95.vbs"16⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3bb307f-fde3-4859-80dd-8c8a24f3e03d.vbs"18⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71b2873f-d8a8-4aaf-8935-3f1796b2cd4f.vbs"20⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81c9d982-8c2d-4a34-a179-6688c50f7e52.vbs"22⤵
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c460b86f-35e5-4cf3-ba87-73ba43db6fd3.vbs"24⤵
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e6dbf6d-339b-4ca8-a663-573a0b4bcbaf.vbs"26⤵
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5edd48b1-092e-4e64-bf1f-27e654b38c19.vbs"28⤵
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"29⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c00d6b24-244b-4169-91ea-62298aefa4a7.vbs"30⤵
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"31⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05ed0555-6693-41a3-9558-fbe6a35cde81.vbs"32⤵
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"33⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c46555c-2105-4391-9ee6-244d465c80c3.vbs"34⤵
-
C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe"35⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f40c0594-8869-48a1-9673-bcf2f7a22ac6.vbs"36⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f485abf4-7103-41e4-a665-cb3d70988684.vbs"36⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23c13356-5f2b-48df-a2b0-cfb735b43219.vbs"34⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53fcd87b-0de5-4d57-b15c-5f3c84586e78.vbs"32⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38deb12b-5806-4be9-9aa3-6d981695452d.vbs"30⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5af4e6bc-52ca-4cf0-ae5e-7aba0cfd3bb4.vbs"28⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\24d4012e-6095-49fb-9c32-50e83d82bd90.vbs"26⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdb060dc-7bc3-4e7f-bc9c-b933a82f4dc3.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\34e719ef-40c6-42b7-b14b-b26595090489.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0deda8c9-1880-4978-a93c-eeff655e149e.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b36b71c8-48b5-4081-b4be-e72ffcd2ef90.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\638d179c-ca3e-4305-b4ff-8119c04890bc.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cfdb253c-00b1-4cec-9eff-93c3af65c7ec.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d932a4b-8da3-4ea6-b63c-4a3ff56d972a.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f3c2414-d127-4ede-95ad-948271ae898b.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84bb2821-96f0-426d-9dde-877c624c5af6.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f1b6ed1-9cc4-4153-91dc-38ee45c07d97.vbs"6⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbb22ceb-164b-4445-9f66-3796176b2e8b.vbs"4⤵
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\LocalLow\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\LocalLow\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\sihost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
backgroundTaskHost.exe
backgroundTaskHost.exe.log
05ed0555-6693-41a3-9558-fbe6a35cde81.vbs
0e6dbf6d-339b-4ca8-a663-573a0b4bcbaf.vbs
54ae4cc2-931e-4021-86c2-2035e28b128c.vbs
5edd48b1-092e-4e64-bf1f-27e654b38c19.vbs
67bfcd21-9b81-4dbb-a4d9-09e2ad9f519c.vbs
6e96e155-c8ce-4a7d-81c9-006271997627.vbs
71b2873f-d8a8-4aaf-8935-3f1796b2cd4f.vbs
81c9d982-8c2d-4a34-a179-6688c50f7e52.vbs
B4hp44X5ex.bat
c00d6b24-244b-4169-91ea-62298aefa4a7.vbs
c3bb307f-fde3-4859-80dd-8c8a24f3e03d.vbs
c460b86f-35e5-4cf3-ba87-73ba43db6fd3.vbs
d1a37145-01d2-412f-b4a4-e1d1bfb89d59.vbs
d1bff9a5-b396-4d9f-b319-1405e8c05f5c.vbs
dd0d52bb-13b0-4963-a625-76a7604e7dff.vbs
fbb22ceb-164b-4445-9f66-3796176b2e8b.vbs
ff47180f-2cd0-4b03-aea8-c1c80a8b1f95.vbs
memory/1652-185-0x000000001C500000-0x000000001C602000-memory.dmp
memory/1952-117-0x000000001BC70000-0x000000001BD72000-memory.dmp
memory/2192-105-0x000000001BA80000-0x000000001BB82000-memory.dmp
memory/3216-5-0x00000000027E0000-0x00000000027EC000-memory.dmp
memory/3216-3-0x00000000027C0000-0x00000000027C8000-memory.dmp
memory/3216-1-0x0000000000350000-0x000000000048E000-memory.dmp
memory/3216-9-0x0000000002830000-0x0000000002838000-memory.dmp
memory/3216-2-0x00007FFAB7B10000-0x00007FFAB85D1000-memory.dmp
memory/3216-15-0x000000001B170000-0x000000001B17C000-memory.dmp
memory/3216-8-0x0000000002820000-0x0000000002828000-memory.dmp
memory/3216-7-0x000000001BD30000-0x000000001C258000-memory.dmp
memory/3216-11-0x000000001B120000-0x000000001B12A000-memory.dmp
memory/3216-12-0x000000001B130000-0x000000001B13E000-memory.dmp
memory/3216-13-0x000000001B140000-0x000000001B148000-memory.dmp
memory/3216-0-0x00007FFAB7B13000-0x00007FFAB7B15000-memory.dmp
memory/3216-6-0x00000000027F0000-0x0000000002802000-memory.dmp
memory/3216-4-0x00000000027D0000-0x00000000027DA000-memory.dmp
memory/3216-10-0x000000001B110000-0x000000001B118000-memory.dmp
memory/3216-14-0x000000001B160000-0x000000001B16A000-memory.dmp
memory/3216-31-0x00007FFAB7B10000-0x00007FFAB85D1000-memory.dmp
memory/3480-81-0x000000001BA90000-0x000000001BB92000-memory.dmp
memory/3556-69-0x000000001BD40000-0x000000001BE42000-memory.dmp
memory/4272-141-0x0000000002EB0000-0x0000000002EC2000-memory.dmp
memory/4496-93-0x000000001BB50000-0x000000001BC52000-memory.dmp
memory/4784-197-0x000000001C1D0000-0x000000001C2D2000-memory.dmp