dcrat | 7cef1a964acbe38f4796b9ddbbd95e3fc19215594b2f3ab74483d58fe4bb93ad

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
17babc686738c7b611b9e9e028c8ef34.exe
Size 3.0MB
Sample240819-23dlysvcnm
SHA256 7cef1a964acbe38f4796b9ddbbd95e3fc19215594b2f3ab74483d58fe4bb93ad
MD5 17babc686738c7b611b9e9e028c8ef34
SHA1 8c959decebcb5544528e2a76f66e73c401e19be8
SHA512 c7e2f881e6eb09e25c08c76b88b7626c768fb3e623b39b538e7b84f02fb6382bf5b4e0d66835c63cf59d1346e91b5bc3b60a6335bab90d5f185d81e5f9a52fe8
SSDEEP 49152:XYh4gIPIBXyjBVVIfVl+rf9LTewShH16PScTtMf6ajJPgqk5lZt:ggQBnoRT6EPS0t66KOlZt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3516	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	392	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4472	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2920	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3784	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4484	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	728	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2964	2832	schtasks.exe	94
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2832	schtasks.exe	94

UAC bypass 3 TTPs 33 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	17babc686738c7b611b9e9e028c8ef34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	17babc686738c7b611b9e9e028c8ef34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	17babc686738c7b611b9e9e028c8ef34.exe

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/4616-1-0x0000000000CE0000-0x0000000000FE0000-memory.dmp	dcrat
behavioral2/files/0x00070000000235ac-38.dat	dcrat

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	17babc686738c7b611b9e9e028c8ef34.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 10 IoCs

pid	Process
4816	RuntimeBroker.exe
1116	RuntimeBroker.exe
3044	RuntimeBroker.exe
1336	RuntimeBroker.exe
4688	RuntimeBroker.exe
3976	RuntimeBroker.exe
2572	RuntimeBroker.exe
2224	RuntimeBroker.exe
4200	RuntimeBroker.exe
4532	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 22 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	17babc686738c7b611b9e9e028c8ef34.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	17babc686738c7b611b9e9e028c8ef34.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
29	pastebin.com
41	pastebin.com
90	pastebin.com
98	pastebin.com
28	pastebin.com
52	pastebin.com
62	pastebin.com
68	pastebin.com
73	pastebin.com
101	pastebin.com

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Mail\6ccacd8608530f	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files\Crashpad\attachments\6cb0b6c459d5d3	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\9e8d7a4ca61bd9	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows NT\0a1fd5f707cd16	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\22528c209bddc1	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files\Windows Defender\en-US\61a52ddc9dd915	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\TextInputHost.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\22eafd247d37c3	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows NT\sppsvc.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows Mail\Idle.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files\Crashpad\attachments\dwm.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files\Windows Defender\en-US\msedge.exe	17babc686738c7b611b9e9e028c8ef34.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\msedge.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\e1ef82546f0b02	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\17babc686738c7b611b9e9e028c8ef34.exe	17babc686738c7b611b9e9e028c8ef34.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\PrintDialog\pris\e1ef82546f0b02	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Windows\Resources\smss.exe	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Windows\Resources\69ddcba757bf72	17babc686738c7b611b9e9e028c8ef34.exe
File created	C:\Windows\PrintDialog\pris\SppExtComObj.exe	17babc686738c7b611b9e9e028c8ef34.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	17babc686738c7b611b9e9e028c8ef34.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4948	schtasks.exe
436	schtasks.exe
2964	schtasks.exe
728	schtasks.exe
4276	schtasks.exe
1180	schtasks.exe
1540	schtasks.exe
5052	schtasks.exe
2920	schtasks.exe
2756	schtasks.exe
392	schtasks.exe
1388	schtasks.exe
4836	schtasks.exe
5068	schtasks.exe
3056	schtasks.exe
2572	schtasks.exe
3784	schtasks.exe
2504	schtasks.exe
2316	schtasks.exe
1016	schtasks.exe
4920	schtasks.exe
2088	schtasks.exe
3336	schtasks.exe
4484	schtasks.exe
3988	schtasks.exe
1516	schtasks.exe
3392	schtasks.exe
3368	schtasks.exe
4224	schtasks.exe
4076	schtasks.exe
696	schtasks.exe
4764	schtasks.exe
220	schtasks.exe
408	schtasks.exe
3516	schtasks.exe
4012	schtasks.exe
4476	schtasks.exe
852	schtasks.exe
4072	schtasks.exe
2240	schtasks.exe
1860	schtasks.exe
4452	schtasks.exe
4860	schtasks.exe
4472	schtasks.exe
4508	schtasks.exe
4160	schtasks.exe
2252	schtasks.exe
3508	schtasks.exe
2724	schtasks.exe
1068	schtasks.exe
1592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
4616	17babc686738c7b611b9e9e028c8ef34.exe
4616	17babc686738c7b611b9e9e028c8ef34.exe
4616	17babc686738c7b611b9e9e028c8ef34.exe
4616	17babc686738c7b611b9e9e028c8ef34.exe
4616	17babc686738c7b611b9e9e028c8ef34.exe
4816	RuntimeBroker.exe
4816	RuntimeBroker.exe
1116	RuntimeBroker.exe
1116	RuntimeBroker.exe
3044	RuntimeBroker.exe
3044	RuntimeBroker.exe
1336	RuntimeBroker.exe
1336	RuntimeBroker.exe
4688	RuntimeBroker.exe
4688	RuntimeBroker.exe
3976	RuntimeBroker.exe
3976	RuntimeBroker.exe
2572	RuntimeBroker.exe
2572	RuntimeBroker.exe
2224	RuntimeBroker.exe
2224	RuntimeBroker.exe
4200	RuntimeBroker.exe
4200	RuntimeBroker.exe
4532	RuntimeBroker.exe
4532	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	17babc686738c7b611b9e9e028c8ef34.exe
Token: SeDebugPrivilege	4816	RuntimeBroker.exe
Token: SeDebugPrivilege	1116	RuntimeBroker.exe
Token: SeDebugPrivilege	3044	RuntimeBroker.exe
Token: SeDebugPrivilege	1336	RuntimeBroker.exe
Token: SeDebugPrivilege	4688	RuntimeBroker.exe
Token: SeDebugPrivilege	3976	RuntimeBroker.exe
Token: SeDebugPrivilege	2572	RuntimeBroker.exe
Token: SeDebugPrivilege	2224	RuntimeBroker.exe
Token: SeDebugPrivilege	4200	RuntimeBroker.exe
Token: SeDebugPrivilege	4532	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4376	4616	17babc686738c7b611b9e9e028c8ef34.exe	146
PID 4616 wrote to memory of 4376	4616	17babc686738c7b611b9e9e028c8ef34.exe	146
PID 4376 wrote to memory of 3924	4376	cmd.exe	148
PID 4376 wrote to memory of 3924	4376	cmd.exe	148
PID 4376 wrote to memory of 4816	4376	cmd.exe	153
PID 4376 wrote to memory of 4816	4376	cmd.exe	153
PID 4816 wrote to memory of 5068	4816	RuntimeBroker.exe	155
PID 4816 wrote to memory of 5068	4816	RuntimeBroker.exe	155
PID 4816 wrote to memory of 4564	4816	RuntimeBroker.exe	156
PID 4816 wrote to memory of 4564	4816	RuntimeBroker.exe	156
PID 5068 wrote to memory of 1116	5068	WScript.exe	159
PID 5068 wrote to memory of 1116	5068	WScript.exe	159
PID 1116 wrote to memory of 3380	1116	RuntimeBroker.exe	160
PID 1116 wrote to memory of 3380	1116	RuntimeBroker.exe	160
PID 1116 wrote to memory of 3236	1116	RuntimeBroker.exe	161
PID 1116 wrote to memory of 3236	1116	RuntimeBroker.exe	161
PID 3380 wrote to memory of 3044	3380	WScript.exe	164
PID 3380 wrote to memory of 3044	3380	WScript.exe	164
PID 3044 wrote to memory of 2276	3044	RuntimeBroker.exe	166
PID 3044 wrote to memory of 2276	3044	RuntimeBroker.exe	166
PID 3044 wrote to memory of 1448	3044	RuntimeBroker.exe	167
PID 3044 wrote to memory of 1448	3044	RuntimeBroker.exe	167
PID 2276 wrote to memory of 1336	2276	WScript.exe	168
PID 2276 wrote to memory of 1336	2276	WScript.exe	168
PID 1336 wrote to memory of 4224	1336	RuntimeBroker.exe	169
PID 1336 wrote to memory of 4224	1336	RuntimeBroker.exe	169
PID 1336 wrote to memory of 1848	1336	RuntimeBroker.exe	170
PID 1336 wrote to memory of 1848	1336	RuntimeBroker.exe	170
PID 4224 wrote to memory of 4688	4224	WScript.exe	172
PID 4224 wrote to memory of 4688	4224	WScript.exe	172
PID 4688 wrote to memory of 4056	4688	RuntimeBroker.exe	173
PID 4688 wrote to memory of 4056	4688	RuntimeBroker.exe	173
PID 4688 wrote to memory of 780	4688	RuntimeBroker.exe	174
PID 4688 wrote to memory of 780	4688	RuntimeBroker.exe	174
PID 4056 wrote to memory of 3976	4056	WScript.exe	175
PID 4056 wrote to memory of 3976	4056	WScript.exe	175
PID 3976 wrote to memory of 3020	3976	RuntimeBroker.exe	176
PID 3976 wrote to memory of 3020	3976	RuntimeBroker.exe	176
PID 3976 wrote to memory of 4424	3976	RuntimeBroker.exe	177
PID 3976 wrote to memory of 4424	3976	RuntimeBroker.exe	177
PID 3020 wrote to memory of 2572	3020	WScript.exe	178
PID 3020 wrote to memory of 2572	3020	WScript.exe	178
PID 2572 wrote to memory of 3616	2572	RuntimeBroker.exe	181
PID 2572 wrote to memory of 3616	2572	RuntimeBroker.exe	181
PID 2572 wrote to memory of 1312	2572	RuntimeBroker.exe	182
PID 2572 wrote to memory of 1312	2572	RuntimeBroker.exe	182
PID 2224 wrote to memory of 4916	2224	RuntimeBroker.exe	186
PID 2224 wrote to memory of 4916	2224	RuntimeBroker.exe	186
PID 2224 wrote to memory of 3864	2224	RuntimeBroker.exe	187
PID 2224 wrote to memory of 3864	2224	RuntimeBroker.exe	187
PID 4916 wrote to memory of 4200	4916	WScript.exe	193
PID 4916 wrote to memory of 4200	4916	WScript.exe	193
PID 4200 wrote to memory of 392	4200	RuntimeBroker.exe	194
PID 4200 wrote to memory of 392	4200	RuntimeBroker.exe	194
PID 4200 wrote to memory of 3336	4200	RuntimeBroker.exe	195
PID 4200 wrote to memory of 3336	4200	RuntimeBroker.exe	195
PID 392 wrote to memory of 4532	392	WScript.exe	197
PID 392 wrote to memory of 4532	392	WScript.exe	197
PID 4532 wrote to memory of 4992	4532	RuntimeBroker.exe	198
PID 4532 wrote to memory of 4992	4532	RuntimeBroker.exe	198
PID 4532 wrote to memory of 3784	4532	RuntimeBroker.exe	199
PID 4532 wrote to memory of 3784	4532	RuntimeBroker.exe	199

System policy modification 1 TTPs 33 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	17babc686738c7b611b9e9e028c8ef34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	17babc686738c7b611b9e9e028c8ef34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	17babc686738c7b611b9e9e028c8ef34.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\17babc686738c7b611b9e9e028c8ef34.exe
"C:\Users\Admin\AppData\Local\Temp\17babc686738c7b611b9e9e028c8ef34.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dyywNDS382.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3924
- - C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
    "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4816
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab7b81aa-f05d-426a-a8f9-f104d3c50302.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1116
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25f18013-7256-435c-a885-ad4e19864230.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90e2dfc7-9f6e-438b-817e-468fe7bbc6ed.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        9⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0d96f2a-547f-40cc-a794-e20b809f70b9.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        11⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4688
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df273bbd-f5d2-4246-ac89-3f6b098c2ead.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        13⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3976
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\694893f8-419b-42ff-baf6-e998199cacc5.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        15⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2572
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7194668e-8d27-4f51-b046-1a4898740a78.vbs"
        16⤵
        
        PID:3616
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        17⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2224
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31027de9-a76d-4584-88d9-f3982e6d93d4.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        19⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb4e0294-3270-4205-8ada-9665686b8441.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe
        
        "C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe"
        21⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49efcb70-4610-4796-959b-28f7c3bd3cad.vbs"
        22⤵
        
        PID:4992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f47bc57-e229-4919-9c08-ff872422418f.vbs"
        22⤵
        
        PID:3784
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c7575a4-b8b6-4474-8acf-435a43edea71.vbs"
        20⤵
        
        PID:3336
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1198829f-2c33-4906-bcd6-25e7536bc4e0.vbs"
        18⤵
        
        PID:3864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\259cc345-74d5-4063-b466-f44f4dcbcee5.vbs"
        16⤵
        
        PID:1312
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\954109f5-2028-46d5-a095-dca63769bb3c.vbs"
        14⤵
        
        PID:4424
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5b1787e-8622-4a7b-9e64-bfcbfdc4fc2a.vbs"
        12⤵
        
        PID:780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22ef03cb-7cfa-4f55-93fe-6c6acf7e66d2.vbs"
        10⤵
        
        PID:1848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a8c34c6-c2c6-4779-9e57-1e85240757fa.vbs"
        8⤵
        
        PID:1448
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f9d86c82-53d1-42c0-8d79-13bc8ba7dea5.vbs"
        6⤵
        
        PID:3236
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bcba27b-c351-4fce-adb8-b888fc039cdc.vbs"
      4⤵
      PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\en-US\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\en-US\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\en-US\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Public\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Public\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Resources\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\NetHood\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Crashpad\attachments\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Crashpad\attachments\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Windows\PrintDialog\pris\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\PrintDialog\pris\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\PrintDialog\pris\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows NT\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "17babc686738c7b611b9e9e028c8ef341" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\17babc686738c7b611b9e9e028c8ef34.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "17babc686738c7b611b9e9e028c8ef34" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\17babc686738c7b611b9e9e028c8ef34.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "17babc686738c7b611b9e9e028c8ef341" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\17babc686738c7b611b9e9e028c8ef34.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1036,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:8
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Idle.exe

Path C:\Program Files (x86)\Windows Mail\Idle.exe
Size 3.0MB
SHA256 7cef1a964acbe38f4796b9ddbbd95e3fc19215594b2f3ab74483d58fe4bb93ad
MD5 17babc686738c7b611b9e9e028c8ef34
SHA1 8c959decebcb5544528e2a76f66e73c401e19be8
SHA512 c7e2f881e6eb09e25c08c76b88b7626c768fb3e623b39b538e7b84f02fb6382bf5b4e0d66835c63cf59d1346e91b5bc3b60a6335bab90d5f185d81e5f9a52fe8
SSDEEP 49152:XYh4gIPIBXyjBVVIfVl+rf9LTewShH16PScTtMf6ajJPgqk5lZt:ggQBnoRT6EPS0t66KOlZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

RuntimeBroker.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
Size 1KB
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
MD5 SHA1 SHA512

Submit Download

25f18013-7256-435c-a885-ad4e19864230.vbs

Path C:\Users\Admin\AppData\Local\Temp\25f18013-7256-435c-a885-ad4e19864230.vbs
Size 739B
SHA256 90a3ff66c49fbf4949d3fa494efd90174d3500350d5c4c2d2fb0637cb9e7b1fc
MD5 695d722cc2a55dd37f1a94478a24a230
SHA1 e0a2d301a9bff92a2b0950977b1b46d5c7c67132
SHA512 46f97e600521176ff3de3b058ba1dd30807c05c3e39005a3d0e21052943c28de0293b6d3822dde0b7ebeb6aad133374e0c0fc053c1419e967560508689e20358
MD5 SHA1 SHA512

Submit Download

31027de9-a76d-4584-88d9-f3982e6d93d4.vbs

Path C:\Users\Admin\AppData\Local\Temp\31027de9-a76d-4584-88d9-f3982e6d93d4.vbs
Size 739B
SHA256 a72013322524fc5509f40454bb599b646b9bb19d25011fa304c3a332f5678967
MD5 f6e968b9623f3519ff54f9a5db687ca7
SHA1 00e45ba4fe894625da11b32b0ee8078235da3a59
SHA512 4f17a18b45812a58825225c7025e9550a5fc9a590de845e6546e498fc1db8d28fba6027f74992974587fd2440dec2ef2606c0a4c0f0f5dbc85e010ec0a27f7d2
MD5 SHA1 SHA512

Submit Download

49efcb70-4610-4796-959b-28f7c3bd3cad.vbs

Path C:\Users\Admin\AppData\Local\Temp\49efcb70-4610-4796-959b-28f7c3bd3cad.vbs
Size 739B
SHA256 576d26d041b4bf38e79ae4e6f391adef780e888aacff3300f14db5eb381627a4
MD5 d27899f8bd3d9957f06661f139d34fde
SHA1 9aec9283be5358cb76c0d6b511b60c5838f07171
SHA512 4adfcb0288380fdf81142925b7e53178b975e3cb282cedc83b33254618c2c4ef324f655ff84eeadd41fbc353f6800fb17e74d810cc94842b804f4c64e5769586
MD5 SHA1 SHA512

Submit Download

694893f8-419b-42ff-baf6-e998199cacc5.vbs

Path C:\Users\Admin\AppData\Local\Temp\694893f8-419b-42ff-baf6-e998199cacc5.vbs
Size 739B
SHA256 7dad60a620d8c737ab87634bcbc6c3beeb634b7629d5f3469fca8f321f3a0034
MD5 7181c3391395ff5695783f8489bb67bd
SHA1 97278cabf61eec24f2b6c25962788fd707e2f8d3
SHA512 fdf7903782f105146fb7b542cebf1ce19bf1a942e1cd579e8fbced1370feaf3ef9b09b38e6e4a846c7206d13e8939265d04b66f72e6ae18a158a5793dfa7979d
MD5 SHA1 SHA512

Submit Download

8bcba27b-c351-4fce-adb8-b888fc039cdc.vbs

Path C:\Users\Admin\AppData\Local\Temp\8bcba27b-c351-4fce-adb8-b888fc039cdc.vbs
Size 515B
SHA256 8928ec88aa6de2fe0f2ffa7f685b68173749a78b06476a033df1f15b6fdefcfc
MD5 0b810a28072b4b9c6882cd8c6deaa6ca
SHA1 f5fcc7ff8482c58b96edab5d6b98234d09d5d60b
SHA512 dc8f83237d3bee8f6050512681b3d80c99228bfceb3c7f68fbee45d6bfdcee3b8793fcdf427580556e249763dc1c7d918426f6537cbd2f6be41f72352a471baa
MD5 SHA1 SHA512

Submit Download

90e2dfc7-9f6e-438b-817e-468fe7bbc6ed.vbs

Path C:\Users\Admin\AppData\Local\Temp\90e2dfc7-9f6e-438b-817e-468fe7bbc6ed.vbs
Size 739B
SHA256 f564e0db1ae52d92c9f4f16ff8eb337d0dbe5dd25026d7154bcc0934fb8acad3
MD5 56be8265ff02205ade503f9503ffc0bf
SHA1 065e2184aa88cae36ab155a3608d3845b4ebbcf4
SHA512 b1b73359a270d73433c6b762f2771ebd51b2fa458cec79cf6ced892f8914e2cfa4607b88f3c4530d38b7c818d08074f60aba0bcdadaee6904b1fd2a4314da1e0
MD5 SHA1 SHA512

Submit Download

ab7b81aa-f05d-426a-a8f9-f104d3c50302.vbs

Path C:\Users\Admin\AppData\Local\Temp\ab7b81aa-f05d-426a-a8f9-f104d3c50302.vbs
Size 739B
SHA256 f90d881956d356eac45e76d83db901c73474ad13cc9eeab01658179d677637ea
MD5 53beb0f723edd5dbcd01ac53e2695081
SHA1 08639e9c632e1e903cd82d6a63c5708faccefd84
SHA512 13a544892f2ff6184e2b7a60788df25beb0f3185facaad10fb29c7d0ca6d04a995d99e75e108599d92288ef12fca44be123a6a45cca7935cc3b4960565d99d75
MD5 SHA1 SHA512

Submit Download

df273bbd-f5d2-4246-ac89-3f6b098c2ead.vbs

Path C:\Users\Admin\AppData\Local\Temp\df273bbd-f5d2-4246-ac89-3f6b098c2ead.vbs
Size 739B
SHA256 378cf4b1c1653cde60522d5584d3e75c265df5d82e9b3a66ae7152aab32d1ebb
MD5 5bc828870b5c1b87603dc21f9bbd90f2
SHA1 d9afe85ebe850c6f224861a14229bfdb09c7c351
SHA512 697a7748454916e76c265f89b55e0eb9eb07c2e510064a19cbd048bff665e702afea4804ecad8b1b930442e9fe56c59f41a27e8cfad6d4285c428d8f9c9481b7
MD5 SHA1 SHA512

Submit Download

dyywNDS382.bat

Path C:\Users\Admin\AppData\Local\Temp\dyywNDS382.bat
Size 228B
SHA256 438efd9199b60ad49f241393d5930193cc45a5c0ef149f450c5676ce89fa78f7
MD5 d0505a2ca4bb6cc55ef91fb396451574
SHA1 c8bb6aef4933e613e6edbf2c2c51db087852383a
SHA512 0efed4e5118a6a4c6f4a94716c8953159e2312bf3d8f5c767aca534e41d18d68ae8491b4a2774d04f1e2f6674472e4278b574b003ad991d52ba156e59732154e
MD5 SHA1 SHA512

Submit Download

eb4e0294-3270-4205-8ada-9665686b8441.vbs

Path C:\Users\Admin\AppData\Local\Temp\eb4e0294-3270-4205-8ada-9665686b8441.vbs
Size 739B
SHA256 3c2105742fd81c04a5e1065a4e307473b0cbfa9936bc2b499a5e51ead3591291
MD5 ee1fd13a736770520e665e19920e691e
SHA1 dffb6c293910960f14ea4e67dce661cfe9ff3436
SHA512 f0580a460cee213c7fbbee350878ca511a1c3167b1b974fd000bff332c519e7e55eff44ffd1cf5b8cdfe93c1dd791806997860dbd87bff0937cea52eaedbd009
MD5 SHA1 SHA512

Submit Download

f0d96f2a-547f-40cc-a794-e20b809f70b9.vbs

Path C:\Users\Admin\AppData\Local\Temp\f0d96f2a-547f-40cc-a794-e20b809f70b9.vbs
Size 739B
SHA256 f505ebf417f59bc740dc91f4b52b4b105c86d9f5c5c8a94b42cd6b282e4012b0
MD5 a58bd7118461e218934b1fb4b048f67a
SHA1 004175b8abac0130b8db626d937ebf596b9b9c09
SHA512 72397e35982dea353b5a5b883ca8a82b761a8ef1e70cd2f3abeae249329911742ec8c26ddda4dcbab4b106b65014ff7c57ac3ff84581137cdc9bab9f7ebea8c6
MD5 SHA1 SHA512

Submit Download

memory/1116-87-0x000000001BFC0000-0x000000001BFD2000-memory.dmp

Download

memory/2572-145-0x000000001CD40000-0x000000001CD52000-memory.dmp

Download

memory/3976-133-0x000000001D030000-0x000000001D042000-memory.dmp

Download

memory/4532-178-0x000000001C9F0000-0x000000001CA02000-memory.dmp

Download

memory/4616-8-0x000000001BC20000-0x000000001BC28000-memory.dmp

Download

memory/4616-15-0x000000001BE10000-0x000000001BE66000-memory.dmp

Download

memory/4616-20-0x000000001C4A0000-0x000000001C4B2000-memory.dmp

Download

memory/4616-19-0x000000001C490000-0x000000001C498000-memory.dmp

Download

memory/4616-21-0x000000001CA00000-0x000000001CF28000-memory.dmp

Download

memory/4616-23-0x000000001C4E0000-0x000000001C4E8000-memory.dmp

Download

memory/4616-28-0x000000001C510000-0x000000001C51A000-memory.dmp

Download

memory/4616-29-0x000000001C520000-0x000000001C52C000-memory.dmp

Download

memory/4616-27-0x000000001C500000-0x000000001C508000-memory.dmp

Download

memory/4616-26-0x000000001C4F0000-0x000000001C4F8000-memory.dmp

Download

memory/4616-25-0x000000001C600000-0x000000001C60E000-memory.dmp

Download

memory/4616-24-0x000000001C5F0000-0x000000001C5FA000-memory.dmp

Download

memory/4616-22-0x000000001C4D0000-0x000000001C4D8000-memory.dmp

Download

memory/4616-17-0x000000001C470000-0x000000001C478000-memory.dmp

Download

memory/4616-16-0x000000001BDF0000-0x000000001BDFC000-memory.dmp

Download

memory/4616-70-0x00007FFC74E80000-0x00007FFC75941000-memory.dmp

Download

memory/4616-1-0x0000000000CE0000-0x0000000000FE0000-memory.dmp

Download

memory/4616-18-0x000000001C480000-0x000000001C48C000-memory.dmp

Download

memory/4616-14-0x000000001BDE0000-0x000000001BDEA000-memory.dmp

Download

memory/4616-13-0x000000001BE00000-0x000000001BE10000-memory.dmp

Download

memory/4616-0-0x00007FFC74E83000-0x00007FFC74E85000-memory.dmp

Download

memory/4616-9-0x000000001BC30000-0x000000001BC40000-memory.dmp

Download

memory/4616-12-0x000000001BDD0000-0x000000001BDE2000-memory.dmp

Download

memory/4616-10-0x000000001BC40000-0x000000001BC56000-memory.dmp

Download

memory/4616-2-0x00007FFC74E80000-0x00007FFC75941000-memory.dmp

Download

memory/4616-11-0x000000001BC60000-0x000000001BC68000-memory.dmp

Download

memory/4616-7-0x000000001BD80000-0x000000001BDD0000-memory.dmp

Download

memory/4616-6-0x000000001BC00000-0x000000001BC1C000-memory.dmp

Download

memory/4616-5-0x000000001BBF0000-0x000000001BBF8000-memory.dmp

Download

memory/4616-4-0x00000000030F0000-0x00000000030FE000-memory.dmp

Download

memory/4616-3-0x00000000030E0000-0x00000000030EE000-memory.dmp

Download

memory/4688-121-0x000000001CC00000-0x000000001CC12000-memory.dmp

Download

memory/4816-74-0x000000001CD30000-0x000000001CD86000-memory.dmp

Download