dcrat | 057029b10fb991791435ba26d2715749bad8114beb7652132c0e8471d0200d11

Analysis

max time kernel
117s
max time network
107s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f604c1ca06db7206f1699e6d908a7a0N.exe
Size

4.9MB
MD5

7f604c1ca06db7206f1699e6d908a7a0
SHA1

ba7e4204908407f64ce41d867a312b970c450ca3
SHA256

057029b10fb991791435ba26d2715749bad8114beb7652132c0e8471d0200d11
SHA512

04ac0f43e282eecaedd7ca0012469145269780ff54b792d511f025851df0974ad1ae568a22e80e78e5b444431e9ebea60e3dcb77a0c9233faee7b758d5354ee8
SSDEEP

49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion execution infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2652	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	2804	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2804	schtasks.exe

UAC bypass 3 TTPs 30 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe7f604c1ca06db7206f1699e6d908a7a0N.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7f604c1ca06db7206f1699e6d908a7a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7f604c1ca06db7206f1699e6d908a7a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7f604c1ca06db7206f1699e6d908a7a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/2120-2-0x000000001B560000-0x000000001B68E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
296	powershell.exe
2832	powershell.exe
2812	powershell.exe
1588	powershell.exe
1820	powershell.exe
1932	powershell.exe
568	powershell.exe
2816	powershell.exe
2848	powershell.exe
1260	powershell.exe
1936	powershell.exe
540	powershell.exe

Executes dropped EXE 9 IoCs

Processes:

csrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid process

484 csrss.exe
3056 csrss.exe
2548 csrss.exe
1576 csrss.exe
1668 csrss.exe
2584 csrss.exe
2312 csrss.exe
1932 csrss.exe
2988 csrss.exe

pid	process
484	csrss.exe
3056	csrss.exe
2548	csrss.exe
1576	csrss.exe
1668	csrss.exe
2584	csrss.exe
2312	csrss.exe
1932	csrss.exe
2988	csrss.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

csrss.execsrss.execsrss.exe7f604c1ca06db7206f1699e6d908a7a0N.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7f604c1ca06db7206f1699e6d908a7a0N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7f604c1ca06db7206f1699e6d908a7a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe

Drops file in Program Files directory 8 IoCs

Processes:

7f604c1ca06db7206f1699e6d908a7a0N.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Mail\de-DE\csrss.exe	7f604c1ca06db7206f1699e6d908a7a0N.exe
File created	C:\Program Files\Windows Mail\de-DE\886983d96e3d3e	7f604c1ca06db7206f1699e6d908a7a0N.exe
File created	C:\Program Files (x86)\Windows Defender\7f604c1ca06db7206f1699e6d908a7a0N.exe	7f604c1ca06db7206f1699e6d908a7a0N.exe
File created	C:\Program Files (x86)\Windows Defender\3893ee64fab4b3	7f604c1ca06db7206f1699e6d908a7a0N.exe
File opened for modification	C:\Program Files\Windows Mail\de-DE\RCX2453.tmp	7f604c1ca06db7206f1699e6d908a7a0N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\RCX2657.tmp	7f604c1ca06db7206f1699e6d908a7a0N.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\7f604c1ca06db7206f1699e6d908a7a0N.exe	7f604c1ca06db7206f1699e6d908a7a0N.exe
File created	C:\Program Files\Windows Mail\de-DE\csrss.exe	7f604c1ca06db7206f1699e6d908a7a0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2652	schtasks.exe
2416	schtasks.exe
2720	schtasks.exe
2596	schtasks.exe
2268	schtasks.exe
1792	schtasks.exe
2280	schtasks.exe
2988	schtasks.exe
2628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

7f604c1ca06db7206f1699e6d908a7a0N.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.execsrss.exe

pid	process
2120	7f604c1ca06db7206f1699e6d908a7a0N.exe
1820	powershell.exe
2832	powershell.exe
1260	powershell.exe
568	powershell.exe
2848	powershell.exe
296	powershell.exe
540	powershell.exe
1588	powershell.exe
1936	powershell.exe
1932	powershell.exe
2812	powershell.exe
2816	powershell.exe
484	csrss.exe
3056	csrss.exe
2548	csrss.exe
1576	csrss.exe
1668	csrss.exe
2584	csrss.exe
2312	csrss.exe
1932	csrss.exe
2988	csrss.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	296	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	484	csrss.exe
Token: SeDebugPrivilege	3056	csrss.exe
Token: SeDebugPrivilege	2548	csrss.exe
Token: SeDebugPrivilege	1576	csrss.exe
Token: SeDebugPrivilege	1668	csrss.exe
Token: SeDebugPrivilege	2584	csrss.exe
Token: SeDebugPrivilege	2312	csrss.exe
Token: SeDebugPrivilege	1932	csrss.exe
Token: SeDebugPrivilege	2988	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7f604c1ca06db7206f1699e6d908a7a0N.execsrss.exeWScript.execsrss.exeWScript.execsrss.exeWScript.exe

description	pid	process	target process
PID 2120 wrote to memory of 1260	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1260	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1260	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1588	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1588	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1588	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1820	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1820	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1820	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1932	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1932	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1932	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1936	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1936	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 1936	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 540	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 540	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 540	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 296	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 296	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 296	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 568	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 568	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 568	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2816	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2816	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2816	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2832	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2832	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2832	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2848	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2848	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2848	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2812	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2812	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 2812	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	powershell.exe
PID 2120 wrote to memory of 484	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	csrss.exe
PID 2120 wrote to memory of 484	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	csrss.exe
PID 2120 wrote to memory of 484	2120	7f604c1ca06db7206f1699e6d908a7a0N.exe	csrss.exe
PID 484 wrote to memory of 3024	484	csrss.exe	WScript.exe
PID 484 wrote to memory of 3024	484	csrss.exe	WScript.exe
PID 484 wrote to memory of 3024	484	csrss.exe	WScript.exe
PID 484 wrote to memory of 2268	484	csrss.exe	WScript.exe
PID 484 wrote to memory of 2268	484	csrss.exe	WScript.exe
PID 484 wrote to memory of 2268	484	csrss.exe	WScript.exe
PID 3024 wrote to memory of 3056	3024	WScript.exe	csrss.exe
PID 3024 wrote to memory of 3056	3024	WScript.exe	csrss.exe
PID 3024 wrote to memory of 3056	3024	WScript.exe	csrss.exe
PID 3056 wrote to memory of 2016	3056	csrss.exe	WScript.exe
PID 3056 wrote to memory of 2016	3056	csrss.exe	WScript.exe
PID 3056 wrote to memory of 2016	3056	csrss.exe	WScript.exe
PID 3056 wrote to memory of 796	3056	csrss.exe	WScript.exe
PID 3056 wrote to memory of 796	3056	csrss.exe	WScript.exe
PID 3056 wrote to memory of 796	3056	csrss.exe	WScript.exe
PID 2016 wrote to memory of 2548	2016	WScript.exe	csrss.exe
PID 2016 wrote to memory of 2548	2016	WScript.exe	csrss.exe
PID 2016 wrote to memory of 2548	2016	WScript.exe	csrss.exe
PID 2548 wrote to memory of 1988	2548	csrss.exe	WScript.exe
PID 2548 wrote to memory of 1988	2548	csrss.exe	WScript.exe
PID 2548 wrote to memory of 1988	2548	csrss.exe	WScript.exe
PID 2548 wrote to memory of 1168	2548	csrss.exe	WScript.exe
PID 2548 wrote to memory of 1168	2548	csrss.exe	WScript.exe
PID 2548 wrote to memory of 1168	2548	csrss.exe	WScript.exe
PID 1988 wrote to memory of 1576	1988	WScript.exe	csrss.exe

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

Processes:

csrss.execsrss.execsrss.execsrss.exe7f604c1ca06db7206f1699e6d908a7a0N.execsrss.execsrss.execsrss.execsrss.execsrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7f604c1ca06db7206f1699e6d908a7a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	7f604c1ca06db7206f1699e6d908a7a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	7f604c1ca06db7206f1699e6d908a7a0N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7f604c1ca06db7206f1699e6d908a7a0N.exe
"C:\Users\Admin\AppData\Local\Temp\7f604c1ca06db7206f1699e6d908a7a0N.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:484

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e8d91631-e2cb-4ac2-b181-d5be62a16d18.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
4⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3056

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\040877dc-298f-4ce9-8f1f-ade626c97b95.vbs"
5⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2548

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4bee5e4-8cb6-4c14-9ff3-eec46eac46fa.vbs"
7⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
8⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1576

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97583e94-2ef0-4e0d-b385-4ef1a284b3ec.vbs"
9⤵
PID:1596

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
10⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1668

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aed2523e-addd-4f46-9a5f-aeff0db20649.vbs"
11⤵
PID:1572

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
12⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2584

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\68f8b6d5-38b0-4acc-ad05-745f93d3f4c5.vbs"
13⤵
PID:2272

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
14⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2312

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7feb12d7-a0eb-4de1-bd5a-1ac0934d4828.vbs"
15⤵
PID:2912

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
16⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1932

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad565cd0-f24b-45c8-af02-20f6c5a3124a.vbs"
17⤵
PID:2240

C:\Program Files\Windows Mail\de-DE\csrss.exe
"C:\Program Files\Windows Mail\de-DE\csrss.exe"
18⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2988

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43a39bf1-cfce-4118-854f-a1c8ec6b6f67.vbs"
19⤵
PID:1424

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad14eb07-1c2e-4dd3-9999-1202d25fbd78.vbs"
19⤵
PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a9a2831-df15-4d9c-bc1d-6b91e0349e39.vbs"
17⤵
PID:1756

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7624806-a6fa-48ac-8c70-cc3832ce89d1.vbs"
15⤵
PID:2252

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\151b0795-4892-42c1-8e8c-da56b07b9481.vbs"
13⤵
PID:1564

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e53e8634-eb02-4bee-bf8c-e596d76c865d.vbs"
11⤵
PID:900

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85d7e246-0aaa-4a86-825d-a6e9a2851f56.vbs"
9⤵
PID:1916

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a320e536-147a-46b9-8113-3a8df3f1a245.vbs"
7⤵
PID:1168

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1378ef74-7c39-40e8-90de-906feac8ef43.vbs"
5⤵
PID:796

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef0e2f00-efb0-414b-967d-0391534306ae.vbs"
3⤵
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\de-DE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Mail\de-DE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f604c1ca06db7206f1699e6d908a7a0N7" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\7f604c1ca06db7206f1699e6d908a7a0N.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f604c1ca06db7206f1699e6d908a7a0N" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\7f604c1ca06db7206f1699e6d908a7a0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f604c1ca06db7206f1699e6d908a7a0N7" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\7f604c1ca06db7206f1699e6d908a7a0N.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Mail\de-DE\csrss.exe

Filesize
4.9MB

MD5
7f604c1ca06db7206f1699e6d908a7a0

SHA1
ba7e4204908407f64ce41d867a312b970c450ca3

SHA256
057029b10fb991791435ba26d2715749bad8114beb7652132c0e8471d0200d11

SHA512
04ac0f43e282eecaedd7ca0012469145269780ff54b792d511f025851df0974ad1ae568a22e80e78e5b444431e9ebea60e3dcb77a0c9233faee7b758d5354ee8

Download Submit
C:\Users\Admin\AppData\Local\Temp\040877dc-298f-4ce9-8f1f-ade626c97b95.vbs

Filesize
721B

MD5
911cbbe5afc2b3ef61c0d0938d1f8c5d

SHA1
5279e1de52966d276520e3438fea5c8c48096871

SHA256
a694fc982717d196db18b28e36c6fa1540ec3ad3518d81b8151f8afeeab067c4

SHA512
986c30918da33ba343cda71d17ea934150cb486870cdb4a766a09c73d775e119238389d53d44596f225cda9dc83988838ec34a63e62de3caf037041f509f6fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\43a39bf1-cfce-4118-854f-a1c8ec6b6f67.vbs

Filesize
721B

MD5
8c7cddac1a8ad3ea0621ed1af9a94cb6

SHA1
9f181d2b109b4d86dc893a0c782d2d6492b10560

SHA256
97842d3d1ca2637e180547fd9deecfcae69974130a18275bc6be088d100e9e87

SHA512
8753f8c29e4fc9cb920b368623f4bc94bbcc9c9f37371b82cad8c696401a6c0478d3f7d3daacda0675c741b279b6bcff576564ab50f5f15c3e3125c34a547e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\68f8b6d5-38b0-4acc-ad05-745f93d3f4c5.vbs

Filesize
721B

MD5
f09fd47e2fa23b9424ade25a6718e182

SHA1
fd1b0991f3cf07dc558c03e569583706fafc9ed3

SHA256
d70d0a34dc805f4b9adfde7a11a821ac67c48f0b727a4b7481f6bc06b2784089

SHA512
c35e00fceb2a4be66f59c271f76c0d0b8fffee5ecde04e86518346ea4fa58b134f0d1392e7b3143e01dd5b794dabc3844c0f21e0690048cce1db858f8463903e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7feb12d7-a0eb-4de1-bd5a-1ac0934d4828.vbs

Filesize
721B

MD5
1a9e1a6f28c2c94542ba8d643ea14f4e

SHA1
da77784d6102fd8cdc8280b0b8fcd09775ff5f2b

SHA256
b02e1a3afe75475d18dfdd61b2c0fffa11f0a6b46c438c5296e0c243e4332b3a

SHA512
099e55ab0779f668aac4eb86e6f49b15e3f9d4877631840c40c2169b251dd6d7e8d4af1a2dd91db23ea7c163dac1d897df8935fb060f719990fd981fcb2cb5e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\97583e94-2ef0-4e0d-b385-4ef1a284b3ec.vbs

Filesize
721B

MD5
22ac627b79cebc869e32b556d8894b81

SHA1
9b509f428ead031970d1f0427717ba7037880693

SHA256
a4ef8c9f667d1a7953cb92f837aa36d7de16cd06ebc78d6f0da0421b7a184fd9

SHA512
25e26e1f140611792f44ba42ad2e37c484b67801a37dae7f60b19d97f163832a6bc49d33b8ca23267934ea0e19144913f7e54aad86624d3b699620ce8200f263

Download Submit
C:\Users\Admin\AppData\Local\Temp\ad565cd0-f24b-45c8-af02-20f6c5a3124a.vbs

Filesize
721B

MD5
ad70c94fce582757acb42906335f1013

SHA1
f89c954019fda9573fdd0dd419801bb4ab382041

SHA256
3f5f35724a3b45c5b71739f451957e26e7a88c562d91768d8ca1eec0414a92ba

SHA512
18d1dfacb5f7292ebe0596d99e73f299d900f60914f1c02dddc87e02335bf5ede74ecc2a7caaab318e30fcd4b63c2a5ee2045909180933b358f6832496fe379d

Download Submit
C:\Users\Admin\AppData\Local\Temp\aed2523e-addd-4f46-9a5f-aeff0db20649.vbs

Filesize
721B

MD5
e2f2045f1025e76ab4a700a7a03569c9

SHA1
cbe86c96482f3ed37bc1854b9eeef76aa07a2558

SHA256
eef398e8a113c5bf9b6c21c4d2310d80f8ea89bd40a8e82aa7483ba677d24260

SHA512
1277746d859002d151924e73cf61cac4b6addf8013133e489225b7d37bbdebebc0c3ecf894bd75009d058377dfd2ea31613bc020ba7afda37acb37788548bdc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\d4bee5e4-8cb6-4c14-9ff3-eec46eac46fa.vbs

Filesize
721B

MD5
403ef7e87fe384dceb6605e6b0e6ae8a

SHA1
604f038ea5c8efc7545dfe095899d023c38a78fa

SHA256
ee6a4083af6cf393881c48896d3854fd9aaa71d4b263089491b8d78fab3c095b

SHA512
16592e5aec4720aaf08879c74697ba961240f4dce14f28426ad100e3faa10f9e3ce123b9d592e16a036b9fe38519e7193eb485fc2c3728955d3b087806ca0f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8d91631-e2cb-4ac2-b181-d5be62a16d18.vbs

Filesize
720B

MD5
0abece08a219d238c1deb0eb036d9d0e

SHA1
1665ad3e6b4a7de43efa6929e5b5f4846508c3f6

SHA256
f59e0b51631aee8238a944febdaf4b02c689f141c50df52f855cb5ddde005944

SHA512
3e4cdc402ae41a3062c0448727762f2eea4055cb4018e4389908ad93600b5bf3445b6fe9df3a1d1c8567c8b299add5c8154504f876cca15c4e30f0b16b19a363

Download Submit
C:\Users\Admin\AppData\Local\Temp\ef0e2f00-efb0-414b-967d-0391534306ae.vbs

Filesize
497B

MD5
dc030e078e5c67b63f5b4b8fb36f508e

SHA1
0d1ec33ad67b25e84de18d74b6b2b977080a4a3f

SHA256
d8e2212b874514bb06629c043003496f5845e4ee58ba2b2d799426d8bd6e4703

SHA512
89e957bf7ef36253cc4ae33649852f0219129b62bb0c4067b9eab23bcf0004775a38b42eebfbe86770c94c10fc2144ea65254bdb6731d2600319e9a4c408dce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6AB5.tmp.exe

Filesize
75KB

MD5
e0a68b98992c1699876f818a22b5b907

SHA1
d41e8ad8ba51217eb0340f8f69629ccb474484d0

SHA256
2b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f

SHA512
856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1bc57e283853405c373fd1f9d33a9f55

SHA1
d54a845dbfae18f9ff10cf42667ae7ae47cad875

SHA256
9eb1fd1fe2675281af51cf309c8a57303ca6b43a54257ded1cc941c5e6dc2e15

SHA512
5b06b1a39835b2971f6aa3806bf395afb010b1e72a163a68001faa37f3ec0fe197ae069917671b49d1c12d315a79cb8fcde3b3a91eb5a029da9bd777170e93c5

Download Submit
memory/484-67-0x00000000013B0000-0x00000000018A4000-memory.dmp

Filesize
5.0MB

Download
memory/484-111-0x0000000000B80000-0x0000000000B92000-memory.dmp

Filesize
72KB

Download
memory/1576-153-0x0000000000330000-0x0000000000824000-memory.dmp

Filesize
5.0MB

Download
memory/1668-168-0x0000000000AE0000-0x0000000000FD4000-memory.dmp

Filesize
5.0MB

Download
memory/1820-72-0x000000001B860000-0x000000001BB42000-memory.dmp

Filesize
2.9MB

Download
memory/1932-212-0x0000000000110000-0x0000000000604000-memory.dmp

Filesize
5.0MB

Download
memory/2120-7-0x0000000002550000-0x0000000002566000-memory.dmp

Filesize
88KB

Download
memory/2120-14-0x000000001AEA0000-0x000000001AEA8000-memory.dmp

Filesize
32KB

Download
memory/2120-15-0x000000001AEB0000-0x000000001AEB8000-memory.dmp

Filesize
32KB

Download
memory/2120-16-0x000000001AEC0000-0x000000001AECC000-memory.dmp

Filesize
48KB

Download
memory/2120-6-0x0000000000A40000-0x0000000000A50000-memory.dmp

Filesize
64KB

Download
memory/2120-13-0x0000000002740000-0x000000000274E000-memory.dmp

Filesize
56KB

Download
memory/2120-10-0x0000000002590000-0x00000000025A2000-memory.dmp

Filesize
72KB

Download
memory/2120-9-0x0000000002580000-0x000000000258A000-memory.dmp

Filesize
40KB

Download
memory/2120-8-0x0000000002570000-0x0000000002580000-memory.dmp

Filesize
64KB

Download
memory/2120-1-0x0000000000B40000-0x0000000001034000-memory.dmp

Filesize
5.0MB

Download
memory/2120-12-0x0000000002630000-0x000000000263E000-memory.dmp

Filesize
56KB

Download
memory/2120-0-0x000007FEF6853000-0x000007FEF6854000-memory.dmp

Filesize
4KB

Download
memory/2120-83-0x000007FEF6850000-0x000007FEF723C000-memory.dmp

Filesize
9.9MB

Download
memory/2120-4-0x0000000000700000-0x000000000071C000-memory.dmp

Filesize
112KB

Download
memory/2120-5-0x0000000000A30000-0x0000000000A38000-memory.dmp

Filesize
32KB

Download
memory/2120-2-0x000000001B560000-0x000000001B68E000-memory.dmp

Filesize
1.2MB

Download
memory/2120-3-0x000007FEF6850000-0x000007FEF723C000-memory.dmp

Filesize
9.9MB

Download
memory/2120-11-0x0000000002620000-0x000000000262A000-memory.dmp

Filesize
40KB

Download
memory/2312-197-0x0000000000E30000-0x0000000001324000-memory.dmp

Filesize
5.0MB

Download
memory/2832-73-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2988-227-0x0000000000C80000-0x0000000001174000-memory.dmp

Filesize
5.0MB

Download