dcrat | 8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/11/2024, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
E96B9E17DA08C5A64C26DC666402C64F.exe
Size 1.2MB
Sample241130-je8s3ssphp
SHA256 8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372
MD5 e96b9e17da08c5a64c26dc666402c64f
SHA1 cceec5c7f6f4bbf08c63153a0dea8b5834ed38ee
SHA512 dd71101f1b6b0dcd545bec2e448c6368a8653b599a5b0de3287ac50126b0c380a325e92fa201bdd869d97cf18e63d0795879923e9364abb92adfc57af02d5040
SSDEEP 24576:QGZn/lA+WQi7Tw3d3pI0eqZb/bte1aMiL/8LLKwi/TIRk:QGzAy1Sob6CsL8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer persistence rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:/Users/Admin/AppData/Local/\\lsm.exe\""	E96B9E17DA08C5A64C26DC666402C64F.exe

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	1196	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1196	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1196	schtasks.exe	30

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe

DCRat payload 8 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/2328-1-0x0000000001150000-0x0000000001294000-memory.dmp	dcrat
behavioral1/files/0x000a000000012033-17.dat	dcrat
behavioral1/memory/2944-19-0x0000000000E40000-0x0000000000F84000-memory.dmp	dcrat
behavioral1/memory/620-52-0x0000000001030000-0x0000000001174000-memory.dmp	dcrat
behavioral1/memory/2476-64-0x00000000010B0000-0x00000000011F4000-memory.dmp	dcrat
behavioral1/memory/2824-87-0x0000000001340000-0x0000000001484000-memory.dmp	dcrat
behavioral1/memory/2756-132-0x00000000001C0000-0x0000000000304000-memory.dmp	dcrat
behavioral1/memory/1964-144-0x0000000001360000-0x00000000014A4000-memory.dmp	dcrat

Executes dropped EXE 13 IoCs

pid	Process
2944	lsm.exe
2964	lsm.exe
2052	lsm.exe
620	lsm.exe
2476	lsm.exe
2460	lsm.exe
2824	lsm.exe
2964	lsm.exe
2028	lsm.exe
944	lsm.exe
2756	lsm.exe
1964	lsm.exe
848	lsm.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:/Users/Admin/AppData/Local/\\lsm.exe\""	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:/Users/Admin/AppData/Local/\\lsm.exe\""	E96B9E17DA08C5A64C26DC666402C64F.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	E96B9E17DA08C5A64C26DC666402C64F.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2720	schtasks.exe
2280	schtasks.exe
2288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2328	E96B9E17DA08C5A64C26DC666402C64F.exe
2944	lsm.exe
2964	lsm.exe
2052	lsm.exe
620	lsm.exe
2476	lsm.exe
2460	lsm.exe
2824	lsm.exe
2964	lsm.exe
2028	lsm.exe
944	lsm.exe
2756	lsm.exe
1964	lsm.exe
848	lsm.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	E96B9E17DA08C5A64C26DC666402C64F.exe
Token: SeDebugPrivilege	2944	lsm.exe
Token: SeDebugPrivilege	2964	lsm.exe
Token: SeDebugPrivilege	2052	lsm.exe
Token: SeDebugPrivilege	620	lsm.exe
Token: SeDebugPrivilege	2476	lsm.exe
Token: SeDebugPrivilege	2460	lsm.exe
Token: SeDebugPrivilege	2824	lsm.exe
Token: SeDebugPrivilege	2964	lsm.exe
Token: SeDebugPrivilege	2028	lsm.exe
Token: SeDebugPrivilege	944	lsm.exe
Token: SeDebugPrivilege	2756	lsm.exe
Token: SeDebugPrivilege	1964	lsm.exe
Token: SeDebugPrivilege	848	lsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2880	2328	E96B9E17DA08C5A64C26DC666402C64F.exe	34
PID 2328 wrote to memory of 2880	2328	E96B9E17DA08C5A64C26DC666402C64F.exe	34
PID 2328 wrote to memory of 2880	2328	E96B9E17DA08C5A64C26DC666402C64F.exe	34
PID 2880 wrote to memory of 2636	2880	cmd.exe	36
PID 2880 wrote to memory of 2636	2880	cmd.exe	36
PID 2880 wrote to memory of 2636	2880	cmd.exe	36
PID 2880 wrote to memory of 2944	2880	cmd.exe	38
PID 2880 wrote to memory of 2944	2880	cmd.exe	38
PID 2880 wrote to memory of 2944	2880	cmd.exe	38
PID 2944 wrote to memory of 2692	2944	lsm.exe	39
PID 2944 wrote to memory of 2692	2944	lsm.exe	39
PID 2944 wrote to memory of 2692	2944	lsm.exe	39
PID 2944 wrote to memory of 1484	2944	lsm.exe	40
PID 2944 wrote to memory of 1484	2944	lsm.exe	40
PID 2944 wrote to memory of 1484	2944	lsm.exe	40
PID 2692 wrote to memory of 2964	2692	WScript.exe	41
PID 2692 wrote to memory of 2964	2692	WScript.exe	41
PID 2692 wrote to memory of 2964	2692	WScript.exe	41
PID 2964 wrote to memory of 3012	2964	lsm.exe	42
PID 2964 wrote to memory of 3012	2964	lsm.exe	42
PID 2964 wrote to memory of 3012	2964	lsm.exe	42
PID 2964 wrote to memory of 836	2964	lsm.exe	43
PID 2964 wrote to memory of 836	2964	lsm.exe	43
PID 2964 wrote to memory of 836	2964	lsm.exe	43
PID 3012 wrote to memory of 2052	3012	WScript.exe	44
PID 3012 wrote to memory of 2052	3012	WScript.exe	44
PID 3012 wrote to memory of 2052	3012	WScript.exe	44
PID 2052 wrote to memory of 1736	2052	lsm.exe	45
PID 2052 wrote to memory of 1736	2052	lsm.exe	45
PID 2052 wrote to memory of 1736	2052	lsm.exe	45
PID 2052 wrote to memory of 1784	2052	lsm.exe	46
PID 2052 wrote to memory of 1784	2052	lsm.exe	46
PID 2052 wrote to memory of 1784	2052	lsm.exe	46
PID 1736 wrote to memory of 620	1736	WScript.exe	47
PID 1736 wrote to memory of 620	1736	WScript.exe	47
PID 1736 wrote to memory of 620	1736	WScript.exe	47
PID 620 wrote to memory of 644	620	lsm.exe	48
PID 620 wrote to memory of 644	620	lsm.exe	48
PID 620 wrote to memory of 644	620	lsm.exe	48
PID 620 wrote to memory of 2360	620	lsm.exe	49
PID 620 wrote to memory of 2360	620	lsm.exe	49
PID 620 wrote to memory of 2360	620	lsm.exe	49
PID 644 wrote to memory of 2476	644	WScript.exe	50
PID 644 wrote to memory of 2476	644	WScript.exe	50
PID 644 wrote to memory of 2476	644	WScript.exe	50
PID 2476 wrote to memory of 2344	2476	lsm.exe	51
PID 2476 wrote to memory of 2344	2476	lsm.exe	51
PID 2476 wrote to memory of 2344	2476	lsm.exe	51
PID 2476 wrote to memory of 2512	2476	lsm.exe	52
PID 2476 wrote to memory of 2512	2476	lsm.exe	52
PID 2476 wrote to memory of 2512	2476	lsm.exe	52
PID 2344 wrote to memory of 2460	2344	WScript.exe	53
PID 2344 wrote to memory of 2460	2344	WScript.exe	53
PID 2344 wrote to memory of 2460	2344	WScript.exe	53
PID 2460 wrote to memory of 2920	2460	lsm.exe	54
PID 2460 wrote to memory of 2920	2460	lsm.exe	54
PID 2460 wrote to memory of 2920	2460	lsm.exe	54
PID 2460 wrote to memory of 2680	2460	lsm.exe	55
PID 2460 wrote to memory of 2680	2460	lsm.exe	55
PID 2460 wrote to memory of 2680	2460	lsm.exe	55
PID 2920 wrote to memory of 2824	2920	WScript.exe	56
PID 2920 wrote to memory of 2824	2920	WScript.exe	56
PID 2920 wrote to memory of 2824	2920	WScript.exe	56
PID 2824 wrote to memory of 2828	2824	lsm.exe	57

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	E96B9E17DA08C5A64C26DC666402C64F.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe
"C:\Users\Admin\AppData\Local\Temp\E96B9E17DA08C5A64C26DC666402C64F.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LDqlTPpYLb.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2636
- - C:\Users\Admin\AppData\Local\lsm.exe
    "C:/Users/Admin/AppData/Local/\lsm.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2944
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3b90500-50ef-4890-9df2-8a5ea2aefea2.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2964
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10f34b13-eb48-4a19-823a-5daa953a264b.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef34e3c5-c8db-4c90-8b1f-724f1f2337ce.vbs"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b37b511-0dbe-491e-81c9-98477d7416e7.vbs"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2476
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7acf6a76-91bc-4654-b58a-4720f5242923.vbs"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2460
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\068a8cc9-eb57-4417-84d0-fe06d55e9eff.vbs"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2824
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9df2d02d-24bb-4c42-9498-d2fe74d9d24a.vbs"
        16⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\92e37356-4a03-453a-8ce4-31fa7c81ac10.vbs"
        18⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2028
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5eb579f1-0576-4cc9-9a38-6363a68424dc.vbs"
        20⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        21⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:944
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e9d4c24-bcd7-4321-a0d1-97b9ea0277de.vbs"
        22⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        23⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd99d9d8-4e56-4f7f-8326-5c7074b66ed0.vbs"
        24⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        25⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1964
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\536e9a9d-8ecf-4d3b-91fb-53bc994f3be1.vbs"
        26⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\lsm.exe
        
        C:\Users\Admin\AppData\Local\lsm.exe
        27⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:848
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48cb2d58-7c6a-45a2-a8c8-498830b85200.vbs"
        28⤵
        
        PID:2616
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23d40032-7691-44e8-85d6-aa8174e431d4.vbs"
        28⤵
        
        PID:1096
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3537fa30-a21f-47f8-b761-7ca69dabfbc5.vbs"
        26⤵
        
        PID:284
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eee013fa-7701-4428-b39a-a404c4219669.vbs"
        24⤵
        
        PID:2220
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31470a26-6d4f-4207-8e83-e6cf92ab038a.vbs"
        22⤵
        
        PID:2288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc750aac-11ab-4876-ad73-6b12e790860e.vbs"
        20⤵
        
        PID:1768
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\527ffcb5-6f38-422a-b928-9dcce304c32e.vbs"
        18⤵
        
        PID:352
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a70fc28b-8cf9-4a0c-b60c-ea47815690c9.vbs"
        16⤵
        
        PID:3024
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4a55f9ce-ee8a-4a45-bc96-1251786bba37.vbs"
        14⤵
        
        PID:2680
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e90e2d7-deaa-47a9-80d2-e348d2bccf8e.vbs"
        12⤵
        
        PID:2512
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27bcef4c-07f6-40cd-9ae7-b23e63d37cc8.vbs"
        10⤵
        
        PID:2360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\014ebc95-722a-49bb-9e44-7f2d71f856f5.vbs"
        8⤵
        
        PID:1784
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\106bec44-c8cf-411a-870a-a2ba33ecd110.vbs"
        6⤵
        
        PID:836
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a4bb7ae3-ccd4-47db-abc7-0065e635bed6.vbs"
      4⤵
      PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:/Users/Admin/AppData/Local/\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:/Users/Admin/AppData/Local/\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:/Users/Admin/AppData/Local/\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

068a8cc9-eb57-4417-84d0-fe06d55e9eff.vbs

Path C:\Users\Admin\AppData\Local\Temp\068a8cc9-eb57-4417-84d0-fe06d55e9eff.vbs
Size 712B
SHA256 f22962a3329265e38037d38d9778a7156b8389d5cd8421247102ca87ecb35550
MD5 6fca7d427207f5623812495ee6566d4d
SHA1 549609f68e016d0410c2867aa34342697c6cd155
SHA512 ea964229b62e7a114dccddaeaf823f0a32cebd028be6ccf41abcbba92ad784a3e7191bc6500e7928a34204a1d86ce306c92c1b263f2309e25f9d848b9a193761
MD5 SHA1 SHA512

Submit Download

10f34b13-eb48-4a19-823a-5daa953a264b.vbs

Path C:\Users\Admin\AppData\Local\Temp\10f34b13-eb48-4a19-823a-5daa953a264b.vbs
Size 712B
SHA256 1ecd8b06cbb655f12d7cf4cd602ec19e5a833c087191e32e322e2f77aa0a33f4
MD5 f524fdddb305566f40a6df0af89d73a1
SHA1 5d16c6971d18619c11b3e529e94a3a92969ccf59
SHA512 49bb78f9301474505c8fd447885b6bcc3bc716c818f84cc2160086e39fd7f1575d6d33abe8c902a6ae4a4df2da2f56d45c2d762109f313c21b9b11ff21e8f7d6
MD5 SHA1 SHA512

Submit Download

48cb2d58-7c6a-45a2-a8c8-498830b85200.vbs

Path C:\Users\Admin\AppData\Local\Temp\48cb2d58-7c6a-45a2-a8c8-498830b85200.vbs
Size 711B
SHA256 f504b788e7f69ccad8a181fc5bc9de3dfe8f0adda509fa9c6f846f6fa0553c19
MD5 a6d2a6e76e8dbddfed02538923b91a8b
SHA1 ef4d7670c1e8fe924ab74e02b7705695ae560c9b
SHA512 fcf6bcecce04b6e63a34d42601a0e054240d8f083069196afcdfe947c5aa3c462c855b5e18e2eb59aa8776ac0257158d9f679a29ed2f2e67b6ec35b45d671813
MD5 SHA1 SHA512

Submit Download

536e9a9d-8ecf-4d3b-91fb-53bc994f3be1.vbs

Path C:\Users\Admin\AppData\Local\Temp\536e9a9d-8ecf-4d3b-91fb-53bc994f3be1.vbs
Size 712B
SHA256 c9ed90b1174ee1fde90f179051f8cab68c3729406e2b7d348ee70cfcd53c8531
MD5 369c78351629fc7b8b1b4b43767c8ae3
SHA1 4e0d0261d0f5f44b243098654f62530454e3df76
SHA512 22a32fa1cdca6274bf18e09419fe87cc6f9e3b19f3e858735ae4ad2978c3270233a066937ae222e56f8a4c8367a89e19cad36dc82a46499a8ed6e3ced250d39c
MD5 SHA1 SHA512

Submit Download

5eb579f1-0576-4cc9-9a38-6363a68424dc.vbs

Path C:\Users\Admin\AppData\Local\Temp\5eb579f1-0576-4cc9-9a38-6363a68424dc.vbs
Size 712B
SHA256 b2104fb52a0f1e01f37e1d6108f2efcec874eb08cba0d5038eb0615ea804772c
MD5 d80825770c81cf1289dba128813f56a6
SHA1 a3e97ee8e8189e7cb13a554f85ca77df13bef0a3
SHA512 d29709e6d070e3e6a9a1e47c59df14ded991ec3d6dfe494fb651ad7bec0f60baefe69147c0509a1229f7e2c739fbdec48299b58d44a0acb7a7f12db16d417fe5
MD5 SHA1 SHA512

Submit Download

7acf6a76-91bc-4654-b58a-4720f5242923.vbs

Path C:\Users\Admin\AppData\Local\Temp\7acf6a76-91bc-4654-b58a-4720f5242923.vbs
Size 712B
SHA256 e1e9748da68213b662a2fe9827bf345bafd9209f2cb63e183eaae761042a2689
MD5 410529b1bbe9f4fc7ebba3e1cc22938c
SHA1 8d0f6a4423f570fe3fd098790fb40cb6a760984f
SHA512 39d12a963f27ef31b7914c08bfa68acb6c20b6454ada82c9a2edcc3008f16620e74761d6e65e48d53aee147c72270a16ad46bfa0fa46e9e1d659232cea9ee4cf
MD5 SHA1 SHA512

Submit Download

8b37b511-0dbe-491e-81c9-98477d7416e7.vbs

Path C:\Users\Admin\AppData\Local\Temp\8b37b511-0dbe-491e-81c9-98477d7416e7.vbs
Size 711B
SHA256 dcd850cd5a1a45d5a2d590cd4b5872e266942c9ded4890899444b1e1a5891495
MD5 f0e2f59acf1f098a3c5716596032a3ce
SHA1 7dd9ec59f2efc9c20ba918fb882ea4821b7f08e3
SHA512 726747db64b7155e0d8d6472c5071bc638d79d5b6c44f87b9379f39e3734ca77d88fe534a168a60cfbfdfff0e2f81d97be610e4c38afa36e8fa01f11aefba78e
MD5 SHA1 SHA512

Submit Download

8e9d4c24-bcd7-4321-a0d1-97b9ea0277de.vbs

Path C:\Users\Admin\AppData\Local\Temp\8e9d4c24-bcd7-4321-a0d1-97b9ea0277de.vbs
Size 711B
SHA256 63be53f8886f166e4fc862e6f7da0635ee39b21ca6cbb5dd74772c13fe7f8e69
MD5 829841458a53b8bbc88ba345d674900e
SHA1 7590ffeef97b434a12ac052b95cc780bc543c117
SHA512 569187e0c7b5d379524d02b6eb8fa591d0c50fec16dd1dbbc130b3a39c023ddad356d674409975a9d267b8929602f2c32c0410a85c8067f4b1f11d822217a8cf
MD5 SHA1 SHA512

Submit Download

9df2d02d-24bb-4c42-9498-d2fe74d9d24a.vbs

Path C:\Users\Admin\AppData\Local\Temp\9df2d02d-24bb-4c42-9498-d2fe74d9d24a.vbs
Size 712B
SHA256 a6ff93d7720ba910f81e0b2ecd1a59df6aef3b3140a1b303738a2bed9834dc28
MD5 36625e451f8bc834155ceb5907611979
SHA1 823bfd95f57c318e490d22de96c94cd651ce52f3
SHA512 656165917978a47c077ac855b3fbe8e566bc03a39d01db120d3bf150382c0c5dba8976638007b31ac3856a8b32448c2923a0275211688cdc7e1ccbdb72f19075
MD5 SHA1 SHA512

Submit Download

LDqlTPpYLb.bat

Path C:\Users\Admin\AppData\Local\Temp\LDqlTPpYLb.bat
Size 202B
SHA256 ff1a5cd9a147f7831273cf2d2b99f120c5d678ef7944273dfd8daf98153cb4a0
MD5 e3306462ee2aa7104b3750bf199dde11
SHA1 4d5cc34d6e866c437544479f40a76c0a276a614a
SHA512 aea94de78d4d56081b13ab19b99014ae65dbb7d3a743416ba3b091a1fe50f9b8616859fc421b2fd8a76d486a6919d59a678bf745d5b8fcba52e68361e9c9bf5c
MD5 SHA1 SHA512

Submit Download

a4bb7ae3-ccd4-47db-abc7-0065e635bed6.vbs

Path C:\Users\Admin\AppData\Local\Temp\a4bb7ae3-ccd4-47db-abc7-0065e635bed6.vbs
Size 488B
SHA256 11830d1ae0a74e4dec3ac54505920303afe998fd846d007010c7fda57d235ece
MD5 3e2b94a4f1e98cc20b84fb8143b5949e
SHA1 36c785a6c7d7f581839dcb23e139183d066100a3
SHA512 8cce3024557ac40e77c7af34fc9d2ff1c3a4230a9cf7d6f7f8eab5d57b226aada45969f48e59bd30244b4c098dfe1a052e934745865159e862a48590c071f76a
MD5 SHA1 SHA512

Submit Download

b3b90500-50ef-4890-9df2-8a5ea2aefea2.vbs

Path C:\Users\Admin\AppData\Local\Temp\b3b90500-50ef-4890-9df2-8a5ea2aefea2.vbs
Size 712B
SHA256 ae90bce3e774410a4a8cdbd0824de3ac227efd59497d29aa5d7f72e70ecdabd0
MD5 cac814ee8fdb265499fcf0e462b2c256
SHA1 152a4de8e34acc32c4d84bc4307b4f603e7a156d
SHA512 d2479d3ce0e48dc0ba9c5e9731c17288fb134dffe31b0805b187ad918168678546caf2664db462e0a05159753b9a3848a37ff86139c224edb846d3cc1849eab4
MD5 SHA1 SHA512

Submit Download

bd99d9d8-4e56-4f7f-8326-5c7074b66ed0.vbs

Path C:\Users\Admin\AppData\Local\Temp\bd99d9d8-4e56-4f7f-8326-5c7074b66ed0.vbs
Size 712B
SHA256 a7dbdb8600ea74d643005571c1969394848e358ca1ab2dd91f326220bcf08d27
MD5 f22c7433028523e1f3153444c2199911
SHA1 d4e86f47dc1aa7a719f66bfdf004c26eb6609d5d
SHA512 13e205a778d0aaf6118596cf4ad73d2f82fadbf2251cf78d992434e31aa873a98d9f0d371657eee6fcaa3f93ed51d4cd18b73c3f3da62a39e8c27eee8e86e260
MD5 SHA1 SHA512

Submit Download

ef34e3c5-c8db-4c90-8b1f-724f1f2337ce.vbs

Path C:\Users\Admin\AppData\Local\Temp\ef34e3c5-c8db-4c90-8b1f-724f1f2337ce.vbs
Size 712B
SHA256 c716c98d57c2d99652c6200144e57061863ce450b5c55a52429be5b41ab2a8ac
MD5 734eae8f518dbe045fa17ea3411320d1
SHA1 ec6a3e2ad48bd744fcc2dfefc0e6db731a1890e7
SHA512 240581f48663cde10a323c0999d8e87963bc68c32d335c104793ab061b5e29f57c07705784f3b6d7807f24e15239899ce9ce72afddbcc24aadc5bfebd9059bd8
MD5 SHA1 SHA512

Submit Download

lsm.exe

Path C:\Users\Admin\AppData\Local\lsm.exe
Size 1.2MB
SHA256 8e7147a2aaffb6632052f190dad38b7d945ae42f1c4e21307f6d9079afb76372
MD5 e96b9e17da08c5a64c26dc666402c64f
SHA1 cceec5c7f6f4bbf08c63153a0dea8b5834ed38ee
SHA512 dd71101f1b6b0dcd545bec2e448c6368a8653b599a5b0de3287ac50126b0c380a325e92fa201bdd869d97cf18e63d0795879923e9364abb92adfc57af02d5040
SSDEEP 24576:QGZn/lA+WQi7Tw3d3pI0eqZb/bte1aMiL/8LLKwi/TIRk:QGzAy1Sob6CsL8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/620-52-0x0000000001030000-0x0000000001174000-memory.dmp

Download

memory/1964-144-0x0000000001360000-0x00000000014A4000-memory.dmp

Download

memory/2328-7-0x00000000005F0000-0x00000000005FC000-memory.dmp

Download

memory/2328-15-0x000007FEF61C0000-0x000007FEF6BAC000-memory.dmp

Download

memory/2328-0-0x000007FEF61C3000-0x000007FEF61C4000-memory.dmp

Download

memory/2328-6-0x0000000000560000-0x000000000056A000-memory.dmp

Download

memory/2328-5-0x00000000003C0000-0x00000000003CA000-memory.dmp

Download

memory/2328-4-0x0000000000540000-0x0000000000556000-memory.dmp

Download

memory/2328-3-0x0000000000520000-0x000000000053C000-memory.dmp

Download

memory/2328-2-0x000007FEF61C0000-0x000007FEF6BAC000-memory.dmp

Download

memory/2328-1-0x0000000001150000-0x0000000001294000-memory.dmp

Download

memory/2476-64-0x00000000010B0000-0x00000000011F4000-memory.dmp

Download

memory/2756-132-0x00000000001C0000-0x0000000000304000-memory.dmp

Download

memory/2824-87-0x0000000001340000-0x0000000001484000-memory.dmp

Download

memory/2944-19-0x0000000000E40000-0x0000000000F84000-memory.dmp

Download