dcrat | 8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83

Analysis

max time kernel
117s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 10:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Size

1.3MB
MD5

a1de6a3a4dc0d006814d3eecd1ddb090
SHA1

b8749ccbe7b8d02cb2e9627763f800acbe140e46
SHA256

8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83
SHA512

fd2a58cdff5df68fb247364b4004d853f92d7a12426ba7f4a2891f7becaf5701e988a8ca739501fa23a07c5701cb8ed227a66a3e7672ee83fac72fed5befdfbb
SSDEEP

24576:qwwpL4DsvfsODQY2mq7yTK32HbzpEOlM7RJFolBjvmPln0Ep9GKc6NC1t:qw8LnsvQKMzpEOlM7RJqlhgq8rC1

Score

10^/10

dcrat infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\", \"C:\\Windows\\DiagTrack\\Settings\\RuntimeBroker.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\StartMenuExperienceHost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\StartMenuExperienceHost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Documents\\StartMenuExperienceHost.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\StartMenuExperienceHost.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3440	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	2912	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2528	2912	schtasks.exe	82

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1648-1-0x0000000000380000-0x00000000004DA000-memory.dmp	dcrat
behavioral2/files/0x00070000000234c9-19.dat	dcrat
behavioral2/files/0x00080000000234c2-69.dat	dcrat
behavioral2/files/0x00090000000234c5-80.dat	dcrat
behavioral2/memory/3728-94-0x0000000000AF0000-0x0000000000C4A000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	RuntimeBroker.exe

Executes dropped EXE 12 IoCs

pid	Process
3728	RuntimeBroker.exe
968	RuntimeBroker.exe
1752	RuntimeBroker.exe
4180	RuntimeBroker.exe
4796	RuntimeBroker.exe
3456	RuntimeBroker.exe
4708	RuntimeBroker.exe
512	RuntimeBroker.exe
2592	RuntimeBroker.exe
748	RuntimeBroker.exe
3368	RuntimeBroker.exe
3932	RuntimeBroker.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\Documents\\StartMenuExperienceHost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Users\\Public\\Documents\\StartMenuExperienceHost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\StartMenuExperienceHost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\StartMenuExperienceHost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files\\Windows Sidebar\\Shared Gadgets\\dllhost.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\DiagTrack\\Settings\\RuntimeBroker.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\DiagTrack\\Settings\\RuntimeBroker.exe\""	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
68	pastebin.com
32	pastebin.com
41	pastebin.com
52	pastebin.com
57	pastebin.com
63	pastebin.com
70	pastebin.com
21	pastebin.com
22	pastebin.com
48	pastebin.com
50	pastebin.com
59	pastebin.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\55b276f4edf653	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCX9119.tmp	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCX95A1.tmp	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\5940a34987c991	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\RCX9118.tmp	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\RCX961F.tmp	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\DiagTrack\Settings\9e8d7a4ca61bd9	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Windows\DiagTrack\Settings\RCX9823.tmp	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Windows\DiagTrack\Settings\RCX9892.tmp	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File opened for modification	C:\Windows\DiagTrack\Settings\RuntimeBroker.exe	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
File created	C:\Windows\DiagTrack\Settings\RuntimeBroker.exe	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe
2392	schtasks.exe
2408	schtasks.exe
3384	schtasks.exe
2528	schtasks.exe
4780	schtasks.exe
4060	schtasks.exe
3444	schtasks.exe
2360	schtasks.exe
3504	schtasks.exe
3940	schtasks.exe
4488	schtasks.exe
3152	schtasks.exe
2296	schtasks.exe
2672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1648	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
3728	RuntimeBroker.exe
968	RuntimeBroker.exe
1752	RuntimeBroker.exe
4180	RuntimeBroker.exe
4796	RuntimeBroker.exe
3456	RuntimeBroker.exe
4708	RuntimeBroker.exe
512	RuntimeBroker.exe
2592	RuntimeBroker.exe
748	RuntimeBroker.exe
3368	RuntimeBroker.exe
3932	RuntimeBroker.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
Token: SeDebugPrivilege	3728	RuntimeBroker.exe
Token: SeDebugPrivilege	968	RuntimeBroker.exe
Token: SeDebugPrivilege	1752	RuntimeBroker.exe
Token: SeDebugPrivilege	4180	RuntimeBroker.exe
Token: SeDebugPrivilege	4796	RuntimeBroker.exe
Token: SeDebugPrivilege	3456	RuntimeBroker.exe
Token: SeDebugPrivilege	4708	RuntimeBroker.exe
Token: SeDebugPrivilege	512	RuntimeBroker.exe
Token: SeDebugPrivilege	2592	RuntimeBroker.exe
Token: SeDebugPrivilege	748	RuntimeBroker.exe
Token: SeDebugPrivilege	3368	RuntimeBroker.exe
Token: SeDebugPrivilege	3932	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1416	1648	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe	98
PID 1648 wrote to memory of 1416	1648	8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe	98
PID 1416 wrote to memory of 4608	1416	cmd.exe	100
PID 1416 wrote to memory of 4608	1416	cmd.exe	100
PID 1416 wrote to memory of 3728	1416	cmd.exe	101
PID 1416 wrote to memory of 3728	1416	cmd.exe	101
PID 3728 wrote to memory of 3980	3728	RuntimeBroker.exe	102
PID 3728 wrote to memory of 3980	3728	RuntimeBroker.exe	102
PID 3728 wrote to memory of 2044	3728	RuntimeBroker.exe	103
PID 3728 wrote to memory of 2044	3728	RuntimeBroker.exe	103
PID 3980 wrote to memory of 968	3980	WScript.exe	108
PID 3980 wrote to memory of 968	3980	WScript.exe	108
PID 968 wrote to memory of 3796	968	RuntimeBroker.exe	109
PID 968 wrote to memory of 3796	968	RuntimeBroker.exe	109
PID 968 wrote to memory of 3112	968	RuntimeBroker.exe	110
PID 968 wrote to memory of 3112	968	RuntimeBroker.exe	110
PID 3796 wrote to memory of 1752	3796	WScript.exe	113
PID 3796 wrote to memory of 1752	3796	WScript.exe	113
PID 1752 wrote to memory of 612	1752	RuntimeBroker.exe	115
PID 1752 wrote to memory of 612	1752	RuntimeBroker.exe	115
PID 1752 wrote to memory of 2392	1752	RuntimeBroker.exe	116
PID 1752 wrote to memory of 2392	1752	RuntimeBroker.exe	116
PID 612 wrote to memory of 4180	612	WScript.exe	117
PID 612 wrote to memory of 4180	612	WScript.exe	117
PID 4180 wrote to memory of 2116	4180	RuntimeBroker.exe	118
PID 4180 wrote to memory of 2116	4180	RuntimeBroker.exe	118
PID 4180 wrote to memory of 624	4180	RuntimeBroker.exe	119
PID 4180 wrote to memory of 624	4180	RuntimeBroker.exe	119
PID 2116 wrote to memory of 4796	2116	WScript.exe	121
PID 2116 wrote to memory of 4796	2116	WScript.exe	121
PID 4796 wrote to memory of 4692	4796	RuntimeBroker.exe	122
PID 4796 wrote to memory of 4692	4796	RuntimeBroker.exe	122
PID 4796 wrote to memory of 872	4796	RuntimeBroker.exe	123
PID 4796 wrote to memory of 872	4796	RuntimeBroker.exe	123
PID 4692 wrote to memory of 3456	4692	WScript.exe	124
PID 4692 wrote to memory of 3456	4692	WScript.exe	124
PID 3456 wrote to memory of 1260	3456	RuntimeBroker.exe	125
PID 3456 wrote to memory of 1260	3456	RuntimeBroker.exe	125
PID 3456 wrote to memory of 3080	3456	RuntimeBroker.exe	126
PID 3456 wrote to memory of 3080	3456	RuntimeBroker.exe	126
PID 1260 wrote to memory of 4708	1260	WScript.exe	127
PID 1260 wrote to memory of 4708	1260	WScript.exe	127
PID 4708 wrote to memory of 3844	4708	RuntimeBroker.exe	128
PID 4708 wrote to memory of 3844	4708	RuntimeBroker.exe	128
PID 4708 wrote to memory of 1940	4708	RuntimeBroker.exe	129
PID 4708 wrote to memory of 1940	4708	RuntimeBroker.exe	129
PID 3844 wrote to memory of 512	3844	WScript.exe	130
PID 3844 wrote to memory of 512	3844	WScript.exe	130
PID 512 wrote to memory of 3392	512	RuntimeBroker.exe	131
PID 512 wrote to memory of 3392	512	RuntimeBroker.exe	131
PID 512 wrote to memory of 1408	512	RuntimeBroker.exe	132
PID 512 wrote to memory of 1408	512	RuntimeBroker.exe	132
PID 3392 wrote to memory of 2592	3392	WScript.exe	133
PID 3392 wrote to memory of 2592	3392	WScript.exe	133
PID 2592 wrote to memory of 4112	2592	RuntimeBroker.exe	134
PID 2592 wrote to memory of 4112	2592	RuntimeBroker.exe	134
PID 2592 wrote to memory of 3172	2592	RuntimeBroker.exe	135
PID 2592 wrote to memory of 3172	2592	RuntimeBroker.exe	135
PID 4112 wrote to memory of 748	4112	WScript.exe	136
PID 4112 wrote to memory of 748	4112	WScript.exe	136
PID 748 wrote to memory of 3236	748	RuntimeBroker.exe	137
PID 748 wrote to memory of 3236	748	RuntimeBroker.exe	137
PID 748 wrote to memory of 952	748	RuntimeBroker.exe	138
PID 748 wrote to memory of 952	748	RuntimeBroker.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe
"C:\Users\Admin\AppData\Local\Temp\8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83N.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Fc7N4hi3mv.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4608
- - C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
    "C:\Windows\DiagTrack\Settings\RuntimeBroker.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d92c478b-6438-4682-b87b-5ecca9934d5f.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3980
    - - C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:968
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbc30eda-98c0-4173-98ba-b65442f03d46.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32c2bcf3-2f27-498a-91a9-7f64530fc0df.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3113d836-ea8f-401a-ba31-2021d1a36810.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23f2eca1-5986-4be2-a9d8-ca9fa74e6923.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2bb224da-416c-4064-b559-4c473857992f.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4708
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\47b48b24-c789-476a-a18e-4da7ecac870c.vbs"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a782c8d2-48c2-406d-8839-d4297086a4bc.vbs"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f15d7e6b-7592-4ddb-827d-4d9380d6c38b.vbs"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8fdabff8-b666-481f-a0f2-e674454a3057.vbs"
        22⤵
        
        PID:3236
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\074d725a-e6be-4c5c-a07d-bae1b1017420.vbs"
        24⤵
        
        PID:3896
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        
        C:\Windows\DiagTrack\Settings\RuntimeBroker.exe
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3932
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40959342-3044-42d6-b459-2af79aa68805.vbs"
        26⤵
        
        PID:5024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0607ddd-eadd-4c1d-9c28-8d3f2d29e2df.vbs"
        26⤵
        
        PID:4212
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa2e7bb4-994f-4f66-80db-edd895564cdc.vbs"
        24⤵
        
        PID:5092
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49d82474-129a-44af-ac96-16d3c2f1ece3.vbs"
        22⤵
        
        PID:952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3023bcdd-40c4-4008-8da1-144c19904046.vbs"
        20⤵
        
        PID:3172
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8262b675-e104-43c3-bb09-907e1f2d1bf5.vbs"
        18⤵
        
        PID:1408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\761d743d-3c81-4515-a8f2-23b22bada669.vbs"
        16⤵
        
        PID:1940
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf06504a-6375-4b22-8761-ed9acf293621.vbs"
        14⤵
        
        PID:3080
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4babde54-e511-4a80-972d-cc6fe21440e5.vbs"
        12⤵
        
        PID:872
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84fadcc6-2ecf-4adb-8e38-3d636358f5b2.vbs"
        10⤵
        
        PID:624
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae25129c-5047-4386-8540-eb8287663f33.vbs"
        8⤵
        
        PID:2392
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c985fb49-7e6a-4a28-853a-c484aab32d7a.vbs"
        6⤵
        
        PID:3112
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40d0de61-bf75-4fde-9259-334e39ed3d12.vbs"
      4⤵
      PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Public\Documents\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\DiagTrack\Settings\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Settings\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\DiagTrack\Settings\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\dllhost.exe

Filesize
1.3MB

MD5
7f424283941772b3b6b13063330f047f

SHA1
a796320d997a4095defa71b13804b0b5c382a026

SHA256
bc62f5d5815d73d06f7b13f26f2feafbcbf947bf0bc1627a047f4d16d2a7e9e1

SHA512
80afafb9bc9713aadee9d34f2297d1c2c5ac8c296a1a2977961b624b8f23886625f6370edb3a1489afb9c078a820b0b943194d57f8ab98c9bfde5ab19e943eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

Filesize
1KB

MD5
3690a1c3b695227a38625dcf27bd6dac

SHA1
c2ed91e98b120681182904fa2c7cd504e5c4b2f5

SHA256
2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

SHA512
15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\074d725a-e6be-4c5c-a07d-bae1b1017420.vbs

Filesize
723B

MD5
94089c66471c92ed6a6173c28fca8857

SHA1
55968a6e60f7225aa82ecc74f55a1e987c023c3c

SHA256
d643f7a7477d33f51f17dfbf666b8fe7a16e75e85087693ebcfe13ed7f69eb1b

SHA512
bd2b4e66fb9026ccd6d971589cd3918b6b801af2ab2efaddbf77e7e1af53337f270169dc6bde61536e96b640513cc7f5b5806dc1fa05a6c570981f372481a6f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\23f2eca1-5986-4be2-a9d8-ca9fa74e6923.vbs

Filesize
723B

MD5
f48995d7d4aca49ca065de56071ad6ee

SHA1
939c1325183ba07d8c4c1def45ad10964433eca8

SHA256
bcddfb8e8453c6819853aa397a99efc7ea819301f039d293f566f8a27e39ed50

SHA512
7ed98faa31b3f10ebecc3e30840762c0b15414d0d466bb401e389787a6d1a193e11f723b23132df418353551ec1a00a2c434808430c279f62c9333602c7ab5af

Download Submit
C:\Users\Admin\AppData\Local\Temp\2bb224da-416c-4064-b559-4c473857992f.vbs

Filesize
723B

MD5
41deaadaf8b401d4dc8107528ab11f11

SHA1
33986bd948e2bbf7ffc615fb51eb55d0e4f21227

SHA256
ee8650c7d655a7f75d0140a797cc1195a40153639e50556cb63352137135e047

SHA512
3169637cacc1db81b05b2d46fbcd762162404d4fe714d262ac704ab19a2a99b5f8fd4dd14feacd51a68f101cd3f15a1b2f1240be4dca64c9c2a8f2d71036e273

Download Submit
C:\Users\Admin\AppData\Local\Temp\3113d836-ea8f-401a-ba31-2021d1a36810.vbs

Filesize
723B

MD5
9c11e2fa0f58e2d22162496516bb08b2

SHA1
71218e6330fc626a4340aae349580d6d7a1da1df

SHA256
2056e9e365f050a0eaa2a4d92f03690c92e5a809be0cf0dbe7368a954e60b7ff

SHA512
a1e0f02aa4d77328e8f711bf1b698478d79531d9af7151906e3d6ca2e0581020b61381a4199ef30855f536f3374f32e4f3df5a2ec4caf49cf2aa73acc9d4ceea

Download Submit
C:\Users\Admin\AppData\Local\Temp\32c2bcf3-2f27-498a-91a9-7f64530fc0df.vbs

Filesize
723B

MD5
a70b29b9e49ae4674a272f8c7f481210

SHA1
be1bebfc0da725b412ac7e6e9cbef28e6b23018b

SHA256
b768202a66ea9e0c9db685cda160fd493721d0c927858486f63d70ab92ab3a48

SHA512
eac4e0a996c1080ba68dec3623972e1f3d86b25cb5e6e1346a641ca3615cee97484bb8e519044a4ee51d617913f4c10bf22dc651ce4cc92093484503a6cf9b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\40959342-3044-42d6-b459-2af79aa68805.vbs

Filesize
723B

MD5
cf78e845388c3a7c7177c4f5fb0af3e4

SHA1
6a1a4f15a3ef2c1d9839d6a561b6ccf38fd4b6c1

SHA256
60a2a1efe9eac5ec2b07bd67cc551150673edad964a01267df8a75fa3c74fc60

SHA512
7a8205989925bf68b0054cb07a6b5a00f439b8f9e9ea07e021c17a2c6655fe376956b141cb4d0e34ec97fd8691eed22d332427411d6f0c2d0bf80a8baaa81de2

Download Submit
C:\Users\Admin\AppData\Local\Temp\40d0de61-bf75-4fde-9259-334e39ed3d12.vbs

Filesize
499B

MD5
da862bf585bec40f947c01d3042f37e3

SHA1
069da1a7f7a26f32634fe3b81c027d7e29535144

SHA256
c7f6dcf9ae144301d229f4891317c5455ba42b34038c44639fee72a9b68934eb

SHA512
40762b68b58653bd5485f036746741516aeab6454b80e8b10c5b633e42da1479cf3b498fc96f6486123da9cf7aea30991f8edd5ab3cc1bbfdd3f73dd872c3470

Download Submit
C:\Users\Admin\AppData\Local\Temp\47b48b24-c789-476a-a18e-4da7ecac870c.vbs

Filesize
723B

MD5
365c8fc3f590ea933c1c873f41d26643

SHA1
8289c6773dc54a303318b873535cd23c201a481a

SHA256
380786f7a7c358865a20c86408e475b72d8bbe34cbd60205791e125ebb2725da

SHA512
1a2a8c4410f4b6a4ae0cf30e19621e0bc276e15dfd4108e01c7bb0fb7d26ebf6be92f00a8541b1009ed06009e437ae06725b6cce0b2132fa406bee99c58dfc54

Download Submit
C:\Users\Admin\AppData\Local\Temp\8fdabff8-b666-481f-a0f2-e674454a3057.vbs

Filesize
722B

MD5
0c6c2dfd14327168b36ef7a6275dd0ae

SHA1
f42bcd44ce036b11793a93017496bcaf257858f4

SHA256
7414140452574537fb5d1b978b727ae76d7e9f94d0d4ccc05ea6b68f32774707

SHA512
7ef3f19b5bb61d260300ccc9cb454ba9445418a6438231768aa2163bc44c37643b6716131cdbea302fec1dc9707c7e9e55ae5cf3dd98cff5ea692b875600ef7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fc7N4hi3mv.bat

Filesize
212B

MD5
6d11c85dc852f4446553729f4f2839ae

SHA1
6724c9895dde6a1b0a2d5a11a6be075ce222a3f2

SHA256
7b11d2a372fe0671bcb3de4676a5e7e7d5f8dd3d271f790950e0b50ff4b52cdf

SHA512
e6cffdaf05f16b93116c608576f4ccf69ff169d7d90e560954d08e6d453b70eee856a7331f6774f993bdb38937309e982e0938e96a673a3bed9949916190b3a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\a782c8d2-48c2-406d-8839-d4297086a4bc.vbs

Filesize
722B

MD5
b61fd727377fb711c3f1c652b85f783b

SHA1
5ca88acdd9d47eb2e0a7227f085ea316173b83a3

SHA256
be79db31c20ef4211d6e14b25dcfeb14324ab3b8ac2e423573deda123bc52600

SHA512
f50db9bb208f355e36d5df29ffaf0402c0b6d226a5d9fd3c237d5026ed50132836ef9cd4a763d64862029323db13ea21758c83c1b6f63aa70357dd3b8093e0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbc30eda-98c0-4173-98ba-b65442f03d46.vbs

Filesize
722B

MD5
2e6197eb81935d98dba39210145f0a32

SHA1
462d12aea648d6d7a67fa3dc3d38e729f167c857

SHA256
5c3ad8cbb2a852f7c7eec285420d3ac728cec698545c92cc1ffb608e0cdf0d64

SHA512
eeed40fbc6c9c5e5adbf70415093a17e7f7efdc51154a62fb1f3ece4be7c2ce293118820a98d6f5379574328fadb680d894904edb92388a7ce6af7c3080e95e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\d92c478b-6438-4682-b87b-5ecca9934d5f.vbs

Filesize
723B

MD5
fd070826b9c3fcf94dd8ca9fc3738891

SHA1
69cc6aab406e216efa413e58fe1b16c09b7d2e8b

SHA256
d90f7927576b1641874a53babb4099650c128a257e5935ff52b836217745d11c

SHA512
ef88bfc3aea6cf9e0be397dfbcd12f858bf1822808f5d4a5d6d316b5ee42454f4ef6e27d814a07b40ee3f6c5163f6e67f5b05af90e6a5af5297344e96a66e34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f15d7e6b-7592-4ddb-827d-4d9380d6c38b.vbs

Filesize
723B

MD5
e981337c6370f0078b7bd9b12b661167

SHA1
26e5a98748b034c515a424b1332d6efd5ba907f6

SHA256
8bfc2f5746f86f265a08debf8cd26c8f0d2270a7df5b1938259ebb846c8d958e

SHA512
136dcd80f759347eaaea5bc13cf3aa3142afa4eb37b8b75870817204e6e66dcfb5aebca915ce73a3c6e0e478eb402394ac12e13b77f1245c1660bda15ddfe088

Download Submit
C:\Windows\DiagTrack\Settings\RuntimeBroker.exe

Filesize
1.3MB

MD5
a1de6a3a4dc0d006814d3eecd1ddb090

SHA1
b8749ccbe7b8d02cb2e9627763f800acbe140e46

SHA256
8ac29c2cebf2c3206cccfc08da7bb0700ee6e664607fa554c4a781e707222d83

SHA512
fd2a58cdff5df68fb247364b4004d853f92d7a12426ba7f4a2891f7becaf5701e988a8ca739501fa23a07c5701cb8ed227a66a3e7672ee83fac72fed5befdfbb

Download Submit
C:\Windows\DiagTrack\Settings\RuntimeBroker.exe

Filesize
1.3MB

MD5
48a36d021e23dbc73278a515c8af5978

SHA1
73f2b9d78df6ecf693b243383533e12ad9888ff4

SHA256
12eef36357c66e9222dd1144a1d6fd124beb0c338d67c22f91591610fab3e884

SHA512
7965c8707c1ff2221a4003233cc89ce96aac4763858fd9a0e3ec7592408bd18614c81ad98af4aedeae2358ae2c106d42b01d7c20232c651c3ac9d076971864fb

Download Submit
memory/1648-7-0x0000000002850000-0x0000000002858000-memory.dmp

Filesize
32KB

Download
memory/1648-89-0x00007FFEAFE70000-0x00007FFEB0065000-memory.dmp

Filesize
2.0MB

Download
memory/1648-10-0x0000000002880000-0x0000000002888000-memory.dmp

Filesize
32KB

Download
memory/1648-9-0x0000000002870000-0x000000000287E000-memory.dmp

Filesize
56KB

Download
memory/1648-8-0x0000000002860000-0x000000000286A000-memory.dmp

Filesize
40KB

Download
memory/1648-0-0x00007FFEAFE70000-0x00007FFEB0065000-memory.dmp

Filesize
2.0MB

Download
memory/1648-6-0x0000000002710000-0x0000000002726000-memory.dmp

Filesize
88KB

Download
memory/1648-5-0x0000000000CF0000-0x0000000000D00000-memory.dmp

Filesize
64KB

Download
memory/1648-4-0x000000001B090000-0x000000001B0E0000-memory.dmp

Filesize
320KB

Download
memory/1648-3-0x00000000026F0000-0x000000000270C000-memory.dmp

Filesize
112KB

Download
memory/1648-2-0x00007FFEAFE70000-0x00007FFEB0065000-memory.dmp

Filesize
2.0MB

Download
memory/1648-1-0x0000000000380000-0x00000000004DA000-memory.dmp

Filesize
1.4MB

Download
memory/3728-94-0x0000000000AF0000-0x0000000000C4A000-memory.dmp

Filesize
1.4MB

Download