Overview

overview

10

Static

static

3

AntiHacks.exe

windows7-x64

10

AntiHacks.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2024, 15:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AntiHacks.exe
  • Size 3.2MB
  • Sample240724-sw9ldatanm
  • SHA256 98a4e2ff280909f23eed0a392e94226e5107e327ee73119a9b0ff54b4725ca85
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratcredential_accessdiscoveryevasioninfostealerpersistenceratspywarestealertrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 9 IoCs
    persistence
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 18 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs .reg file with regedit 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\AntiHacks.exe
    "C:\Users\Admin\AppData\Local\Temp\AntiHacks.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\shellbag.exe
      "C:\Users\Admin\AppData\Local\Temp\shellbag.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\ShellNoRoam-BagMRU.reg" "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\ShellNoRoam\BagMRU"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2868
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\ShellNoRoam-Bags.reg" "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\ShellNoRoam\Bags"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:436
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\Shell-BagMRU.reg" "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\BagMRU"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1508
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\Shell-Bags.reg" "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:4124
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\classes-Shell-BagMRU.reg" "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:2116
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\classes-Shell-Bags.reg" "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1224
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\classes-Wow6432Node-Shell-BagMRU.reg" "HKEY_CURRENT_USER\oftware\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\BagMRU"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:1232
      • C:\Windows\SysWOW64\regedit.exe
        "C:\Windows\System32\regedit.exe" /e "C:\Users\Admin\Desktop\ShellBags Backups day=24 hour=15 min=30 s=47\classes-Wow6432Node-Shell-Bags.reg" "HKEY_CURRENT_USER\oftware\Classes\Wow6432Node\Local Settings\Software\Microsoft\Windows\Shell\Bags"
        3⤵
        • System Location Discovery: System Language Discovery
        • Runs .reg file with regedit
        PID:5076
    • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\SurrogatewinDrivernetsvc\R5hC8NuDFM7nyk7qlrM.vbe"
        3⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:956
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\SurrogatewinDrivernetsvc\cKVjGozDO4m75IfUMKm8koxCMJS.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2596
          • C:\SurrogatewinDrivernetsvc\portproviderperf.exe
            "C:\SurrogatewinDrivernetsvc\portproviderperf.exe"
            5⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3284
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8ExUyAgSyK.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4444
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:3840
                • C:\Recovery\WindowsRE\Registry.exe
                  "C:\Recovery\WindowsRE\Registry.exe"
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:3660
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89e51e41-43fe-444e-a8a7-5dfaaf2a29c9.vbs"
                    8⤵
                      PID:4776
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90674d56-10ab-4f75-bb00-69fe27db4a0f.vbs"
                      8⤵
                        PID:1664
                      • C:\Windows\explorer.exe
                        "explorer.exe"
                        8⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SendNotifyMessage
                        PID:4708
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:916
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4308
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1660
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3624
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 10 /tr "'C:\SurrogatewinDrivernetsvc\WaaSMedicAgent.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2304
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\SurrogatewinDrivernetsvc\WaaSMedicAgent.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4836
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\SurrogatewinDrivernetsvc\WaaSMedicAgent.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3172
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\TrustedInstaller.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1092
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\TrustedInstaller.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4324
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Start Menu\TrustedInstaller.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4848
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4844
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4800
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3912
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:540
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4172
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:5068
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\SurrogatewinDrivernetsvc\wininit.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1520
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\SurrogatewinDrivernetsvc\wininit.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2472
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\SurrogatewinDrivernetsvc\wininit.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4496
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Contacts\StartMenuExperienceHost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2116
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\StartMenuExperienceHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1028
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Contacts\StartMenuExperienceHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3580
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4784
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:368
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3024
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\WaaSMedicAgent.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4040
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Default\Templates\WaaSMedicAgent.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1264
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Templates\WaaSMedicAgent.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4892
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3104
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
            PID:1512
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2548
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3784

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                3
                T1547

                Active Setup

                1
                T1547.014

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Impair Defenses

                1
                T1562

                Disable or Modify Tools

                1
                T1562.001

                Modify Registry

                7
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                4
                T1012

                System Information Discovery

                5
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                R5hC8NuDFM7nyk7qlrM.vbe
                • Path C:\SurrogatewinDrivernetsvc\R5hC8NuDFM7nyk7qlrM.vbe
                • Size 228B
                • SHA256 4986b4fab3b58097badee55a3bf54be38f19890f3ee01e37cc88529c6baa19c5
                • MD5 SHA1 SHA512
                Submit Download

                cKVjGozDO4m75IfUMKm8koxCMJS.bat
                • Path C:\SurrogatewinDrivernetsvc\cKVjGozDO4m75IfUMKm8koxCMJS.bat
                • Size 162B
                • SHA256 db58b3dde8508ecbe59d938545246355b52d9cdec29f76657b66638c4d7aeeb2
                • MD5 SHA1 SHA512
                Submit Download

                portproviderperf.exe
                • Path C:\SurrogatewinDrivernetsvc\portproviderperf.exe
                • Size 2.7MB
                • SHA256 9d8b10aec1aad24217494e4dd9f03e17263d896b3a366f84a8412a7ba774d64e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AppCache133663087295981434.txt.~tmp
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133663087295981434.txt.~tmp
                • Size 75KB
                • SHA256 7ce471686f04cde17144fd08c9ff59b992d28e8cc6e7e4848955edae6c1f72de
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                89e51e41-43fe-444e-a8a7-5dfaaf2a29c9.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\89e51e41-43fe-444e-a8a7-5dfaaf2a29c9.vbs
                • Size 710B
                • SHA256 9fc42fdfb6e217c098e91fd86e3ea4e98aef0637b571920c8728db98e06ebd90
                • MD5 SHA1 SHA512
                Submit Download

                8ExUyAgSyK.bat
                • Path C:\Users\Admin\AppData\Local\Temp\8ExUyAgSyK.bat
                • Size 199B
                • SHA256 5cb215e2ec19fccd99ffdcd5e0d65f2746a3e36834a4686423d3eb25615953f9
                • MD5 SHA1 SHA512
                Submit Download

                90674d56-10ab-4f75-bb00-69fe27db4a0f.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\90674d56-10ab-4f75-bb00-69fe27db4a0f.vbs
                • Size 486B
                • SHA256 7f7c5540ffcbca76fcade36d4c393b1874f2c5a5bbd33840227a8ae7812dfa29
                • MD5 SHA1 SHA512
                Submit Download

                DCRatBuild.exe
                • Path C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
                • Size 3.0MB
                • SHA256 4cfea92da3cccd5a9023896c9c83de3f755aa79ee26a67b471d569ccbbc36f8c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                shellbag.exe
                • Path C:\Users\Admin\AppData\Local\Temp\shellbag.exe
                • Size 1.6MB
                • SHA256 c93a0f4c6b5f24ee31cddb92b0ea3337021b5fb91faae8a381d3bd2c9b6add54
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/2952-24-0x0000000000400000-0x0000000000572000-memory.dmp
                Download

                memory/2952-155-0x0000000000400000-0x0000000000572000-memory.dmp
                Download

                memory/2952-23-0x0000000000409000-0x000000000040A000-memory.dmp
                Download

                memory/2952-150-0x0000000000400000-0x0000000000572000-memory.dmp
                Download

                memory/2952-149-0x0000000000400000-0x0000000000572000-memory.dmp
                Download

                memory/2952-97-0x0000000002420000-0x0000000002421000-memory.dmp
                Download

                memory/2952-21-0x0000000002420000-0x0000000002421000-memory.dmp
                Download

                memory/2952-156-0x0000000000400000-0x0000000000572000-memory.dmp
                Download

                memory/2952-83-0x0000000000400000-0x0000000000572000-memory.dmp
                Download

                memory/3284-39-0x0000000000B10000-0x0000000000DC2000-memory.dmp
                Download

                memory/3284-45-0x0000000002F50000-0x0000000002F5C000-memory.dmp
                Download

                memory/3284-47-0x000000001C0D0000-0x000000001C126000-memory.dmp
                Download

                memory/3284-48-0x0000000002F70000-0x0000000002F82000-memory.dmp
                Download

                memory/3284-49-0x000000001C670000-0x000000001CB98000-memory.dmp
                Download

                memory/3284-50-0x0000000002F80000-0x0000000002F8C000-memory.dmp
                Download

                memory/3284-51-0x000000001C140000-0x000000001C14C000-memory.dmp
                Download

                memory/3284-52-0x000000001C150000-0x000000001C15C000-memory.dmp
                Download

                memory/3284-53-0x000000001C3D0000-0x000000001C3D8000-memory.dmp
                Download

                memory/3284-55-0x000000001C370000-0x000000001C37E000-memory.dmp
                Download

                memory/3284-54-0x000000001C360000-0x000000001C36A000-memory.dmp
                Download

                memory/3284-57-0x000000001C390000-0x000000001C39A000-memory.dmp
                Download

                memory/3284-56-0x000000001C380000-0x000000001C388000-memory.dmp
                Download

                memory/3284-58-0x000000001C3A0000-0x000000001C3AC000-memory.dmp
                Download

                memory/3284-43-0x0000000002F30000-0x0000000002F46000-memory.dmp
                Download

                memory/3284-46-0x0000000002F60000-0x0000000002F6A000-memory.dmp
                Download

                memory/3284-44-0x0000000002F10000-0x0000000002F18000-memory.dmp
                Download

                memory/3284-42-0x0000000002F00000-0x0000000002F08000-memory.dmp
                Download

                memory/3284-41-0x000000001BA70000-0x000000001BAC0000-memory.dmp
                Download

                memory/3284-40-0x0000000002EE0000-0x0000000002EFC000-memory.dmp
                Download

                memory/3660-159-0x000000001BF60000-0x000000001BF76000-memory.dmp
                Download

                memory/3784-163-0x0000020365100000-0x0000020365200000-memory.dmp
                Download

                memory/3784-164-0x0000020365100000-0x0000020365200000-memory.dmp
                Download

                memory/3784-167-0x0000020366260000-0x0000020366280000-memory.dmp
                Download

                memory/3784-162-0x0000020365100000-0x0000020365200000-memory.dmp
                Download

                memory/3784-198-0x0000020366630000-0x0000020366650000-memory.dmp
                Download

                memory/3784-175-0x0000020366220000-0x0000020366240000-memory.dmp
                Download

                memory/4708-160-0x00000000037D0000-0x00000000037D1000-memory.dmp
                Download

                memory/4812-0-0x00007FFD30A13000-0x00007FFD30A15000-memory.dmp
                Download

                memory/4812-25-0x00007FFD30A10000-0x00007FFD314D1000-memory.dmp
                Download

                memory/4812-3-0x00007FFD30A10000-0x00007FFD314D1000-memory.dmp
                Download

                memory/4812-1-0x00000000002A0000-0x00000000005CC000-memory.dmp
                Download