dcrat | c729d915ac96ff25722e76303e87e67c8ed51f776992724fa89fedbb77fc8a28

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
587e1d2473fea9284918bfbcf9897de2.exe
Size 2.5MB
Sample240630-nmpsdsxbla
SHA256 c729d915ac96ff25722e76303e87e67c8ed51f776992724fa89fedbb77fc8a28
MD5 587e1d2473fea9284918bfbcf9897de2
SHA1 25dc1703e07cc5cc890238cc18d0199effab86be
SHA512 1e7313c16f84e618b9d9cea644d95b34cdb339830c5354354f126b85e8772994302abe5d7a2554e62898fb36d38f03c90b012e4060b69f57ce35806e975522fc
SSDEEP 49152:4sg2eGAIciUHLJPXf0fo+goVM6EztdiHGEgE7YsOlTvtq9hzDzqv:4FLHLJPPI9ErnvaYzlAfDzq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion execution infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 9 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\", \"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\", \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath_target_105437\\msedge.exe\", \"C:\\Windows\\Containers\\dllhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\upfc.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\", \"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\", \"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\", \"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\", \"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\", \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath_target_105437\\msedge.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\", \"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\", \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath_target_105437\\msedge.exe\", \"C:\\Windows\\Containers\\dllhost.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\", \"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Users\\All Users\\Templates\\dwm.exe\", \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath_target_105437\\msedge.exe\", \"C:\\Windows\\Containers\\dllhost.exe\", \"C:\\Program Files\\WindowsPowerShell\\upfc.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\", \"C:\\Users\\Default\\Saved Games\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4704	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4580	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2388	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	984	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3076	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	880	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2424	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	4596	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	4596	schtasks.exe	89

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2292-1-0x0000000000320000-0x00000000005B0000-memory.dmp	dcrat
behavioral2/files/0x00070000000235cd-29.dat	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe
1088	powershell.exe
4976	powershell.exe
544	powershell.exe
3016	powershell.exe
3660	powershell.exe
4428	powershell.exe
2368	powershell.exe
4676	powershell.exe
4272	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	587e1d2473fea9284918bfbcf9897de2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	System.exe

Executes dropped EXE 1 IoCs

pid	Process
3408	System.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default\\Saved Games\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default\\Saved Games\\explorer.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath_target_105437\\msedge.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\WindowsPowerShell\\upfc.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Vss\\Writers\\Application\\wininit.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\All Users\\Templates\\dwm.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Containers\\dllhost.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\WindowsPowerShell\\upfc.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\All Users\\Templates\\dwm.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath_target_105437\\msedge.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.187.37\\fontdrvhost.exe\""	587e1d2473fea9284918bfbcf9897de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Containers\\dllhost.exe\""	587e1d2473fea9284918bfbcf9897de2.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\fontdrvhost.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\5b884080fd4f94	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\msedge.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\61a52ddc9dd915	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files\WindowsPowerShell\upfc.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files\WindowsPowerShell\ea1d8f6d871115	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\fontdrvhost.exe	587e1d2473fea9284918bfbcf9897de2.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Vss\Writers\Application\56085415360792	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\Containers\dllhost.exe	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\Containers\5940a34987c991	587e1d2473fea9284918bfbcf9897de2.exe
File created	C:\Windows\Vss\Writers\Application\wininit.exe	587e1d2473fea9284918bfbcf9897de2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	System.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1312	schtasks.exe
448	schtasks.exe
2528	schtasks.exe
1184	schtasks.exe
4820	schtasks.exe
2180	schtasks.exe
1000	schtasks.exe
540	schtasks.exe
4088	schtasks.exe
2424	schtasks.exe
2860	schtasks.exe
2388	schtasks.exe
3644	schtasks.exe
4628	schtasks.exe
2056	schtasks.exe
3076	schtasks.exe
4028	schtasks.exe
3828	schtasks.exe
4580	schtasks.exe
3688	schtasks.exe
4448	schtasks.exe
4300	schtasks.exe
844	schtasks.exe
3444	schtasks.exe
4704	schtasks.exe
984	schtasks.exe
880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2292	587e1d2473fea9284918bfbcf9897de2.exe
2292	587e1d2473fea9284918bfbcf9897de2.exe
2292	587e1d2473fea9284918bfbcf9897de2.exe
2292	587e1d2473fea9284918bfbcf9897de2.exe
2292	587e1d2473fea9284918bfbcf9897de2.exe
2292	587e1d2473fea9284918bfbcf9897de2.exe
2292	587e1d2473fea9284918bfbcf9897de2.exe
2292	587e1d2473fea9284918bfbcf9897de2.exe
4676	powershell.exe
4676	powershell.exe
4428	powershell.exe
4428	powershell.exe
4976	powershell.exe
4976	powershell.exe
3660	powershell.exe
3660	powershell.exe
1088	powershell.exe
1088	powershell.exe
4272	powershell.exe
4272	powershell.exe
4744	powershell.exe
4744	powershell.exe
2368	powershell.exe
2368	powershell.exe
544	powershell.exe
544	powershell.exe
4744	powershell.exe
3016	powershell.exe
3016	powershell.exe
544	powershell.exe
4428	powershell.exe
1088	powershell.exe
4676	powershell.exe
4976	powershell.exe
4272	powershell.exe
3660	powershell.exe
2368	powershell.exe
3408	System.exe
3408	System.exe
3016	powershell.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe
3408	System.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3408	System.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	587e1d2473fea9284918bfbcf9897de2.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	3408	System.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeBackupPrivilege	3108	vssvc.exe
Token: SeRestorePrivilege	3108	vssvc.exe
Token: SeAuditPrivilege	3108	vssvc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 3016	2292	587e1d2473fea9284918bfbcf9897de2.exe	117
PID 2292 wrote to memory of 3016	2292	587e1d2473fea9284918bfbcf9897de2.exe	117
PID 2292 wrote to memory of 4272	2292	587e1d2473fea9284918bfbcf9897de2.exe	118
PID 2292 wrote to memory of 4272	2292	587e1d2473fea9284918bfbcf9897de2.exe	118
PID 2292 wrote to memory of 544	2292	587e1d2473fea9284918bfbcf9897de2.exe	119
PID 2292 wrote to memory of 544	2292	587e1d2473fea9284918bfbcf9897de2.exe	119
PID 2292 wrote to memory of 4976	2292	587e1d2473fea9284918bfbcf9897de2.exe	120
PID 2292 wrote to memory of 4976	2292	587e1d2473fea9284918bfbcf9897de2.exe	120
PID 2292 wrote to memory of 4676	2292	587e1d2473fea9284918bfbcf9897de2.exe	121
PID 2292 wrote to memory of 4676	2292	587e1d2473fea9284918bfbcf9897de2.exe	121
PID 2292 wrote to memory of 3660	2292	587e1d2473fea9284918bfbcf9897de2.exe	122
PID 2292 wrote to memory of 3660	2292	587e1d2473fea9284918bfbcf9897de2.exe	122
PID 2292 wrote to memory of 2368	2292	587e1d2473fea9284918bfbcf9897de2.exe	123
PID 2292 wrote to memory of 2368	2292	587e1d2473fea9284918bfbcf9897de2.exe	123
PID 2292 wrote to memory of 4428	2292	587e1d2473fea9284918bfbcf9897de2.exe	124
PID 2292 wrote to memory of 4428	2292	587e1d2473fea9284918bfbcf9897de2.exe	124
PID 2292 wrote to memory of 1088	2292	587e1d2473fea9284918bfbcf9897de2.exe	126
PID 2292 wrote to memory of 1088	2292	587e1d2473fea9284918bfbcf9897de2.exe	126
PID 2292 wrote to memory of 4744	2292	587e1d2473fea9284918bfbcf9897de2.exe	127
PID 2292 wrote to memory of 4744	2292	587e1d2473fea9284918bfbcf9897de2.exe	127
PID 2292 wrote to memory of 3408	2292	587e1d2473fea9284918bfbcf9897de2.exe	136
PID 2292 wrote to memory of 3408	2292	587e1d2473fea9284918bfbcf9897de2.exe	136
PID 3408 wrote to memory of 4300	3408	System.exe	140
PID 3408 wrote to memory of 4300	3408	System.exe	140
PID 3408 wrote to memory of 824	3408	System.exe	141
PID 3408 wrote to memory of 824	3408	System.exe	141

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	587e1d2473fea9284918bfbcf9897de2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	System.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	System.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\587e1d2473fea9284918bfbcf9897de2.exe
"C:\Users\Admin\AppData\Local\Temp\587e1d2473fea9284918bfbcf9897de2.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\587e1d2473fea9284918bfbcf9897de2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Saved Games\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\Application\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\msedge.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Recovery\WindowsRE\System.exe
  "C:\Recovery\WindowsRE\System.exe"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3408
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bf6052c-9d4c-4fd7-bfab-3883395258a2.vbs"
    3⤵
    PID:4300
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\961504e2-f782-440a-b4ae-85357f81ecac.vbs"
    3⤵
    PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Saved Games\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\Vss\Writers\Application\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Vss\Writers\Application\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Templates\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Templates\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105437\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\Containers\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Containers\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Containers\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8
1⤵
PID:4536

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\ProgramData\Microsoft\Windows\Templates\dwm.exe
Size 2.5MB
SHA256 c729d915ac96ff25722e76303e87e67c8ed51f776992724fa89fedbb77fc8a28
MD5 587e1d2473fea9284918bfbcf9897de2
SHA1 25dc1703e07cc5cc890238cc18d0199effab86be
SHA512 1e7313c16f84e618b9d9cea644d95b34cdb339830c5354354f126b85e8772994302abe5d7a2554e62898fb36d38f03c90b012e4060b69f57ce35806e975522fc
SSDEEP 49152:4sg2eGAIciUHLJPXf0fo+goVM6EztdiHGEgE7YsOlTvtq9hzDzqv:4FLHLJPPI9ErnvaYzlAfDzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8222fe869b025493591ca2ffbabe089c2e682449e77b754fc864ba62d64ee957
MD5 3a5e1f1efff867a822c6a57ee928dd66
SHA1 b017854d8a1deb05f1447e9dd6002902fb66bf6b
SHA512 25fc0fd6a71595c44efe34d281c4bc4924ac82f76b9f697497d0019fa2c8e0cadf58f92ae4272f00b1ef1e97dfd93bd740a9e7f7d9dc93cb1cadbde5f93d1782
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 8c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
MD5 28d4235aa2e6d782751f980ceb6e5021
SHA1 f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA512 dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
MD5 SHA1 SHA512

Submit Download

8bf6052c-9d4c-4fd7-bfab-3883395258a2.vbs

Path C:\Users\Admin\AppData\Local\Temp\8bf6052c-9d4c-4fd7-bfab-3883395258a2.vbs
Size 708B
SHA256 a6321181ae787a674800b97cfea69a4338720e5ea03b4965bf91b22ddfcfbb32
MD5 5d598f5f10bfb5f3f67565bea52d3312
SHA1 81382202b6b067a6febd04684cb240260501714f
SHA512 8f3402153a5158784746adaa34d785753c371914c5f7c588d855bf1fbe61f255b2a92954f59d08ee146ec08e258cd053e64b729502a646710cdec2a48944607a
MD5 SHA1 SHA512

Submit Download

961504e2-f782-440a-b4ae-85357f81ecac.vbs

Path C:\Users\Admin\AppData\Local\Temp\961504e2-f782-440a-b4ae-85357f81ecac.vbs
Size 484B
SHA256 77a9232dbefd9051ecd41b72c8c39a08a0c7959d11048b4440b65291e6381d90
MD5 dcdb774629cd7900a3b871b669cef050
SHA1 484d5b1ff761f1b321ce4a7d59ee4c3537aef20d
SHA512 529b0311b4985897a10baa3d0865398a7a11e532912003469baeee95a0c7a51642f5a0ea629983d20b44897a2b4ab6a3269a5c65235ce6900c07be0d3d0ef0d0
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1alpzu2w.in0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1alpzu2w.in0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1088-53-0x000001C85CF40000-0x000001C85CF62000-memory.dmp

Download

memory/2292-11-0x000000001B2F0000-0x000000001B2F8000-memory.dmp

Download

memory/2292-10-0x000000001B2E0000-0x000000001B2EC000-memory.dmp

Download

memory/2292-16-0x000000001B9E0000-0x000000001B9EE000-memory.dmp

Download

memory/2292-15-0x000000001B9D0000-0x000000001B9DA000-memory.dmp

Download

memory/2292-13-0x000000001B310000-0x000000001B318000-memory.dmp

Download

memory/2292-12-0x000000001B300000-0x000000001B30C000-memory.dmp

Download

memory/2292-0-0x00007FF992653000-0x00007FF992655000-memory.dmp

Download

memory/2292-18-0x000000001BA00000-0x000000001BA08000-memory.dmp

Download

memory/2292-50-0x00007FF992650000-0x00007FF993111000-memory.dmp

Download

memory/2292-19-0x000000001BA20000-0x000000001BA2A000-memory.dmp

Download

memory/2292-20-0x000000001BA30000-0x000000001BA3C000-memory.dmp

Download

memory/2292-17-0x000000001B9F0000-0x000000001B9F8000-memory.dmp

Download

memory/2292-6-0x0000000002700000-0x0000000002708000-memory.dmp

Download

memory/2292-5-0x000000001B270000-0x000000001B2C0000-memory.dmp

Download

memory/2292-4-0x00000000026E0000-0x00000000026FC000-memory.dmp

Download

memory/2292-14-0x000000001B9C0000-0x000000001B9C8000-memory.dmp

Download

memory/2292-7-0x000000001B2C0000-0x000000001B2D6000-memory.dmp

Download

memory/2292-9-0x000000001B970000-0x000000001B9C6000-memory.dmp

Download

memory/2292-8-0x0000000002780000-0x000000000278A000-memory.dmp

Download

memory/2292-3-0x00000000026D0000-0x00000000026DE000-memory.dmp

Download

memory/2292-2-0x00007FF992650000-0x00007FF993111000-memory.dmp

Download

memory/2292-1-0x0000000000320000-0x00000000005B0000-memory.dmp

Download