Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe
Resource
win10v2004-20241007-en
General
-
Target
d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe
-
Size
2.9MB
-
MD5
ce2ec4539435dfeac7e246fe5565c521
-
SHA1
59f3da006005a109914c31b5d5cd94dc4c93309c
-
SHA256
d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562
-
SHA512
408a1db2cd98702bca3811e124d78a56cbca79a1d200593759bde1947a4a599f8cd40cd8dbb2e7be7dec416e3f5de0c4466f98ddea1daf6d313671695f25a7ba
-
SSDEEP
49152:6h/814lignPl1s5Cp5+tOCiqgc8I7uBiYUtGGirMn0JkH4SwiLwRktMtL+CsA7Z:6h/8Hgn9u4P+l8I7uB6db0JhAw6tMtLr
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Steam\\steamclient.exe\"" d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Steam\\steamclient.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe\"" d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1040 powershell.exe 3172 powershell.exe 1044 powershell.exe 2304 powershell.exe 3960 powershell.exe 2592 powershell.exe 816 powershell.exe 3352 powershell.exe 336 powershell.exe 1828 powershell.exe 1952 powershell.exe 4572 powershell.exe 3808 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe -
Executes dropped EXE 1 IoCs
pid Process 4696 steamclient.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamclient = "\"C:\\Program Files (x86)\\Steam\\steamclient.exe\"" d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steamclient = "\"C:\\Program Files (x86)\\Steam\\steamclient.exe\"" d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe\"" d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe\"" d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\Windows\System32\CSC1D9361651A814D138D8A3945D619A65.TMP csc.exe File created \??\c:\Windows\System32\hnaorh.exe csc.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Steam\steamclient.exe d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe File opened for modification C:\Program Files (x86)\Steam\steamclient.exe d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe File created C:\Program Files (x86)\Steam\fcafd258929766 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1760 schtasks.exe 4364 schtasks.exe 1272 schtasks.exe 2196 schtasks.exe 4708 schtasks.exe 656 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 2304 powershell.exe Token: SeDebugPrivilege 336 powershell.exe Token: SeDebugPrivilege 1040 powershell.exe Token: SeDebugPrivilege 3352 powershell.exe Token: SeDebugPrivilege 1952 powershell.exe Token: SeDebugPrivilege 816 powershell.exe Token: SeDebugPrivilege 1044 powershell.exe Token: SeDebugPrivilege 3172 powershell.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeDebugPrivilege 1828 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeDebugPrivilege 4696 steamclient.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2336 wrote to memory of 4552 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 89 PID 2336 wrote to memory of 4552 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 89 PID 4552 wrote to memory of 980 4552 csc.exe 91 PID 4552 wrote to memory of 980 4552 csc.exe 91 PID 2336 wrote to memory of 1952 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 95 PID 2336 wrote to memory of 1952 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 95 PID 2336 wrote to memory of 2592 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 96 PID 2336 wrote to memory of 2592 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 96 PID 2336 wrote to memory of 3960 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 97 PID 2336 wrote to memory of 3960 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 97 PID 2336 wrote to memory of 2304 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 98 PID 2336 wrote to memory of 2304 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 98 PID 2336 wrote to memory of 816 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 99 PID 2336 wrote to memory of 816 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 99 PID 2336 wrote to memory of 1044 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 100 PID 2336 wrote to memory of 1044 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 100 PID 2336 wrote to memory of 1828 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 101 PID 2336 wrote to memory of 1828 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 101 PID 2336 wrote to memory of 3172 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 102 PID 2336 wrote to memory of 3172 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 102 PID 2336 wrote to memory of 336 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 103 PID 2336 wrote to memory of 336 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 103 PID 2336 wrote to memory of 3808 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 104 PID 2336 wrote to memory of 3808 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 104 PID 2336 wrote to memory of 1040 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 105 PID 2336 wrote to memory of 1040 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 105 PID 2336 wrote to memory of 4572 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 107 PID 2336 wrote to memory of 4572 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 107 PID 2336 wrote to memory of 3352 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 109 PID 2336 wrote to memory of 3352 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 109 PID 2336 wrote to memory of 1772 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 121 PID 2336 wrote to memory of 1772 2336 d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe 121 PID 1772 wrote to memory of 3456 1772 cmd.exe 123 PID 1772 wrote to memory of 3456 1772 cmd.exe 123 PID 1772 wrote to memory of 1272 1772 cmd.exe 124 PID 1772 wrote to memory of 1272 1772 cmd.exe 124 PID 1772 wrote to memory of 4696 1772 cmd.exe 125 PID 1772 wrote to memory of 4696 1772 cmd.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe"C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w3q3pbu0\w3q3pbu0.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1690.tmp" "c:\Windows\System32\CSC1D9361651A814D138D8A3945D619A65.TMP"3⤵PID:980
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Steam\steamclient.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3352
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zmz8UYKSAt.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3456
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:1272
-
-
C:\Program Files (x86)\Steam\steamclient.exe"C:\Program Files (x86)\Steam\steamclient.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "steamclients" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Steam\steamclient.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "steamclient" /sc ONLOGON /tr "'C:\Program Files (x86)\Steam\steamclient.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "steamclients" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Steam\steamclient.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562d" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:4708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562d" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2196
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5ce2ec4539435dfeac7e246fe5565c521
SHA159f3da006005a109914c31b5d5cd94dc4c93309c
SHA256d5ee74f4f460c4f861c01ecc3e22b679075949108b6fee594193695d4175d562
SHA512408a1db2cd98702bca3811e124d78a56cbca79a1d200593759bde1947a4a599f8cd40cd8dbb2e7be7dec416e3f5de0c4466f98ddea1daf6d313671695f25a7ba
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
1KB
MD55df3ff28eefacb3685ce30774f37b97e
SHA17fff18f7b12f115eeeaf51a8cc3375a298ab749f
SHA2564f652cbea7e01ac1939d198c703c32e6b06af896f77a93d9fdc0e0e9d159b998
SHA5126e6bb7c520efbd3f1824f2760711596554ec605d7d1cf18e1023bbb1a7b7aef35e1fc19caa44f6b989431166901b941b80b02faf33dc7957e5067ca599406b92
-
Filesize
220B
MD598c32a7653c79d7e7af6ac702c1128a9
SHA1b4b688e29a237209a9445db092497716a12ab402
SHA256897b65670ad41fe4904c0ca8bbd3379cb2a38c0378746efbe3199199d3523c3a
SHA512d4c09f5900fc73808443402ebff98c8e079730436e86d2cbc32e7246b667afa95f12154bb01b6f6956aaf77eeae0b157f458173050bb7d3188d05215bc824f25
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
376B
MD5c2f911c4ed9b112c7a34c0c94cf74bd8
SHA1663f75e21c3541217d5c0366b9fb4a01d86c5150
SHA2566a2455d368282871a7f68c65a8c31c7af00e861058d72dfbb768c6000376c7cb
SHA512a211d1fbb59dc00f2731e1a95a7d9819276b4c9f73d4e2641fcb9cc3ddfa8726a34e4acd4af14ed82d2f7608248c6fd6cb46acceb92c50289431869c9315b6f2
-
Filesize
235B
MD50c0a20860332c356730d30f856840e65
SHA1faf134cd679b4b49ee904ca93e126208bb8d9242
SHA2568c646521c45d03dc87b1a0ceac29ea76cfb58b6fc8e4b318d7234a018b2c4bfb
SHA51225b9e8cca215d55f978d2735261544fde838e635585a19084e950d12589ee2f4ff3b151e2edd908164c1b6090b3437ea4dd28c505ca4c71acd6dbcab301d717c
-
Filesize
1KB
MD565d5babddb4bd68783c40f9e3678613f
SHA171e76abb44dbea735b9faaccb8c0fad345b514f4
SHA256d61a59849cacd91b8039a8e41a5b92a7f93e2d46c90791b9ba6b5f856008cd8f
SHA51221223e9a32df265bb75093d1ebaa879880a947d25ac764f3452b9104893b05f2c8fe4150cb2465681df7a0554dcefdb7f623aaf54772ade878270f453ebc1bcf