Overview

overview

10

Static

static

10

646A50D060...44.exe

windows7-x64

10

646A50D060...44.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26/11/2024, 09:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    646A50D060AE1B649F0CA735AABF5744.exe
  • Size 3.6MB
  • Sample241126-k2qrfstrhw
  • SHA256 078a6edfe74bdca838f020373b45f18d1a89abe276d75eedba8cc4a0e8ac0acd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratdiscoveryevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 29 IoCs
    persistence
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 39 IoCs
    evasiontrojan
  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 58 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 26 IoCs
    evasiontrojan
  • Drops file in Program Files directory 24 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 39 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\646A50D060AE1B649F0CA735AABF5744.exe
    "C:\Users\Admin\AppData\Local\Temp\646A50D060AE1B649F0CA735AABF5744.exe"
    1⤵
    • DcRat
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\fontMonitor\B6f2SnQ47.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2352
        • C:\fontMonitor\chainagent.exe
          "C:\fontMonitor\chainagent.exe"
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2756
          • C:\fontMonitor\chainagent.exe
            "C:\fontMonitor\chainagent.exe"
            5⤵
            • Modifies WinLogon for persistence
            • UAC bypass
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1620
            • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
              "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
              6⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1608
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\573d88df-fbee-4e1a-b178-94defe651605.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:656
                • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                  8⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1468
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d264708-fecf-4735-8a3b-3365576a9b44.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2324
                    • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                      "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                      10⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:2652
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e44e4e8c-4e6f-4165-a516-1a55c6648e1e.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1808
                        • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                          "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                          12⤵
                          • UAC bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:1828
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80250c2a-f815-42f5-9326-34a3c4e61b19.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:600
                            • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                              "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                              14⤵
                              • UAC bypass
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1488
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb9696b6-458b-498c-985f-eaa0e1a41b7c.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2284
                                • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                                  "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                                  16⤵
                                  • UAC bypass
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2844
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\129ddd22-a040-47e8-9703-ba9d80ec6943.vbs"
                                    17⤵
                                      PID:268
                                      • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                                        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                                        18⤵
                                        • UAC bypass
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2084
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\652f3ec3-b1e5-4adc-90ca-1dd1bdf35a81.vbs"
                                          19⤵
                                            PID:2796
                                            • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                                              "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                                              20⤵
                                              • UAC bypass
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:2444
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b710f29-4dcb-4c10-bb9f-a0d373ad86bd.vbs"
                                                21⤵
                                                  PID:2964
                                                  • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                                                    "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                                                    22⤵
                                                    • UAC bypass
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:1784
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59db4efd-b79f-47c6-acf3-e93833f8fdf1.vbs"
                                                      23⤵
                                                        PID:3048
                                                        • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                                                          "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                                                          24⤵
                                                          • UAC bypass
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:1012
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ca7257b-88b3-4d9e-adba-785d719dc61b.vbs"
                                                            25⤵
                                                              PID:1232
                                                              • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe
                                                                "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe"
                                                                26⤵
                                                                • UAC bypass
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:1736
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afed1cc4-f532-4e9a-857b-a7daef91385d.vbs"
                                                                  27⤵
                                                                    PID:1132
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61dfab41-32b6-4bbb-8d21-837b825cfde9.vbs"
                                                                    27⤵
                                                                      PID:1280
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e417382a-795e-44e7-8aff-a2626c53316e.vbs"
                                                                  25⤵
                                                                    PID:1028
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4600e9e8-b06c-4c3d-ba5d-031fd04aed22.vbs"
                                                                23⤵
                                                                  PID:3032
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f98016c-8048-4a3a-b2e9-bc88de2e7a51.vbs"
                                                              21⤵
                                                                PID:2092
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b33ce88e-9ea4-42aa-b5a5-10c76dd31d13.vbs"
                                                            19⤵
                                                              PID:2780
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf80b737-e41f-47b1-96db-0c6c1690e534.vbs"
                                                          17⤵
                                                            PID:2676
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dbfa5505-758b-43e9-b050-cdea3b980661.vbs"
                                                        15⤵
                                                          PID:2792
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2ac818a-07e0-4566-a0dd-f10d69653d17.vbs"
                                                      13⤵
                                                        PID:2540
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc2cbf40-7baf-420c-83b0-0b49dba83271.vbs"
                                                    11⤵
                                                      PID:3064
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c4aabea-79a6-4517-a67d-dd71a036fbab.vbs"
                                                  9⤵
                                                    PID:1668
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8625e51-d382-463d-ae70-26aeafa1de33.vbs"
                                                7⤵
                                                  PID:2816
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\smss.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:804
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:2004
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1596
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      PID:2792
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1244
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2512
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2924
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1796
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2012
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\smss.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1656
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\L2Schemas\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2016
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:1504
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2464
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2088
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2132
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\winlogon.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      PID:556
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:532
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:1564
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:936
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2128
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:1776
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2568
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:444
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2380
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\it-IT\lsm.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1944
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\it-IT\lsm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1280
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Windows\PolicyDefinitions\it-IT\lsm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1828
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:284
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:1472
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2140
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Windows\Fonts\taskhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:268
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Fonts\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2340
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1880
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Links\Idle.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1528
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Links\Idle.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:1344
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Links\Idle.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2984
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1512
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:2696
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\csrss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2400
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Games\Mahjong\en-US\smss.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1908
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Mahjong\en-US\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1640
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Games\Mahjong\en-US\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      PID:2244
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Windows\it-IT\taskhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      PID:2056
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\it-IT\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2844
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\it-IT\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2752
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\Microsoft Shared\Filters\spoolsv.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2564
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\Filters\spoolsv.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2640
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\Microsoft Shared\Filters\spoolsv.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2776
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\lsm.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2632
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\lsm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      PID:2772
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\lsm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2668
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\smss.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2160
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1128
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1392
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1700
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2948
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1544
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:676
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1356
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2164
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Recent\dwm.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1748
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Recent\dwm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      PID:2424
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Recent\dwm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1196
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1396
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      PID:2924
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\services.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:644
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\fontMonitor\taskhost.exe'" /f
                                      1⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1104
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\fontMonitor\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1952
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\fontMonitor\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      PID:1556
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\fontMonitor\Idle.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1532
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\fontMonitor\Idle.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      PID:1736
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\fontMonitor\Idle.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2896
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\browser\audiodg.exe'" /f
                                      1⤵
                                      • DcRat
                                      PID:2576
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\audiodg.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      PID:1852
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\browser\audiodg.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2372
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2284
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2740
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Photo Viewer\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2820
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\fontMonitor\explorer.exe'" /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2236
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\fontMonitor\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2492
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\fontMonitor\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:748
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\taskhost.exe'" /f
                                      1⤵
                                      • DcRat
                                      PID:2500
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\taskhost.exe'" /rl HIGHEST /f
                                      1⤵
                                        PID:2944
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\taskhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • DcRat
                                        PID:948
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "chainagentc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\chainagent.exe'" /f
                                        1⤵
                                          PID:1308
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "chainagent" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\chainagent.exe'" /rl HIGHEST /f
                                          1⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:872
                                        • C:\Windows\system32\schtasks.exe
                                          schtasks.exe /create /tn "chainagentc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\chainagent.exe'" /rl HIGHEST /f
                                          1⤵
                                          • DcRat
                                          PID:756

                                        Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Privilege Escalation

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Defense Evasion

                                              Abuse Elevation Control Mechanism

                                              1
                                              T1548

                                              Bypass User Account Control

                                              1
                                              T1548.002

                                              Impair Defenses

                                              1
                                              T1562

                                              Disable or Modify Tools

                                              1
                                              T1562.001

                                              Modify Registry

                                              4
                                              T1112

                                              Credential Access

                                              Discovery

                                              Query Registry

                                              1
                                              T1012

                                              System Information Discovery

                                              2
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              Lateral Movement

                                              Collection

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              27d1bcfc3c54e0
                                              • Path C:\Program Files\Windows Photo Viewer\27d1bcfc3c54e0
                                              • Size 420B
                                              • SHA256 f04a6dd5ce97a248ed89a7f351de558966bba7b90d075c5b066cae0e172319e2
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 d528dcb6b8cc359b6c42b4f5b654c7c35193d17c070eaca25413ef8e9f42b3da
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 6d6bfc5a92f2d9ba1af52f141105e6d8b2e96fc3399df45f0dc45ba90d24b095
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 7e7cb65c9504142eed2bee802db5fef50d77b4fbbf792fc78efb31f62699d50a
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 9511e2b21140f0e9f70bd5fd18b7dd0544f5f0733a0ea046c5882a80f8e95162
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 c08bd49929f89a1a003d8f5f9091d308565ba3549b5fcb16378343636b20858c
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 9b5163016248aec5e2bd2906f248584dcf5a638d28a84783a7ad8aab03cd1b84
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 a6b79864418d01aa0c0c75aafe18354e0f424aa4fa1793413bee27bd82c2eacf
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 1994958255d95429ffda1e2bb9e5d79c10c26817518a602d8f527d2f71c2af36
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 586f46bd559f0163db03a3f45d571aba7f01ace39407b060486ffa0ddf564746
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              94308059B57B3142E455B38A6EB92015
                                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                              • Size 342B
                                              • SHA256 b85005724475ad68996804dd905dd020a399f3cb632b2c906a2e789d3c818edb
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              129ddd22-a040-47e8-9703-ba9d80ec6943.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\129ddd22-a040-47e8-9703-ba9d80ec6943.vbs
                                              • Size 757B
                                              • SHA256 baf7a8598e8edcb3486f6130955107863371a21f2f25e62c867ef68dc1bd4266
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              2b710f29-4dcb-4c10-bb9f-a0d373ad86bd.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\2b710f29-4dcb-4c10-bb9f-a0d373ad86bd.vbs
                                              • Size 757B
                                              • SHA256 e9ab5a6870113d71f7086e669772b0a97283ba6d643efd5db4fe5d3f473264cd
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              4ca7257b-88b3-4d9e-adba-785d719dc61b.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\4ca7257b-88b3-4d9e-adba-785d719dc61b.vbs
                                              • Size 757B
                                              • SHA256 57d4d556835da22ffff2e771bbb443d176d04b881f0d63780b50ef13ee0794f8
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              573d88df-fbee-4e1a-b178-94defe651605.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\573d88df-fbee-4e1a-b178-94defe651605.vbs
                                              • Size 757B
                                              • SHA256 25c13c8702509459d802a32e5507f6ae748b4b319addd9142535b466fc29de3a
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              59db4efd-b79f-47c6-acf3-e93833f8fdf1.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\59db4efd-b79f-47c6-acf3-e93833f8fdf1.vbs
                                              • Size 757B
                                              • SHA256 e3fdd2bc366655e93cc5e32a51e1839eaf3afb7c4e9cc32a537893925b66246c
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              5d264708-fecf-4735-8a3b-3365576a9b44.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\5d264708-fecf-4735-8a3b-3365576a9b44.vbs
                                              • Size 757B
                                              • SHA256 6853eab47e38df940977329a9924b6876b0da98dcc486e225aa3e8964c53ea8e
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              652f3ec3-b1e5-4adc-90ca-1dd1bdf35a81.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\652f3ec3-b1e5-4adc-90ca-1dd1bdf35a81.vbs
                                              • Size 757B
                                              • SHA256 b7a79940622b9a3cc8ccda7d5ede17c38209143c31923b0bc841667f514bcdf3
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              80250c2a-f815-42f5-9326-34a3c4e61b19.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\80250c2a-f815-42f5-9326-34a3c4e61b19.vbs
                                              • Size 757B
                                              • SHA256 d25ed8eb8afb8cd2243039d5df7fc85e1401f96841fac41e97cea9ebdbf38209
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              CabC6CA.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\CabC6CA.tmp
                                              • Size 70KB
                                              • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              TarC6DD.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\TarC6DD.tmp
                                              • Size 181KB
                                              • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              afed1cc4-f532-4e9a-857b-a7daef91385d.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\afed1cc4-f532-4e9a-857b-a7daef91385d.vbs
                                              • Size 757B
                                              • SHA256 6ca7f4c984c8ebfb3900d780a4a36a62267cebf33d34045cce31660a25688045
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              bb9696b6-458b-498c-985f-eaa0e1a41b7c.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\bb9696b6-458b-498c-985f-eaa0e1a41b7c.vbs
                                              • Size 757B
                                              • SHA256 c06e6a2393906bc30e3ae51c530346bc00e9e214e27e67a3fe192692be9c45cc
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              d8625e51-d382-463d-ae70-26aeafa1de33.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\d8625e51-d382-463d-ae70-26aeafa1de33.vbs
                                              • Size 533B
                                              • SHA256 6a1b5927154794ae00aa0b85d9abfc22690d86626da8d8bab2de12bb97b62a4c
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              e44e4e8c-4e6f-4165-a516-1a55c6648e1e.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\e44e4e8c-4e6f-4165-a516-1a55c6648e1e.vbs
                                              • Size 757B
                                              • SHA256 10ea054b36bf8abc08a20f91174f57cc3862d1a38ab6d287170c5893a8840449
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              B6f2SnQ47.bat
                                              • Path C:\fontMonitor\B6f2SnQ47.bat
                                              • Size 31B
                                              • SHA256 52bde46534a8a1ea436617040c311631ce470e0e60875585921e2b3fbde3809c
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              GFcBidplGj1mDhuTvzK8nh.vbe
                                              • Path C:\fontMonitor\GFcBidplGj1mDhuTvzK8nh.vbe
                                              • Size 197B
                                              • SHA256 d3be77c2e695644f8dfbc8342c806f5f48c3074f5ea1000aa300b6c7061e591f
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              chainagent.exe
                                              • Path \fontMonitor\chainagent.exe
                                              • Size 3.3MB
                                              • SHA256 58440f3b4db0b30ffa0001857bd2cf329d470c518895ac668ab2eb25a10499f7
                                              • MD5 SHA1 SHA512 SSDEEP
                                              Submit Download

                                              memory/1012-1185-0x0000000000840000-0x0000000000852000-memory.dmp
                                              Download

                                              memory/1012-1184-0x0000000000200000-0x000000000055C000-memory.dmp
                                              Download

                                              memory/1468-232-0x0000000000DE0000-0x0000000000DF2000-memory.dmp
                                              Download

                                              memory/1488-590-0x00000000002A0000-0x00000000005FC000-memory.dmp
                                              Download

                                              memory/1608-115-0x0000000000C00000-0x0000000000C56000-memory.dmp
                                              Download

                                              memory/1620-68-0x0000000000D90000-0x0000000000DA2000-memory.dmp
                                              Download

                                              memory/1736-1304-0x0000000001240000-0x000000000159C000-memory.dmp
                                              Download

                                              memory/1828-470-0x00000000010E0000-0x000000000143C000-memory.dmp
                                              Download

                                              memory/1828-471-0x0000000000C90000-0x0000000000CE6000-memory.dmp
                                              Download

                                              memory/2084-829-0x00000000010A0000-0x00000000013FC000-memory.dmp
                                              Download

                                              memory/2084-830-0x0000000001050000-0x00000000010A6000-memory.dmp
                                              Download

                                              memory/2652-351-0x0000000000050000-0x00000000003AC000-memory.dmp
                                              Download

                                              memory/2756-29-0x0000000000E60000-0x0000000000E68000-memory.dmp
                                              Download

                                              memory/2756-23-0x0000000000B30000-0x0000000000B3C000-memory.dmp
                                              Download

                                              memory/2756-45-0x000000001B080000-0x000000001B08A000-memory.dmp
                                              Download

                                              memory/2756-44-0x000000001B070000-0x000000001B078000-memory.dmp
                                              Download

                                              memory/2756-43-0x000000001B060000-0x000000001B06C000-memory.dmp
                                              Download

                                              memory/2756-42-0x000000001B050000-0x000000001B05E000-memory.dmp
                                              Download

                                              memory/2756-41-0x000000001B040000-0x000000001B048000-memory.dmp
                                              Download

                                              memory/2756-40-0x000000001B030000-0x000000001B03E000-memory.dmp
                                              Download

                                              memory/2756-39-0x000000001AF20000-0x000000001AF2A000-memory.dmp
                                              Download

                                              memory/2756-38-0x000000001AF10000-0x000000001AF1C000-memory.dmp
                                              Download

                                              memory/2756-37-0x000000001AB30000-0x000000001AB38000-memory.dmp
                                              Download

                                              memory/2756-36-0x000000001AB20000-0x000000001AB2C000-memory.dmp
                                              Download

                                              memory/2756-35-0x000000001AB10000-0x000000001AB1C000-memory.dmp
                                              Download

                                              memory/2756-34-0x000000001AB00000-0x000000001AB08000-memory.dmp
                                              Download

                                              memory/2756-33-0x000000001AAF0000-0x000000001AAFC000-memory.dmp
                                              Download

                                              memory/2756-32-0x0000000001310000-0x0000000001322000-memory.dmp
                                              Download

                                              memory/2756-31-0x0000000000E80000-0x0000000000E88000-memory.dmp
                                              Download

                                              memory/2756-13-0x0000000001340000-0x000000000169C000-memory.dmp
                                              Download

                                              memory/2756-14-0x0000000000160000-0x000000000016E000-memory.dmp
                                              Download

                                              memory/2756-30-0x0000000000E70000-0x0000000000E7C000-memory.dmp
                                              Download

                                              memory/2756-28-0x0000000000E50000-0x0000000000E5C000-memory.dmp
                                              Download

                                              memory/2756-27-0x000000001AAA0000-0x000000001AAF6000-memory.dmp
                                              Download

                                              memory/2756-26-0x0000000000E40000-0x0000000000E4A000-memory.dmp
                                              Download

                                              memory/2756-24-0x0000000000B20000-0x0000000000B28000-memory.dmp
                                              Download

                                              memory/2756-25-0x0000000000CA0000-0x0000000000CB0000-memory.dmp
                                              Download

                                              memory/2756-46-0x000000001B090000-0x000000001B09C000-memory.dmp
                                              Download

                                              memory/2756-22-0x0000000000A90000-0x0000000000AA2000-memory.dmp
                                              Download

                                              memory/2756-20-0x0000000000A70000-0x0000000000A86000-memory.dmp
                                              Download

                                              memory/2756-21-0x00000000004C0000-0x00000000004C8000-memory.dmp
                                              Download

                                              memory/2756-19-0x00000000003C0000-0x00000000003D0000-memory.dmp
                                              Download

                                              memory/2756-18-0x00000000003B0000-0x00000000003B8000-memory.dmp
                                              Download

                                              memory/2756-17-0x0000000000390000-0x00000000003AC000-memory.dmp
                                              Download

                                              memory/2756-16-0x0000000000180000-0x0000000000188000-memory.dmp
                                              Download

                                              memory/2756-15-0x0000000000170000-0x000000000017E000-memory.dmp
                                              Download

                                              memory/2844-710-0x0000000000D90000-0x0000000000DA2000-memory.dmp
                                              Download

                                              memory/2844-709-0x0000000000ED0000-0x000000000122C000-memory.dmp
                                              Download