dcrat | 38b3c41d485fa638c249ee54c9a3ca358a9eb36e561834d9f7f2fca088da6248

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4711f3cfcb7893940530c79c3e978d96.exe
Size 3.7MB
Sample240709-k2qrfsydnh
SHA256 38b3c41d485fa638c249ee54c9a3ca358a9eb36e561834d9f7f2fca088da6248
MD5 4711f3cfcb7893940530c79c3e978d96
SHA1 bd6f1b0c05f42ad060b8ded31c34fc7f9c69a1ff
SHA512 bd7925836c83b2ad4dd999312d6b45bc497d4b3ccb530cc7789d4264ba38760a0d5f144279ebd3a30def25a825d56aa254cf594d0c4f7e960b6863961edb9a5f
SSDEEP 98304:Ub0L4WMdHDEC91KK9GOFeDzqswQ2x00zqrFipJ:U7WMVnkcGRDu3z00mrF8J
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3984	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1428	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3832	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4328	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2016	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4364	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	2592	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2592	schtasks.exe	98

UAC bypass 3 TTPs 18 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperComfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperComfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperComfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00070000000235db-15.dat	dcrat
behavioral2/memory/4648-17-0x0000000000F40000-0x00000000012AA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	4711f3cfcb7893940530c79c3e978d96.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	hyperComfont.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	sysmon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\Control Panel\International\Geo\Nation	sysmon.exe

Executes dropped EXE 6 IoCs

pid	Process
4648	hyperComfont.exe
872	sysmon.exe
888	sysmon.exe
2584	sysmon.exe
4456	sysmon.exe
4996	sysmon.exe

Checks whether UAC is enabled 1 TTPs 12 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hyperComfont.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperComfont.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\sysmon.exe	hyperComfont.exe
File created	C:\Program Files\Windows Portable Devices\121e5b5079f7c0	hyperComfont.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\wininit.exe	hyperComfont.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\56085415360792	hyperComfont.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\dwm.exe	hyperComfont.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\6cb0b6c459d5d3	hyperComfont.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Containers\serviced\sihost.exe	hyperComfont.exe
File created	C:\Windows\Containers\serviced\66fc9ff0ee96c2	hyperComfont.exe
File created	C:\Windows\it-IT\msedge.exe	hyperComfont.exe
File created	C:\Windows\it-IT\61a52ddc9dd915	hyperComfont.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe	hyperComfont.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\27d1bcfc3c54e0	hyperComfont.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	4711f3cfcb7893940530c79c3e978d96.exe
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	sysmon.exe
Key created	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000_Classes\Local Settings	sysmon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
860	schtasks.exe
3660	schtasks.exe
3200	schtasks.exe
2808	schtasks.exe
3984	schtasks.exe
908	schtasks.exe
1524	schtasks.exe
844	schtasks.exe
4680	schtasks.exe
2940	schtasks.exe
4256	schtasks.exe
1428	schtasks.exe
2016	schtasks.exe
3336	schtasks.exe
1720	schtasks.exe
4900	schtasks.exe
4412	schtasks.exe
3832	schtasks.exe
3688	schtasks.exe
4364	schtasks.exe
1692	schtasks.exe
1004	schtasks.exe
5020	schtasks.exe
540	schtasks.exe
2736	schtasks.exe
4328	schtasks.exe
2584	schtasks.exe
1084	schtasks.exe
536	schtasks.exe
3780	schtasks.exe
3484	schtasks.exe
1380	schtasks.exe
3432	schtasks.exe
4968	schtasks.exe
1040	schtasks.exe
1452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
4648	hyperComfont.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
872	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe
888	sysmon.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	hyperComfont.exe
Token: SeDebugPrivilege	872	sysmon.exe
Token: SeDebugPrivilege	888	sysmon.exe
Token: SeDebugPrivilege	2584	sysmon.exe
Token: SeDebugPrivilege	4456	sysmon.exe
Token: SeDebugPrivilege	4996	sysmon.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4848	3200	4711f3cfcb7893940530c79c3e978d96.exe	92
PID 3200 wrote to memory of 4848	3200	4711f3cfcb7893940530c79c3e978d96.exe	92
PID 3200 wrote to memory of 4848	3200	4711f3cfcb7893940530c79c3e978d96.exe	92
PID 3200 wrote to memory of 960	3200	4711f3cfcb7893940530c79c3e978d96.exe	93
PID 3200 wrote to memory of 960	3200	4711f3cfcb7893940530c79c3e978d96.exe	93
PID 3200 wrote to memory of 960	3200	4711f3cfcb7893940530c79c3e978d96.exe	93
PID 4848 wrote to memory of 5116	4848	WScript.exe	95
PID 4848 wrote to memory of 5116	4848	WScript.exe	95
PID 4848 wrote to memory of 5116	4848	WScript.exe	95
PID 5116 wrote to memory of 4648	5116	cmd.exe	97
PID 5116 wrote to memory of 4648	5116	cmd.exe	97
PID 4648 wrote to memory of 872	4648	hyperComfont.exe	135
PID 4648 wrote to memory of 872	4648	hyperComfont.exe	135
PID 872 wrote to memory of 4244	872	sysmon.exe	136
PID 872 wrote to memory of 4244	872	sysmon.exe	136
PID 872 wrote to memory of 5084	872	sysmon.exe	137
PID 872 wrote to memory of 5084	872	sysmon.exe	137
PID 4244 wrote to memory of 888	4244	WScript.exe	138
PID 4244 wrote to memory of 888	4244	WScript.exe	138
PID 888 wrote to memory of 4236	888	sysmon.exe	139
PID 888 wrote to memory of 4236	888	sysmon.exe	139
PID 888 wrote to memory of 1596	888	sysmon.exe	140
PID 888 wrote to memory of 1596	888	sysmon.exe	140
PID 4236 wrote to memory of 2584	4236	WScript.exe	142
PID 4236 wrote to memory of 2584	4236	WScript.exe	142
PID 2584 wrote to memory of 4776	2584	sysmon.exe	143
PID 2584 wrote to memory of 4776	2584	sysmon.exe	143
PID 2584 wrote to memory of 4628	2584	sysmon.exe	144
PID 2584 wrote to memory of 4628	2584	sysmon.exe	144
PID 4776 wrote to memory of 4456	4776	WScript.exe	147
PID 4776 wrote to memory of 4456	4776	WScript.exe	147
PID 4456 wrote to memory of 3052	4456	sysmon.exe	148
PID 4456 wrote to memory of 3052	4456	sysmon.exe	148
PID 4456 wrote to memory of 2992	4456	sysmon.exe	149
PID 4456 wrote to memory of 2992	4456	sysmon.exe	149
PID 3052 wrote to memory of 4996	3052	WScript.exe	150
PID 3052 wrote to memory of 4996	3052	WScript.exe	150
PID 4996 wrote to memory of 1424	4996	sysmon.exe	151
PID 4996 wrote to memory of 1424	4996	sysmon.exe	151
PID 4996 wrote to memory of 3364	4996	sysmon.exe	152
PID 4996 wrote to memory of 3364	4996	sysmon.exe	152

System policy modification 1 TTPs 18 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hyperComfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hyperComfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sysmon.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hyperComfont.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sysmon.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4711f3cfcb7893940530c79c3e978d96.exe
"C:\Users\Admin\AppData\Local\Temp\4711f3cfcb7893940530c79c3e978d96.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\hyperfontRuntimebrokerCommon\17FXhqQMuScKHJyvEDRVZzLeavPeF.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\hyperfontRuntimebrokerCommon\eBp4nOdCYHh4n2XmCiTw0ppf.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\hyperfontRuntimebrokerCommon\hyperComfont.exe
      "C:\hyperfontRuntimebrokerCommon\hyperComfont.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:4648
    - - C:\Users\Admin\Templates\sysmon.exe
        
        "C:\Users\Admin\Templates\sysmon.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:872
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcf698a7-9536-4792-816f-07c699c45a7d.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Users\Admin\Templates\sysmon.exe
        
        C:\Users\Admin\Templates\sysmon.exe
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3614d260-e92c-496e-9c5c-a1e2972c26d1.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Users\Admin\Templates\sysmon.exe
        
        C:\Users\Admin\Templates\sysmon.exe
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75b6ae03-a544-46ff-b6a3-91965112b2db.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Users\Admin\Templates\sysmon.exe
        
        C:\Users\Admin\Templates\sysmon.exe
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7348f947-cc83-4627-8767-45d51663dca6.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Users\Admin\Templates\sysmon.exe
        
        C:\Users\Admin\Templates\sysmon.exe
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\196e62a8-20b0-40fd-928a-8cd9378dfee5.vbs"
        14⤵
        
        PID:1424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89e0e5bb-f56f-4606-9528-a853bf209184.vbs"
        14⤵
        
        PID:3364
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\752a32b2-f906-4093-a7da-b95205009fea.vbs"
        12⤵
        
        PID:2992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cfac1be8-d899-4500-b99c-b48c8e78ceeb.vbs"
        10⤵
        
        PID:4628
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\786f5a33-6070-484d-8583-010c82b95cf2.vbs"
        8⤵
        
        PID:1596
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce80ec87-f649-419f-82ac-888c0df20ffb.vbs"
        6⤵
        
        PID:5084
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\hyperfontRuntimebrokerCommon\file.vbs"
  2⤵
  PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3804,i,8810623976767776473,12198967845557146846,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
1⤵
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\hyperfontRuntimebrokerCommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\hyperfontRuntimebrokerCommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\hyperfontRuntimebrokerCommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Windows\Containers\serviced\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\Containers\serviced\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Windows\it-IT\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Windows\it-IT\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\WindowsPowerShell\Configuration\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Configuration\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Templates\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Admin\Templates\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Templates\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysmon.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

196e62a8-20b0-40fd-928a-8cd9378dfee5.vbs

Path C:\Users\Admin\AppData\Local\Temp\196e62a8-20b0-40fd-928a-8cd9378dfee5.vbs
Size 711B
SHA256 fe710f6a12dd0af38553c76608f5d998175befe6cf2699f34019e818206cd578
MD5 fb2f1e99595fc2d4898b2b280efd4b7d
SHA1 a17131c7cdc38d88927b211fb623bcd95f1475b6
SHA512 27d0e2dafb3a06aaf2431c3502d62a7f9cadb4d3409fa66b16044638b4641b74a5f131ef2e487da281dba86106e93b0d27195ca75ffb15a654416574e379b1f3
MD5 SHA1 SHA512

Submit Download

3614d260-e92c-496e-9c5c-a1e2972c26d1.vbs

Path C:\Users\Admin\AppData\Local\Temp\3614d260-e92c-496e-9c5c-a1e2972c26d1.vbs
Size 710B
SHA256 91d5ea28b10bf256bf40526b0d7fc55fee5f523de7b16e8a5c4e15f460f79791
MD5 8551a35ce906dedff94f87a24cdcee9d
SHA1 c90eb86df7c966760ef5a661508acf03bb06cd85
SHA512 51b97ea0812d6d307d17b26e43b289c20053abda77b122d89819da13e4835e7b30a6ec77c1f2171992ade62637fe0b73538d260a5c06beaf60d3d415499b8fb8
MD5 SHA1 SHA512

Submit Download

7348f947-cc83-4627-8767-45d51663dca6.vbs

Path C:\Users\Admin\AppData\Local\Temp\7348f947-cc83-4627-8767-45d51663dca6.vbs
Size 711B
SHA256 d70fe0e133c50cf59f3138f2f990a26dfccfab447917edc152e32e3154e0c9a4
MD5 7bb9128a6e8447233c3257f9318cac44
SHA1 d6eb801f120278dd296dd62bab0436dcb6f9abad
SHA512 a3b0c7aafb5385ef05d2c1d1cb48cdc15a635322dfac5407af276c465d0a6d89a9808e03dd3388f6f5bc8af04801c749c9abc8f4173f57d657f90754365c5c84
MD5 SHA1 SHA512

Submit Download

75b6ae03-a544-46ff-b6a3-91965112b2db.vbs

Path C:\Users\Admin\AppData\Local\Temp\75b6ae03-a544-46ff-b6a3-91965112b2db.vbs
Size 711B
SHA256 da0b88ade6988f3210f3511adc2f2d7f6bdc58b7f2c39748e672137c8aeeb645
MD5 10e5bbdfab80331be7411114d1db2e26
SHA1 783fbe977a488f270e1009374917cce40de7b79a
SHA512 b64673233646382a9e9d4a84cb147fe7a72b577c8cfe985b6f8b028131de4435411038f23d9859f1ddaff2613e6f19b1f0be90e56ad7e80cefd58ae73440889a
MD5 SHA1 SHA512

Submit Download

ce80ec87-f649-419f-82ac-888c0df20ffb.vbs

Path C:\Users\Admin\AppData\Local\Temp\ce80ec87-f649-419f-82ac-888c0df20ffb.vbs
Size 487B
SHA256 82ad066638ab5f7cd486b34e3da54cab00122780ae7624c13ca38a17e302d385
MD5 b9d912b6a717799a5e1ffaf032178db6
SHA1 c6964fcd685ec6dd321d9f86bb352d55c433afa7
SHA512 569a706faceba5453d6d1c8d2ac96f8e024493eff93ee54573bce32975e0a046d3aec4df50c89dfa71c976321328c1c63152a16462b82089a75c6b8946c24d66
MD5 SHA1 SHA512

Submit Download

fcf698a7-9536-4792-816f-07c699c45a7d.vbs

Path C:\Users\Admin\AppData\Local\Temp\fcf698a7-9536-4792-816f-07c699c45a7d.vbs
Size 710B
SHA256 101a3435172e062f358f230bf50dcbd6e91eed76a0efeb67392bd6e3c1331d62
MD5 180192d84a34e95b4a69141ad1ce958c
SHA1 5f269f6c7752792c929dd1563c8d3da98d9592c8
SHA512 c529b638d676dd53960b197924f9578d21e975eea73def4da09c3293f23d12dd02db28f637e1b6c182af4e095e342f335b270cada90dba26856e41e676a0a3c1
MD5 SHA1 SHA512

Submit Download

17FXhqQMuScKHJyvEDRVZzLeavPeF.vbe

Path C:\hyperfontRuntimebrokerCommon\17FXhqQMuScKHJyvEDRVZzLeavPeF.vbe
Size 229B
SHA256 f9442fce4e4e403b855ec9e8a3c6488b0901bf65bc2c53a4e8acbe4f6c879bf2
MD5 682a578d0b26a02e59289a5065b061b8
SHA1 f1a391eba8fadab5a6199d6437a4fddc8f010b08
SHA512 c87dbb42ff84c3c719ce56454afc9d80d253bde2ef422582924342605966c413d53b486648f6ce1d76e4f93020e05e0a6ba946ea88c94ac85bfa046078739a40
MD5 SHA1 SHA512

Submit Download

eBp4nOdCYHh4n2XmCiTw0ppf.bat

Path C:\hyperfontRuntimebrokerCommon\eBp4nOdCYHh4n2XmCiTw0ppf.bat
Size 50B
SHA256 35175a64757a6da56fdf1cccc8bb296067ec01d08ac8031c0763e0e5fa014466
MD5 db909b0863cd9b1b10a79be76c884f12
SHA1 7edb1cd7929fb35ff3679bab47f880b76121637f
SHA512 2cc025795569bf4efcb86f6949be20fdf18ec438df2d30233df5d20da8d05bca0ad58da7549d932d38bb6526283b1df2d4fbf32e6ea1cfafb39089127e45c8a6
MD5 SHA1 SHA512

Submit Download

file.vbs

Path C:\hyperfontRuntimebrokerCommon\file.vbs
Size 34B
SHA256 f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
MD5 677cc4360477c72cb0ce00406a949c61
SHA1 b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA512 7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
MD5 SHA1 SHA512

Submit Download

hyperComfont.exe

Path C:\hyperfontRuntimebrokerCommon\hyperComfont.exe
Size 3.4MB
SHA256 ad3cad3320c96364564203d96cc76ebea925dcc8de447195e0c1addb9f28e7e8
MD5 338454b2d553f26b11d45d3f958e5491
SHA1 5e124d56d3d63ca2e1e7196e46c11914ab1fc4a2
SHA512 b555c82f9868afe822f02f598663f91be7d31217d5d56a849fb8a6ff2edcaae81b8ab4ae94850c3431cbae044af17f00c3329687d972dbe2dc0b869f991d168c
SSDEEP 98304:/L4WMdHDEC91KK9GOFeDzqswQ2x00zqrFip:UWMVnkcGRDu3z00mrF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/872-91-0x000000001B970000-0x000000001B982000-memory.dmp

Download

memory/888-104-0x000000001B400000-0x000000001B412000-memory.dmp

Download

memory/2584-116-0x000000001BF40000-0x000000001BF96000-memory.dmp

Download

memory/4648-35-0x000000001C770000-0x000000001C77C000-memory.dmp

Download

memory/4648-41-0x000000001C7E0000-0x000000001C7E8000-memory.dmp

Download

memory/4648-26-0x000000001C040000-0x000000001C048000-memory.dmp

Download

memory/4648-25-0x000000001C020000-0x000000001C036000-memory.dmp

Download

memory/4648-27-0x000000001C050000-0x000000001C062000-memory.dmp

Download

memory/4648-28-0x000000001C070000-0x000000001C07C000-memory.dmp

Download

memory/4648-29-0x000000001C060000-0x000000001C068000-memory.dmp

Download

memory/4648-30-0x000000001C6E0000-0x000000001C6F0000-memory.dmp

Download

memory/4648-31-0x000000001C6F0000-0x000000001C6FA000-memory.dmp

Download

memory/4648-32-0x000000001C700000-0x000000001C756000-memory.dmp

Download

memory/4648-33-0x000000001C750000-0x000000001C75C000-memory.dmp

Download

memory/4648-34-0x000000001C760000-0x000000001C768000-memory.dmp

Download

memory/4648-24-0x000000001C010000-0x000000001C020000-memory.dmp

Download

memory/4648-36-0x000000001C780000-0x000000001C788000-memory.dmp

Download

memory/4648-37-0x000000001C790000-0x000000001C7A2000-memory.dmp

Download

memory/4648-38-0x000000001CCF0000-0x000000001D218000-memory.dmp

Download

memory/4648-39-0x000000001C7C0000-0x000000001C7CC000-memory.dmp

Download

memory/4648-40-0x000000001C7D0000-0x000000001C7DC000-memory.dmp

Download

memory/4648-42-0x000000001C7F0000-0x000000001C7FC000-memory.dmp

Download

memory/4648-23-0x000000001BED0000-0x000000001BED8000-memory.dmp

Download

memory/4648-43-0x000000001C800000-0x000000001C80C000-memory.dmp

Download

memory/4648-44-0x000000001CA80000-0x000000001CA88000-memory.dmp

Download

memory/4648-45-0x000000001CA10000-0x000000001CA1C000-memory.dmp

Download

memory/4648-47-0x000000001CA30000-0x000000001CA3E000-memory.dmp

Download

memory/4648-46-0x000000001CA20000-0x000000001CA2A000-memory.dmp

Download

memory/4648-49-0x000000001CA50000-0x000000001CA5E000-memory.dmp

Download

memory/4648-48-0x000000001CA40000-0x000000001CA48000-memory.dmp

Download

memory/4648-50-0x000000001BE80000-0x000000001BE88000-memory.dmp

Download

memory/4648-22-0x000000001C590000-0x000000001C5E0000-memory.dmp

Download

memory/4648-21-0x000000001BFF0000-0x000000001C00C000-memory.dmp

Download

memory/4648-20-0x000000001BEC0000-0x000000001BEC8000-memory.dmp

Download

memory/4648-19-0x0000000003490000-0x000000000349E000-memory.dmp

Download

memory/4648-18-0x0000000001B70000-0x0000000001B7E000-memory.dmp

Download

memory/4648-17-0x0000000000F40000-0x00000000012AA000-memory.dmp

Download

memory/4648-51-0x000000001BE90000-0x000000001BE9C000-memory.dmp

Download

memory/4648-53-0x000000001BEB0000-0x000000001BEBA000-memory.dmp

Download

memory/4648-54-0x000000001CA60000-0x000000001CA6C000-memory.dmp

Download

memory/4648-52-0x000000001BEA0000-0x000000001BEA8000-memory.dmp

Download