Overview

overview

10

Static

static

10

501aa5f94b...ad.exe

windows7-x64

10

501aa5f94b...ad.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2024 02:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe

  • Size

    1.4MB

  • MD5

    181d043c0617914801548f09d5b776d4

  • SHA1

    757f042065a3dc2c9f73e635b41f83591c8ad647

  • SHA256

    501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad

  • SHA512

    c56897c04b11db7c09ef21be8fe6a541c3c9ffb428b3e1340fce5b035f9f74bb133b57e7cc0852730efd20b4a49da0e8a79b6390f105d18f9fb39461559be574

  • SSDEEP

    24576:6oIREGQw97lGTIYskQyxNtGSKERqWzAcqGv+3spCElJz009I+LU:gRdGcHkBxNYARdzAcqGv+cphlJzxV

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • Process spawned unexpected child process 9 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 45 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 30 IoCs
    evasiontrojan
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 45 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe
    "C:\Users\Admin\AppData\Local\Temp\501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4200
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1844
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79350c44-f314-47e4-978d-a8a750512297.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:452
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b1a0663-e516-4957-a405-0f2fa66171b4.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3988
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:612
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eaa98044-f14a-44ba-a246-841447fa249d.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1960
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1548
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb9c996a-c581-4ecc-b399-f86a57085721.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3644
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:3068
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81361a27-3845-4d0d-84b0-fbe10e0b58b5.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1088
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4640
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2328979-2d19-404d-8a6a-50a353d5577a.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:464
                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1936
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2894586c-f5f6-4aee-98f4-47cdb98b07c6.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3792
                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2728
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2409a100-2cb8-465e-8518-31d3804a41bf.vbs"
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3912
                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                                      18⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:3828
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b92c09e1-d104-4453-8a5b-7b6ff7cf70d1.vbs"
                                        19⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2744
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                                          20⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:2468
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f173e9f-2de2-473a-b280-3a1a81fbf514.vbs"
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2552
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                                              22⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:4388
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\544ef4c0-d4c5-47d3-81a8-448397e2c851.vbs"
                                                23⤵
                                                  PID:2804
                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                                                    24⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:4356
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f18b3eaf-eae1-42d6-9910-3bdef4a01b5d.vbs"
                                                      25⤵
                                                        PID:3080
                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                                                          26⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:1504
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22c92d64-32cc-41d1-924e-787485e72525.vbs"
                                                            27⤵
                                                              PID:3864
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe"
                                                                28⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:1548
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afd01793-7d1b-4b8c-a243-8cd28e88a2fb.vbs"
                                                                  29⤵
                                                                    PID:4876
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d0326ea-f249-4bc0-acaa-ced37e18d918.vbs"
                                                                    29⤵
                                                                      PID:3828
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eff67b27-3d66-4c30-a512-6740abe91af3.vbs"
                                                                  27⤵
                                                                    PID:1392
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7813e64-53ac-4acc-9277-7097a0e8e75f.vbs"
                                                                25⤵
                                                                  PID:3220
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c73eff06-44e6-4eb0-bf79-40fcde2a0c0a.vbs"
                                                              23⤵
                                                                PID:4572
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b61e85e-f3a1-424f-b352-a9d0fb60122d.vbs"
                                                            21⤵
                                                              PID:3180
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3afedeef-6710-4596-b4b0-c5a018cbc12c.vbs"
                                                          19⤵
                                                            PID:4184
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f835169-1eb2-4d18-bb48-97a807439cc3.vbs"
                                                        17⤵
                                                          PID:1016
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb04a517-05e6-4b76-b75d-58b447238959.vbs"
                                                      15⤵
                                                        PID:2644
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c71daa26-9718-4d04-bb2b-f946dca65b9c.vbs"
                                                    13⤵
                                                      PID:1124
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4624512a-b13d-40ff-9bd5-f9ec84fc54a9.vbs"
                                                  11⤵
                                                    PID:4200
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8054add-a86f-4192-8e50-809c14ae91c2.vbs"
                                                9⤵
                                                  PID:4340
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f0eaa01-b46b-41b0-a78a-4cc82c1b8b9a.vbs"
                                              7⤵
                                                PID:320
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2c0ccd6-e4e0-4dfa-98f5-b523c9411430.vbs"
                                            5⤵
                                              PID:2556
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77714a69-fc1e-4440-85ed-bf3d1f989e1a.vbs"
                                          3⤵
                                            PID:5032
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4468
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1280
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2072
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dwm.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1476
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:448
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\dwm.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4900
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:232
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2140
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3012

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Privilege Escalation

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Scheduled Task/Job

                                      1
                                      T1053

                                      Scheduled Task

                                      1
                                      T1053.005

                                      Defense Evasion

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Impair Defenses

                                      1
                                      T1562

                                      Disable or Modify Tools

                                      1
                                      T1562.001

                                      Modify Registry

                                      4
                                      T1112

                                      Credential Access

                                      Discovery

                                      Query Registry

                                      2
                                      T1012

                                      System Information Discovery

                                      3
                                      T1082

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\taskhostw.exe
                                        Filesize

                                        1.4MB

                                        MD5

                                        181d043c0617914801548f09d5b776d4

                                        SHA1

                                        757f042065a3dc2c9f73e635b41f83591c8ad647

                                        SHA256

                                        501aa5f94b15b8716ef7f76e2dbdc146b436cd9e72274d6ec5dec7265706c0ad

                                        SHA512

                                        c56897c04b11db7c09ef21be8fe6a541c3c9ffb428b3e1340fce5b035f9f74bb133b57e7cc0852730efd20b4a49da0e8a79b6390f105d18f9fb39461559be574

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log
                                        Filesize

                                        1KB

                                        MD5

                                        3690a1c3b695227a38625dcf27bd6dac

                                        SHA1

                                        c2ed91e98b120681182904fa2c7cd504e5c4b2f5

                                        SHA256

                                        2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

                                        SHA512

                                        15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\0b1a0663-e516-4957-a405-0f2fa66171b4.vbs
                                        Filesize

                                        739B

                                        MD5

                                        45f0bdfbbdb7e0d2106243d424350787

                                        SHA1

                                        55b442f8b9abb4dfc8726636095d99cfabfe1158

                                        SHA256

                                        dba04b61f40835f1fbfa63b22415196e1775aae854d1b00f42356af4514f4c04

                                        SHA512

                                        095327e0463ad6bd844f4baeb4171231d3a43650b00df92a4f847309908e076edb8782e90ff8328616edfb0761fde2691e39cebfadf0d9d99058677be281f2a5

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\22c92d64-32cc-41d1-924e-787485e72525.vbs
                                        Filesize

                                        740B

                                        MD5

                                        1b5e9ebc4d4588fba7ccef3dc553cd92

                                        SHA1

                                        98bef3a9d894dc5986689501471a96287825124f

                                        SHA256

                                        be0b0f216e7a5604e01d14c9b0cb4f367cc58ff32eac7ef904a502576caddf60

                                        SHA512

                                        6563f36aac7f219646baa4258e41fd39197f72ccb49be130d446d92f4c349b7e15174e87ba86ce43d5d74e255c90b752b8f492ae4c1f5d45bf63030ab911f440

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\2409a100-2cb8-465e-8518-31d3804a41bf.vbs
                                        Filesize

                                        740B

                                        MD5

                                        10e424d9f15aa65eddaf9d63acd38934

                                        SHA1

                                        967c7e2f484e558d0fe97d90834c69a6a6c95158

                                        SHA256

                                        1536272d07ed8e16565c8792eadc4e8b2c9b75d1996f490020906954311e3a94

                                        SHA512

                                        ad7db74d7ff386d55ea2a1a53058279f63f26c4a32c2b37363b7fd4666c20088962aecbca5feeb3db8c780ae6ce2ed628116d88c42a63c2cb0ae70183b8ffbaf

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\2894586c-f5f6-4aee-98f4-47cdb98b07c6.vbs
                                        Filesize

                                        740B

                                        MD5

                                        9d9d01d424f474ef71e214f82ce8b288

                                        SHA1

                                        34653c76292e5d28f077eb7cabedbf7d6ee688cc

                                        SHA256

                                        bb1cce8fbdf6b6c7e666c17e6972428f4d7440c00e2eed4929a5f49dc7fa2c57

                                        SHA512

                                        0caef4e8be4a95daf8bd8db5211d1c8235200507611487a99c2cb91737ab97d044f27fccbe93f7565a2212aeccccf03aac9f3d6b62441779ce225c7de151227e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\4f173e9f-2de2-473a-b280-3a1a81fbf514.vbs
                                        Filesize

                                        740B

                                        MD5

                                        0e710fd274734b836fb3792255546f0c

                                        SHA1

                                        37217da572e14c6a274939ef1d04dfe6e7597766

                                        SHA256

                                        436c94858b01d231e89d64036801501f672a6957e8b14fa684a605695f835ef5

                                        SHA512

                                        d4d04b20c73b6537eb67117080beef6b52a6a012172f0e8822dd9fc322bb664f3c9544bff090423f00f1d6000720b50b81e27fef860730f5c8d1bf23d731e795

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\544ef4c0-d4c5-47d3-81a8-448397e2c851.vbs
                                        Filesize

                                        740B

                                        MD5

                                        9a8238dacef5a777ec9741fc59ac8c28

                                        SHA1

                                        50d90fe6f422b9750a42a0461a8f4d97c51dec2e

                                        SHA256

                                        6bef960d65dd03783e7b773edd8f51604567c8c07066cdcac42fbef84e266283

                                        SHA512

                                        b53f5d9d0e6c73318c5c79bfe5e22976e979b5987cfb25040562a4c55f0a036eff8ae43aed24ddd69c77c47e2ebdbd35ac969bc061a8f84db9b14dc52c6c3371

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\77714a69-fc1e-4440-85ed-bf3d1f989e1a.vbs
                                        Filesize

                                        516B

                                        MD5

                                        dda3f8b34e631097c539cafa664d4bb1

                                        SHA1

                                        a412c7baa59588e5a1d05b45a18e801d43d83b46

                                        SHA256

                                        4b1b53e1e8491cf89b8ae6a339f6d46567782ef489aad0d35042fd810b2d52eb

                                        SHA512

                                        b7a530f2796225e22c57a33272837ae885d976e31154e307a6d5a550145f8c1a33d09e07def2972152e748aa6b6989d46a99f9415c1c197180e626a0decef04e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\79350c44-f314-47e4-978d-a8a750512297.vbs
                                        Filesize

                                        740B

                                        MD5

                                        93039e91cb8926f666a232e5036617ef

                                        SHA1

                                        7964e02d61ca4e35a5b0ac16e07071485a8808a7

                                        SHA256

                                        a7a0d5a996969c230ea4700610a6c76e359b6ebe1204b5c0f55b325a93abfea6

                                        SHA512

                                        96c228a5d14d38f5f1e8e12add78fb610647f666b23cdcbe8aa3a637624fb5ab6a8705d865eca2a936330b053dbd8f6693a969fe47046345a44bddf05dc42e5b

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\81361a27-3845-4d0d-84b0-fbe10e0b58b5.vbs
                                        Filesize

                                        740B

                                        MD5

                                        3e25709d08a93580176344f3daa2cea2

                                        SHA1

                                        24083d6ba5ee5237f0b820640b03ff8a959a0e28

                                        SHA256

                                        c0b7a47406bf341a8e416e707635ed4ada0569768e11e00fcc1ba16f14c41e8a

                                        SHA512

                                        086062f7275a60f2134218847d77ddf88d33616f82e0d5200ac4fb8532e73b121d4f034094097e8d9d721dddb8c3d8ad608b2d1f4080e89f635cfc7c91cedab7

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\a2328979-2d19-404d-8a6a-50a353d5577a.vbs
                                        Filesize

                                        740B

                                        MD5

                                        0f1cdd851f689ef4340b9d2152d5bcff

                                        SHA1

                                        cf518a548a3acfbe3b0175cfd2da8f4256ababdc

                                        SHA256

                                        9ee5d8f52b37f1078d5725bdc5572f6c4779a93fde130407aba7ba27aa03e914

                                        SHA512

                                        14bad40dccbca5164f1e5d67adffbb13547e6cbc39636877fc46c569cecc04d1212c479b7f7829efc22e9f41b149b60b92fcc9ca39db8f5dbb15568e855054cb

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\b92c09e1-d104-4453-8a5b-7b6ff7cf70d1.vbs
                                        Filesize

                                        740B

                                        MD5

                                        91d8d15a32feed06f6a8596f78d8501b

                                        SHA1

                                        f2f9485031e1a0c6792ad079d83ff6f1e0fc7028

                                        SHA256

                                        c31479da467297fb499b1f19690d568bfcd03660b60c9b852fce42448c2aff49

                                        SHA512

                                        509eb227139f099f69a0571c7d5dcf058a9a5b9775aa142e26feac0cd47aa3b4f25d9fa2169136fb37d4bd67f52779739b6d17de60deff6872afd6b1d633c8eb

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\bb9c996a-c581-4ecc-b399-f86a57085721.vbs
                                        Filesize

                                        740B

                                        MD5

                                        36e625882e6ec94d2fd0031152ceb6b5

                                        SHA1

                                        588bef96c8c9262259ab3d90a7241957a0f94a37

                                        SHA256

                                        a1c43d53a2edfcfed35c5c748d5e900ffb409670991db82445468eed8547385d

                                        SHA512

                                        ee7aa2dda7c73a3291276b6be8dfdc5b7c418586ba75085ee23e2d57741e2b9f0926172b1c63af8c33198eebc44c3bcfbeb87d535aab9eccdd3e4e6051aa74c8

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\eaa98044-f14a-44ba-a246-841447fa249d.vbs
                                        Filesize

                                        739B

                                        MD5

                                        b2339b763e3e734274aacd8e64625839

                                        SHA1

                                        85f9be3e4f1fa8b2f6596da73c47fe144e64fcb8

                                        SHA256

                                        514dac711ae1b0ca34a39e0d5276e1c026c223933fc90eb9d99f5b9d305bd6a5

                                        SHA512

                                        cdf3896d097a92de2f2cb149338f0c16422a485522226a3055157df5a720296dcd035064f635a13ad7eccbf148e3dca8db1d9ce477131d7f60ce349b0c0daff1

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\f18b3eaf-eae1-42d6-9910-3bdef4a01b5d.vbs
                                        Filesize

                                        740B

                                        MD5

                                        65fb08d123480bc4a124ee0ec3f63ef4

                                        SHA1

                                        74bbc6a63b32757fbbb8f4d1453b3e4c8f7e30c7

                                        SHA256

                                        0d53c17f961b5a9a3cdea6106ff9abd835e0e897a52fdcff1fafc21b6cdc3751

                                        SHA512

                                        c9b831ffc0cc7ce31c6d271a8c4218556f37ab756c346393a1838d78b678509c16e95415c41c5029c4b6af296effab0ab086268b45bd17ff00ff93d251469e29

                                        Download Submit

                                      • memory/4200-5-0x00000000029E0000-0x00000000029F6000-memory.dmp

                                        Filesize

                                        88KB

                                        Download

                                      • memory/4200-9-0x0000000002A80000-0x0000000002A8A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/4200-0-0x00007FFB34543000-0x00007FFB34545000-memory.dmp

                                        Filesize

                                        8KB

                                        Download

                                      • memory/4200-28-0x00007FFB34540000-0x00007FFB35001000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/4200-8-0x0000000002A20000-0x0000000002A2C000-memory.dmp

                                        Filesize

                                        48KB

                                        Download

                                      • memory/4200-7-0x0000000002A10000-0x0000000002A1A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/4200-4-0x0000000002A30000-0x0000000002A80000-memory.dmp

                                        Filesize

                                        320KB

                                        Download

                                      • memory/4200-10-0x000000001B470000-0x000000001B47E000-memory.dmp

                                        Filesize

                                        56KB

                                        Download

                                      • memory/4200-3-0x00000000010D0000-0x00000000010EC000-memory.dmp

                                        Filesize

                                        112KB

                                        Download

                                      • memory/4200-2-0x00007FFB34540000-0x00007FFB35001000-memory.dmp

                                        Filesize

                                        10.8MB

                                        Download

                                      • memory/4200-6-0x0000000002A00000-0x0000000002A10000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/4200-1-0x0000000000630000-0x0000000000798000-memory.dmp

                                        Filesize

                                        1.4MB

                                        Download