dcrat | 1d6628a6cd66f3dd7f3377ee1c30e8a92cedb1d40f5a121b84e5ab84a0e19909

Analysis

max time kernel
94s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
552e401ed4740592eed1d413ae5a798c.exe
Size 2.7MB
Sample240925-fx413azepg
SHA256 1d6628a6cd66f3dd7f3377ee1c30e8a92cedb1d40f5a121b84e5ab84a0e19909
MD5 552e401ed4740592eed1d413ae5a798c
SHA1 e1f350c68108e3bdb0e2fad97647c6b99a22df5b
SHA512 eeae5d9008bc4951769e1be081af9d168fd7ab90d072a2b3be60114086d0baef68e5eb22a73df8c48f6059afb7fafe2529f2bf5ad8dd7129420943033cbc4b53
SSDEEP 49152:zbA30HsQ4Coflk1GpUkQcn6dZD5upurIPqtFmNHa3WKuh:zboHNk1gP6/YurIdN60h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery evasion infostealer persistence rat

Malware Config

Signatures

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4700	schtasks.exe
		4688	schtasks.exe
		4596	schtasks.exe
		3272	schtasks.exe
		3744	schtasks.exe
		3520	schtasks.exe
		3276	schtasks.exe
		3260	schtasks.exe
		3632	schtasks.exe
		4200	schtasks.exe
		1368	schtasks.exe
		3272	schtasks.exe
File created	C:\Windows\Cursors\22eafd247d37c3		nvdriver.exe
		2264	schtasks.exe
		3068	schtasks.exe
		2748	schtasks.exe
		4900	schtasks.exe
		468	schtasks.exe
		2356	schtasks.exe
		4376	schtasks.exe
		2588	schtasks.exe
		4488	schtasks.exe
		1708	schtasks.exe
		3276	schtasks.exe
		2444	schtasks.exe
		3328	schtasks.exe
		3216	schtasks.exe
		964	schtasks.exe
		3528	schtasks.exe
		3460	schtasks.exe
		4912	schtasks.exe
		2312	schtasks.exe
		2024	schtasks.exe
		4940	schtasks.exe
		2240	schtasks.exe
		1892	schtasks.exe
		2696	schtasks.exe
		2888	schtasks.exe
		3880	schtasks.exe
		3204	schtasks.exe
		456	schtasks.exe
		2628	schtasks.exe
		2732	schtasks.exe
		3812	schtasks.exe
		4756	schtasks.exe
		4524	schtasks.exe
		4160	schtasks.exe
		2772	schtasks.exe
		5056	schtasks.exe
		4172	schtasks.exe
		3340	schtasks.exe
		2400	schtasks.exe
		624	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		552e401ed4740592eed1d413ae5a798c.exe
		4252	schtasks.exe
		3444	schtasks.exe
		5080	schtasks.exe
		1068	schtasks.exe
		4420	schtasks.exe
		2492	schtasks.exe
		4392	schtasks.exe
		2480	schtasks.exe
		3688	schtasks.exe
		1804	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 23 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\explorer.exe\", \"C:\\Windows\\RemotePackages\\upfc.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\nvdriver.exe\", \"C:\\Windows\\GameBarPresenceWriter\\sppsvc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\explorer.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\explorer.exe\", \"C:\\Windows\\RemotePackages\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Program Files (x86)\\Google\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\explorer.exe\", \"C:\\Windows\\RemotePackages\\upfc.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\nvdriver.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Cursors\\TextInputHost.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\", \"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\", \"C:\\Users\\Default\\Start Menu\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\nvdriver.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\", \"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\", \"C:\\Recovery\\WindowsRE\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\", \"C:\\Windows\\Resources\\Registry.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\", \"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\""	nvdriver.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2240	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4172	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3880	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4756	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3308	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4524	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4376	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5056	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	1476	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	1476	schtasks.exe	91

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0006000000022998-4.dat	dcrat
behavioral2/memory/4588-7-0x0000000000400000-0x00000000006BB000-memory.dmp	dcrat
behavioral2/files/0x0007000000023435-24.dat	dcrat
behavioral2/memory/3932-26-0x00000000005B0000-0x00000000007EA000-memory.dmp	dcrat

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	552e401ed4740592eed1d413ae5a798c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	gf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	nvdriver.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	nvdriver.exe

Executes dropped EXE 4 IoCs

pid	Process
1940	gf.exe
3932	nvdriver.exe
5044	nvdriver.exe
1328	explorer.exe

Adds Run key to start application 2 TTPs 46 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\GameBarPresenceWriter\\sppsvc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\GameBarPresenceWriter\\sppsvc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvdriver = "\"C:\\Recovery\\WindowsRE\\nvdriver.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Media Player\\en-US\\lsass.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Google\\Idle.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Registration\\CRMLog\\RuntimeBroker.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Google\\Idle.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\winlogon.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\explorer.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Resources\\Registry.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\explorer.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\Windows Photo Viewer\\fr-FR\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Resources\\Registry.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WaaSMedicAgent = "\"C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\WaaSMedicAgent.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\RemotePackages\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\Cursors\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Microsoft Office 15\\ClientX64\\fontdrvhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\uk-UA\\dllhost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvdriver = "\"C:\\Program Files\\Google\\Chrome\\Application\\nvdriver.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\Cursors\\TextInputHost.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Start Menu\\csrss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Start Menu\\csrss.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvdriver = "\"C:\\Program Files\\Google\\Chrome\\Application\\nvdriver.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvdriver = "\"C:\\Recovery\\WindowsRE\\nvdriver.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Windows Media Player\\uk-UA\\spoolsv.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\""	nvdriver.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Windows\\RemotePackages\\upfc.exe\""	nvdriver.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\en-US\lsass.exe	nvdriver.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\22eafd247d37c3	nvdriver.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe	nvdriver.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\5940a34987c991	nvdriver.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\upfc.exe	nvdriver.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ea1d8f6d871115	nvdriver.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\c82b8037eab33d	nvdriver.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\MixerBranding\lsass.exe	nvdriver.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\6203df4a6bafc7	nvdriver.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe	nvdriver.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\7a0fd90576e088	nvdriver.exe
File created	C:\Program Files\Google\Chrome\Application\nvdriver.exe	nvdriver.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\5b884080fd4f94	nvdriver.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe	nvdriver.exe
File created	C:\Program Files (x86)\Google\6ccacd8608530f	nvdriver.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\TextInputHost.exe	nvdriver.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe	nvdriver.exe
File created	C:\Program Files (x86)\Windows Media Player\uk-UA\spoolsv.exe	nvdriver.exe
File created	C:\Program Files (x86)\Windows Media Player\uk-UA\f3b6ecef712a24	nvdriver.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\cc11b995f2a76d	nvdriver.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\WaaSMedicAgent.exe	nvdriver.exe
File created	C:\Program Files (x86)\Google\Idle.exe	nvdriver.exe
File created	C:\Program Files\Google\Chrome\Application\2434693f6d13a3	nvdriver.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Resources\ee2ad38f3d4382	nvdriver.exe
File created	C:\Windows\PrintDialog\en-US\fontdrvhost.exe	nvdriver.exe
File created	C:\Windows\RemotePackages\upfc.exe	nvdriver.exe
File created	C:\Windows\RemotePackages\ea1d8f6d871115	nvdriver.exe
File created	C:\Windows\GameBarPresenceWriter\sppsvc.exe	nvdriver.exe
File opened for modification	C:\Windows\Cursors\TextInputHost.exe	nvdriver.exe
File created	C:\Windows\Cursors\22eafd247d37c3	nvdriver.exe
File created	C:\Windows\Registration\CRMLog\RuntimeBroker.exe	nvdriver.exe
File created	C:\Windows\GameBarPresenceWriter\0a1fd5f707cd16	nvdriver.exe
File created	C:\Windows\Cursors\TextInputHost.exe	nvdriver.exe
File created	C:\Windows\Registration\CRMLog\9e8d7a4ca61bd9	nvdriver.exe
File created	C:\Windows\Resources\Registry.exe	nvdriver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	552e401ed4740592eed1d413ae5a798c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	gf.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	nvdriver.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	nvdriver.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2748	reg.exe
532	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3744	schtasks.exe
2588	schtasks.exe
2732	schtasks.exe
5020	schtasks.exe
3328	schtasks.exe
3272	schtasks.exe
3272	schtasks.exe
2356	schtasks.exe
4252	schtasks.exe
4200	schtasks.exe
2772	schtasks.exe
4900	schtasks.exe
3276	schtasks.exe
3444	schtasks.exe
5080	schtasks.exe
2480	schtasks.exe
4756	schtasks.exe
456	schtasks.exe
2748	schtasks.exe
2264	schtasks.exe
3340	schtasks.exe
2240	schtasks.exe
2312	schtasks.exe
3276	schtasks.exe
3528	schtasks.exe
1804	schtasks.exe
4300	schtasks.exe
3308	schtasks.exe
4700	schtasks.exe
3688	schtasks.exe
1284	schtasks.exe
3204	schtasks.exe
4420	schtasks.exe
4688	schtasks.exe
2400	schtasks.exe
5072	schtasks.exe
3320	schtasks.exe
4596	schtasks.exe
1892	schtasks.exe
3880	schtasks.exe
4912	schtasks.exe
3520	schtasks.exe
4172	schtasks.exe
4392	schtasks.exe
468	schtasks.exe
2492	schtasks.exe
3580	schtasks.exe
3216	schtasks.exe
2444	schtasks.exe
3260	schtasks.exe
3632	schtasks.exe
1368	schtasks.exe
624	schtasks.exe
3812	schtasks.exe
2024	schtasks.exe
3068	schtasks.exe
4160	schtasks.exe
1068	schtasks.exe
4488	schtasks.exe
964	schtasks.exe
5056	schtasks.exe
3460	schtasks.exe
2888	schtasks.exe
4376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3932	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
5044	nvdriver.exe
1328	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	nvdriver.exe
Token: SeDebugPrivilege	5044	nvdriver.exe
Token: SeDebugPrivilege	1328	explorer.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1940	4588	552e401ed4740592eed1d413ae5a798c.exe	82
PID 4588 wrote to memory of 1940	4588	552e401ed4740592eed1d413ae5a798c.exe	82
PID 4588 wrote to memory of 1940	4588	552e401ed4740592eed1d413ae5a798c.exe	82
PID 1940 wrote to memory of 3840	1940	gf.exe	83
PID 1940 wrote to memory of 3840	1940	gf.exe	83
PID 1940 wrote to memory of 3840	1940	gf.exe	83
PID 1940 wrote to memory of 1392	1940	gf.exe	84
PID 1940 wrote to memory of 1392	1940	gf.exe	84
PID 1940 wrote to memory of 1392	1940	gf.exe	84
PID 1392 wrote to memory of 2748	1392	cmd.exe	87
PID 1392 wrote to memory of 2748	1392	cmd.exe	87
PID 1392 wrote to memory of 2748	1392	cmd.exe	87
PID 3840 wrote to memory of 4296	3840	WScript.exe	88
PID 3840 wrote to memory of 4296	3840	WScript.exe	88
PID 3840 wrote to memory of 4296	3840	WScript.exe	88
PID 4296 wrote to memory of 3932	4296	cmd.exe	90
PID 4296 wrote to memory of 3932	4296	cmd.exe	90
PID 3932 wrote to memory of 1052	3932	nvdriver.exe	104
PID 3932 wrote to memory of 1052	3932	nvdriver.exe	104
PID 4296 wrote to memory of 532	4296	cmd.exe	106
PID 4296 wrote to memory of 532	4296	cmd.exe	106
PID 4296 wrote to memory of 532	4296	cmd.exe	106
PID 1052 wrote to memory of 3236	1052	cmd.exe	107
PID 1052 wrote to memory of 3236	1052	cmd.exe	107
PID 1052 wrote to memory of 5044	1052	cmd.exe	111
PID 1052 wrote to memory of 5044	1052	cmd.exe	111
PID 5044 wrote to memory of 1200	5044	nvdriver.exe	169
PID 5044 wrote to memory of 1200	5044	nvdriver.exe	169
PID 1200 wrote to memory of 4608	1200	cmd.exe	171
PID 1200 wrote to memory of 4608	1200	cmd.exe	171
PID 1200 wrote to memory of 1328	1200	cmd.exe	175
PID 1200 wrote to memory of 1328	1200	cmd.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\552e401ed4740592eed1d413ae5a798c.exe
"C:\Users\Admin\AppData\Local\Temp\552e401ed4740592eed1d413ae5a798c.exe"
1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\gf.exe
  "C:\Users\Admin\AppData\Local\Temp\gf.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\nvidiadrivers\u3p5x83dINqg4J2NZ.vbe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\nvidiadrivers\B2wJE9LGiwl91msFdoVPyW.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4296
    - - C:\Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe
        
        "C:\Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe"
        5⤵
        DcRat
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3932
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z42aSHZuZJ.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe
        
        "C:\Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe"
        7⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dEY73XStwm.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:4608
        
        C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe
        
        "C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe"
        9⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\nvidiadrivers\cqJqQeasQQmFWMBrC3t.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Windows\Cursors\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Cursors\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\Cursors\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\TextInputHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Start Menu\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Start Menu\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nvdrivern" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\nvdriver.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nvdriver" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\nvdriver.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nvdrivern" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\nvdriver.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\Registration\CRMLog\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\CRMLog\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\spoolsv.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\uk-UA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Windows\Resources\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Resources\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\WaaSMedicAgent.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 7 /tr "'C:\Program Files\WindowsPowerShell\Modules\Pester\WaaSMedicAgent.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\upfc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\RemotePackages\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\RemotePackages\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nvdrivern" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\nvdriver.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nvdriver" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\nvdriver.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "nvdrivern" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\nvdriver.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:1708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\GameBarPresenceWriter\sppsvc.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\GameBarPresenceWriter\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nvdriver.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nvdriver.exe.log
Size 1KB
SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
MD5 7800fca2323a4130444c572374a030f4
SHA1 40c9b8e0e5e7d72a5293f4010f2ccf21e637b4aa
SHA512 c8a7ad930b8c07007c7a67d8c32a2a4a401dcc34ab966e0e80901655fcbe1f5c95b72a195e6381b1de56c2c987eeab093d8e89891bec9e9684785c5d824b3554
MD5 SHA1 SHA512

Submit Download

Z42aSHZuZJ.bat

Path C:\Users\Admin\AppData\Local\Temp\Z42aSHZuZJ.bat
Size 222B
SHA256 84639a92757f51b3df083f06193af003ac5bea43e8ddbc6b2fa276f9bd3b9562
MD5 0559681e761ddaada9ed9fd6b42b2900
SHA1 e1da4b2452e9e25cb505034b061760d0c53c4080
SHA512 286450349705046f784d8833403f3835cff825efdf0c0e588c438e23f90bc22533d21cf6a06b5b04ba981d799266551bde1eb297f7ad403b01fc6f51d0356e81
MD5 SHA1 SHA512

Submit Download

dEY73XStwm.bat

Path C:\Users\Admin\AppData\Local\Temp\dEY73XStwm.bat
Size 225B
SHA256 588091fbe3115fe34b42610f653bbc6cf3e617e5b2f97bb4471d51f64954f758
MD5 6bb9e6968420b9b5dfb4edb1c03b0945
SHA1 444ddd1a91f6932e15861646a6ecc2e46ca8166e
SHA512 97db0fcb55c11efb26f97d51ed421c4eec00f70d4a7cb7c8952d31800cce2bb48e8b4fd7e642721e61dde8fbb7b5bd539dd7b371ebd5e673f0b13d5252efc37a
MD5 SHA1 SHA512

Submit Download

gf.exe

Path C:\Users\Admin\AppData\Local\Temp\gf.exe
Size 2.5MB
SHA256 983cc8d48a66b58f5fed9d82a7733cc3b4f06b534eb9ea98163a7694fa4fe2d9
MD5 e6fbc2b450302ae039181e4fac91aa3d
SHA1 640d28797f473a13fbaebd330ce47d4c91537225
SHA512 57eea73569d483f0f35f77a283e50d63399ed00ff32a6a8d2a7ec8451b9fcb214f0a3f33fdee730fbb86274f6eaaed5fed852eab9eaeea6b09445bce882f98e6
SSDEEP 49152:UbA30HsQ4Coflk1GpUkQcn6dZD5upurIPqtFmNHa3WKuX:UboHNk1gP6/YurIdN60X
MD5 SHA1 SHA512 SSDEEP

Submit Download

B2wJE9LGiwl91msFdoVPyW.bat

Path C:\Users\Admin\AppData\Roaming\nvidiadrivers\B2wJE9LGiwl91msFdoVPyW.bat
Size 150B
SHA256 92556b6d69fdb1d965f7aaca28d576422ee19f6bc1115d625415c06dba4663cd
MD5 2f13af336ec7cf35b11324a9884fc6a9
SHA1 4fa9d0a577f1ec5008df4ab1cb57449f56f91d6c
SHA512 6866f3bf1daedb313dc8c7442710f951e304ace9cf36a0a0b1e5c7a0468de1dbc38b0dcaf88c9a1ccf193bce1831fb85cfdaceeedbba559c8a0a478d658e1d4f
MD5 SHA1 SHA512

Submit Download

cqJqQeasQQmFWMBrC3t.bat

Path C:\Users\Admin\AppData\Roaming\nvidiadrivers\cqJqQeasQQmFWMBrC3t.bat
Size 109B
SHA256 8fc70a4625c0d4dabac7ec8eecc7175eb5b8f661293f478119c11f389d13318c
MD5 031d0c353460a3323ed03ad8d920dbbc
SHA1 75dd8d5ccaddabb53d825f0a5dfe4b9bb1c43441
SHA512 0d5538a28106da3512d7de220cc598f4a9077b8aa8b9fdd338ad2e76df7ed29be42bbd8f36ec9a7cb2ac12aeafd7b70ccfb7b31f6ae2e70aa08553ebc2f037d3
MD5 SHA1 SHA512

Submit Download

nvdriver.exe

Path C:\Users\Admin\AppData\Roaming\nvidiadrivers\nvdriver.exe
Size 2.2MB
SHA256 60519e5af340c24acefe2ae89365ab197128a63adc3ff7045904d1a44696afcd
MD5 9319cedbd6bb07d2821e81bbb0a51c18
SHA1 d2130ff26ec69cf901e2a3b99e9e07c4a9059cc3
SHA512 9e037bd09bdbd29d668ca4d7823ea84d08be8b3e7f5bb903b715f9c7ccd79e9cfeb936ba204311c951ce65c7473434a8a3db928f89da306ec919d1a939c21d2f
SSDEEP 49152:KsQ4Coflk1GpUkQcn6dZD5upurIPqtFmNHa3WKu:FHNk1gP6/YurIdN60
MD5 SHA1 SHA512 SSDEEP

Submit Download

u3p5x83dINqg4J2NZ.vbe

Path C:\Users\Admin\AppData\Roaming\nvidiadrivers\u3p5x83dINqg4J2NZ.vbe
Size 219B
SHA256 44590c0a478095e187c3dae37e9b49f6b0f561d01d41de65f319d5019728d19e
MD5 f103de7a5a6b36ab176147d293fb34e6
SHA1 e91487f1a9e2dee405ac57e76661760f652b532a
SHA512 f2f9aa10c7b25f7692aaf6afddb23fafeb37b3256343d5b48b87944c6314ee68ed0beb4ddf10c2ba0abe40ebddb5c1fabf6b5d30c715b02480eda3db4af01877
MD5 SHA1 SHA512

Submit Download

memory/1328-96-0x00000000028B0000-0x0000000002906000-memory.dmp

Download

memory/3932-28-0x00000000029B0000-0x0000000002A00000-memory.dmp

Download

memory/3932-30-0x0000000002960000-0x00000000029B6000-memory.dmp

Download

memory/3932-31-0x0000000002930000-0x000000000293E000-memory.dmp

Download

memory/3932-33-0x0000000002A00000-0x0000000002A08000-memory.dmp

Download

memory/3932-32-0x0000000002940000-0x0000000002948000-memory.dmp

Download

memory/3932-29-0x0000000002910000-0x0000000002926000-memory.dmp

Download

memory/3932-27-0x00000000028F0000-0x000000000290C000-memory.dmp

Download

memory/3932-26-0x00000000005B0000-0x00000000007EA000-memory.dmp

Download

memory/4588-7-0x0000000000400000-0x00000000006BB000-memory.dmp

Download