dcrat | 741f406af0d9813380255250f41bb4b5202575b0a95a5405b67520f5840393b1

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sirius.exe
Size

2.4MB
MD5

e88e9ba128b0f902f05a24fc524b6642
SHA1

aead6538e5762c1dce5aa5a823e6a897395dfab9
SHA256

741f406af0d9813380255250f41bb4b5202575b0a95a5405b67520f5840393b1
SHA512

276a779d33dcd77c6222c98b5cc3fcbd095216213eb77d4d4b898320b0805729561a7f45d279d54bc7abb16f2f816e531e6dbddf3f95401f0f39d9458b4fc942
SSDEEP

24576:zTbBv5rUFz0sjTfN29w3R97qQqGv53D0pOuAw1sNv2pbP6inu0lPP1Y7QzqF:tBeHYiUm53D0mtv2pZFPPqUzs

Score

10^/10

dcrat discovery infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\HyperFontReview.exe\", \"C:\\ChainBlockportcomnet\\taskhostw.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\HyperFontReview.exe\", \"C:\\ChainBlockportcomnet\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\lsass.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\HyperFontReview.exe\", \"C:\\ChainBlockportcomnet\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\HyperFontReview.exe\", \"C:\\ChainBlockportcomnet\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\", \"C:\\ChainBlockportcomnet\\HyperFontReview.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\HyperFontReview.exe\""	HyperFontReview.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2284	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3744	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3296	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4456	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3260	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	3708	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	3708	schtasks.exe	89

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Sirius.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	HyperFontReview.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	taskhostw.exe

Executes dropped EXE 14 IoCs

pid	Process
2164	HyperFontReview.exe
536	taskhostw.exe
1776	taskhostw.exe
4808	taskhostw.exe
4312	taskhostw.exe
4284	taskhostw.exe
4360	taskhostw.exe
1164	taskhostw.exe
2232	taskhostw.exe
2728	taskhostw.exe
1472	taskhostw.exe
3220	taskhostw.exe
1672	taskhostw.exe
3968	taskhostw.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperFontReview = "\"C:\\Recovery\\WindowsRE\\HyperFontReview.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperFontReview = "\"C:\\Recovery\\WindowsRE\\HyperFontReview.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\lsass.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\it-IT\\lsass.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Recovery\\WindowsRE\\MoUsoCoreWorker.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperFontReview = "\"C:\\ChainBlockportcomnet\\HyperFontReview.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HyperFontReview = "\"C:\\ChainBlockportcomnet\\HyperFontReview.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\ChainBlockportcomnet\\taskhostw.exe\""	HyperFontReview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\ChainBlockportcomnet\\taskhostw.exe\""	HyperFontReview.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC33A3A3692493476A8B4528DCBD9F2.TMP	csc.exe
File created	\??\c:\Windows\System32\ewkptm.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\6203df4a6bafc7	HyperFontReview.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\lsass.exe	HyperFontReview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sirius.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3752	PING.EXE
2668	PING.EXE
3408	PING.EXE
4236	PING.EXE
2104	PING.EXE
3292	PING.EXE
4000	PING.EXE
952	PING.EXE
5088	PING.EXE
4368	PING.EXE
4300	PING.EXE

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	HyperFontReview.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	Sirius.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	taskhostw.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
4000	PING.EXE
952	PING.EXE
2668	PING.EXE
4368	PING.EXE
2104	PING.EXE
3752	PING.EXE
3408	PING.EXE
5088	PING.EXE
4236	PING.EXE
4300	PING.EXE
3292	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5076	schtasks.exe
1336	schtasks.exe
3084	schtasks.exe
3296	schtasks.exe
4840	schtasks.exe
2284	schtasks.exe
4824	schtasks.exe
4456	schtasks.exe
1832	schtasks.exe
4940	schtasks.exe
4340	schtasks.exe
4820	schtasks.exe
1484	schtasks.exe
2112	schtasks.exe
3744	schtasks.exe
3260	schtasks.exe
2268	schtasks.exe
2416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
2164	HyperFontReview.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe
536	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	HyperFontReview.exe
Token: SeDebugPrivilege	536	taskhostw.exe
Token: SeDebugPrivilege	1776	taskhostw.exe
Token: SeDebugPrivilege	4808	taskhostw.exe
Token: SeDebugPrivilege	4312	taskhostw.exe
Token: SeDebugPrivilege	4284	taskhostw.exe
Token: SeDebugPrivilege	4360	taskhostw.exe
Token: SeDebugPrivilege	1164	taskhostw.exe
Token: SeDebugPrivilege	2232	taskhostw.exe
Token: SeDebugPrivilege	2728	taskhostw.exe
Token: SeDebugPrivilege	1472	taskhostw.exe
Token: SeDebugPrivilege	3220	taskhostw.exe
Token: SeDebugPrivilege	1672	taskhostw.exe
Token: SeDebugPrivilege	3968	taskhostw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3448	5112	Sirius.exe	83
PID 5112 wrote to memory of 3448	5112	Sirius.exe	83
PID 5112 wrote to memory of 3448	5112	Sirius.exe	83
PID 3448 wrote to memory of 2548	3448	WScript.exe	97
PID 3448 wrote to memory of 2548	3448	WScript.exe	97
PID 3448 wrote to memory of 2548	3448	WScript.exe	97
PID 2548 wrote to memory of 2164	2548	cmd.exe	99
PID 2548 wrote to memory of 2164	2548	cmd.exe	99
PID 2164 wrote to memory of 4636	2164	HyperFontReview.exe	103
PID 2164 wrote to memory of 4636	2164	HyperFontReview.exe	103
PID 4636 wrote to memory of 2804	4636	csc.exe	105
PID 4636 wrote to memory of 2804	4636	csc.exe	105
PID 2164 wrote to memory of 1488	2164	HyperFontReview.exe	121
PID 2164 wrote to memory of 1488	2164	HyperFontReview.exe	121
PID 1488 wrote to memory of 4576	1488	cmd.exe	123
PID 1488 wrote to memory of 4576	1488	cmd.exe	123
PID 1488 wrote to memory of 3292	1488	cmd.exe	124
PID 1488 wrote to memory of 3292	1488	cmd.exe	124
PID 1488 wrote to memory of 536	1488	cmd.exe	128
PID 1488 wrote to memory of 536	1488	cmd.exe	128
PID 536 wrote to memory of 1812	536	taskhostw.exe	130
PID 536 wrote to memory of 1812	536	taskhostw.exe	130
PID 1812 wrote to memory of 4512	1812	cmd.exe	132
PID 1812 wrote to memory of 4512	1812	cmd.exe	132
PID 1812 wrote to memory of 3752	1812	cmd.exe	133
PID 1812 wrote to memory of 3752	1812	cmd.exe	133
PID 1812 wrote to memory of 1776	1812	cmd.exe	136
PID 1812 wrote to memory of 1776	1812	cmd.exe	136
PID 1776 wrote to memory of 1204	1776	taskhostw.exe	138
PID 1776 wrote to memory of 1204	1776	taskhostw.exe	138
PID 1204 wrote to memory of 3532	1204	cmd.exe	140
PID 1204 wrote to memory of 3532	1204	cmd.exe	140
PID 1204 wrote to memory of 4000	1204	cmd.exe	141
PID 1204 wrote to memory of 4000	1204	cmd.exe	141
PID 1204 wrote to memory of 4808	1204	cmd.exe	143
PID 1204 wrote to memory of 4808	1204	cmd.exe	143
PID 4808 wrote to memory of 3700	4808	taskhostw.exe	145
PID 4808 wrote to memory of 3700	4808	taskhostw.exe	145
PID 3700 wrote to memory of 5060	3700	cmd.exe	147
PID 3700 wrote to memory of 5060	3700	cmd.exe	147
PID 3700 wrote to memory of 952	3700	cmd.exe	148
PID 3700 wrote to memory of 952	3700	cmd.exe	148
PID 3700 wrote to memory of 4312	3700	cmd.exe	150
PID 3700 wrote to memory of 4312	3700	cmd.exe	150
PID 4312 wrote to memory of 4804	4312	taskhostw.exe	152
PID 4312 wrote to memory of 4804	4312	taskhostw.exe	152
PID 4804 wrote to memory of 3516	4804	cmd.exe	154
PID 4804 wrote to memory of 3516	4804	cmd.exe	154
PID 4804 wrote to memory of 4008	4804	cmd.exe	155
PID 4804 wrote to memory of 4008	4804	cmd.exe	155
PID 4804 wrote to memory of 4284	4804	cmd.exe	157
PID 4804 wrote to memory of 4284	4804	cmd.exe	157
PID 4284 wrote to memory of 3200	4284	taskhostw.exe	159
PID 4284 wrote to memory of 3200	4284	taskhostw.exe	159
PID 3200 wrote to memory of 224	3200	cmd.exe	161
PID 3200 wrote to memory of 224	3200	cmd.exe	161
PID 3200 wrote to memory of 1612	3200	cmd.exe	162
PID 3200 wrote to memory of 1612	3200	cmd.exe	162
PID 3200 wrote to memory of 4360	3200	cmd.exe	164
PID 3200 wrote to memory of 4360	3200	cmd.exe	164
PID 4360 wrote to memory of 4012	4360	taskhostw.exe	166
PID 4360 wrote to memory of 4012	4360	taskhostw.exe	166
PID 4012 wrote to memory of 4944	4012	cmd.exe	168
PID 4012 wrote to memory of 4944	4012	cmd.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Sirius.exe
"C:\Users\Admin\AppData\Local\Temp\Sirius.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainBlockportcomnet\NjC268YrIE3.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ChainBlockportcomnet\cz7Hmt9rVGQXaOiUvs0kcu0Nht.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\ChainBlockportcomnet\HyperFontReview.exe
      "C:\ChainBlockportcomnet/HyperFontReview.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g0pa1qoz\g0pa1qoz.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4636
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3A7.tmp" "c:\Windows\System32\CSC33A3A3692493476A8B4528DCBD9F2.TMP"
        6⤵
        
        PID:2804
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mr59LjoxdD.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1488
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4576
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3292
      - C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Hk8IJNqbTq.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4512
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3752
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4wM4wqHWVF.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4000
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EHU1Lrqt50.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:5060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:952
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B8RGJU8TMM.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3516
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4008
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:224
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1612
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wr1mxRbh1u.bat"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2668
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1164
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ylDQV2JGYe.bat"
        19⤵
        
        PID:3452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3408
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4wM4wqHWVF.bat"
        21⤵
        
        PID:864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5088
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9fn0Ky9lyW.bat"
        23⤵
        
        PID:3480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4880
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4368
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YvmOC36wL2.bat"
        25⤵
        
        PID:4788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4236
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\z03YznJ6kZ.bat"
        27⤵
        
        PID:3664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4300
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q4KhmYWH96.bat"
        29⤵
        
        PID:708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2800
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3944
        
        C:\Recovery\WindowsRE\taskhostw.exe
        
        "C:\Recovery\WindowsRE\taskhostw.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9fn0Ky9lyW.bat"
        31⤵
        
        PID:2832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:872
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReviewH" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\HyperFontReview.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReview" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\HyperFontReview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReviewH" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\HyperFontReview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\ChainBlockportcomnet\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\ChainBlockportcomnet\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\ChainBlockportcomnet\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReviewH" /sc MINUTE /mo 13 /tr "'C:\ChainBlockportcomnet\HyperFontReview.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReview" /sc ONLOGON /tr "'C:\ChainBlockportcomnet\HyperFontReview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperFontReviewH" /sc MINUTE /mo 7 /tr "'C:\ChainBlockportcomnet\HyperFontReview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainBlockportcomnet\HyperFontReview.exe

Filesize
1.8MB

MD5
567cd508bc0600d5b2e390422d5801b7

SHA1
093d100e41e9d24b6b72e0f3d8b00ab7efcdb201

SHA256
4e180cc9f48bcc3ab5532dbc7b0a6ce389d5dda4c6a91aa078fc717ff9bddfef

SHA512
eb8ceabbf6c7518c76c2027533fea4c4a405c5f106edffea228e16e9fd0fa5d0365f5b480cb16f10129cf022ca1fdf1e102bb99c3e1fc8805f4a7a00bd57613e

Download Submit
C:\ChainBlockportcomnet\NjC268YrIE3.vbe

Filesize
225B

MD5
c116b7f56f9a648b221b2eb1738cc725

SHA1
fa990cef96e5a8566e0ebec696b30ef06beb96b0

SHA256
b3fe07c8d460ec9392585cabac43a635c5022cc58cc805b46ce66fed18736571

SHA512
68f07f604a0cea97cedaac041c61aa4eabf4f41b5901a3affc2a94c1678bc11cc4c6115d7afe3c31cc821053ef0d65562760c0214e720c7ad0f6ec6461673a1e

Download Submit
C:\ChainBlockportcomnet\cz7Hmt9rVGQXaOiUvs0kcu0Nht.bat

Filesize
77B

MD5
2ed11b1529600db8518888a8d4f1990e

SHA1
21961a59c7f22c04d0704f1a29c1e7720156f942

SHA256
eb402b7e0d0145ca49d3c43df2b134fd9a8f2ae3a07319a9cb0e70fba6e7d06b

SHA512
e40fa81fceb25ff396fb6bcdba1a15f3ce437ed4fda6754f4ff41d60a852cdc6aa25ab622652ccb0ab94e14ab9e56829cdfc4aaec233ca2307efa142ed34ce5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log

Filesize
1KB

MD5
f8b2fca3a50771154571c11f1c53887b

SHA1
2e83b0c8e2f4c10b145b7fb4832ed1c78743de3f

SHA256
0efa72802031a8f902c3a4ab18fe3d667dafc71c93eb3a1811e78353ecf4a6b6

SHA512
b98b8d5516593d13415199d4ac6fbe4ff924488487c4bd863cb677601048785d872a3ff30129148e2961cb6fb2fc33117540302980a132f57f7ec9a497813f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4wM4wqHWVF.bat

Filesize
163B

MD5
2d7fead7b752e1e3c94df03350e5d9df

SHA1
13b65e2f6e328a267fb80e1cae06358c4c66c39d

SHA256
f9c1a50ef8794ffb5c98d82067bff297162723bb925d7d159cd2d29371b84c00

SHA512
4031b0bdc68a1a33fbb6de76120f30b64383efd792ed174921c1fbb8bc5573bd3f266523228b59f53a625d32e79fa3b109f5fdf56ce640264af773e0f6e13226

Download Submit
C:\Users\Admin\AppData\Local\Temp\9fn0Ky9lyW.bat

Filesize
163B

MD5
21edeb5dea89dd040f4d154b3dc48709

SHA1
5382fcc9b3c61aaea372571a94a9989d61666400

SHA256
3272ca32c0b65da9adad14e4eb4945c697203a9622c28c359b26bc117d3a4c6d

SHA512
70dd7f7d6e8a3954b96e3450da6ec8b87660b73865d7896709996169a645b810e3919f6b8ef7c0cde141747974c1133a3bd01fc5b35cc60168e990dffe802e69

Download Submit
C:\Users\Admin\AppData\Local\Temp\B8RGJU8TMM.bat

Filesize
211B

MD5
df624ac46183a89957ba23c882cd8b09

SHA1
3d75aa9fe9617f89a083563d9c67351638230e83

SHA256
f810516d3b1e279e6ed4cab835eebb167b38a0f1c00d323d578bdcab6fbb2258

SHA512
a43630f9342287a552d95f9b345bdb71d8c0ff2a8424a7ebc34e6b9657e611848a298a3f0247afe89255a6b1ff72240349f216093fd1dbc17dd763220db65d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\EHU1Lrqt50.bat

Filesize
163B

MD5
7b5779f7e5902e534e30132ffcc9c966

SHA1
447f583187026b353e68833457a0b5fe1c4cf5ac

SHA256
fbbf34f2061802c35090a4c8f6e077bb65b5e7f39168bcf251edf084cb89c64a

SHA512
8a2133e4ec75ad7b2242de9ac568c32feca39a8a5ccd9a1be90da4a1b52557b26cbf505194f85928a7768518601ef753aae6674a73e7fa1e4d8edc5b0a217557

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hk8IJNqbTq.bat

Filesize
163B

MD5
5cd667fea6feb926d197c1c274bc631c

SHA1
5eb044b4df9a701c8947d53e67acaa2ba2164c12

SHA256
38c94d97460193ee2ad8d94f63fa8efb5dafa0a9a52779acd6156341557957d3

SHA512
f1938893ce6f99f084273c924285189c778277b332fa78ef2ad2dce5b7e006f11cdf4968e754d105211b365bb197cdfa18d98f07389abd1c48de30f6b1a49ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat

Filesize
211B

MD5
63f4c768eadab9153ddd8f46abe98f47

SHA1
ee8d9b143aa2dd1874a92300519ec8130db9b852

SHA256
2468d824a7df8ed24d6c74bb89a8591e92702c2ca7860355afbd49dfd9a8ea5e

SHA512
48ab7d712291e5bec32a1902344acb1577edbcca8ab5d9a9562134c7ea057c510d67bc6226159e239287a7896d83523324efd96278ee96adcd696a41485d61cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Q4KhmYWH96.bat

Filesize
211B

MD5
1555ad5aac13fdfe35755436e5985cfe

SHA1
e2650bb7b8aaa2464dc42a52d539da09dd2e3ebe

SHA256
52b6cde954db558605c78c3e309e6ae83067ec5bebd5c2141a63d83e94ecc78e

SHA512
1b5b7bbf1843c60c7b1b3cd4b278e620674501b4e4dbfe89d28c0c57ed30de72dd152f9994f32642c3f94af9474fbd28ba90d92e225dd052b8378f944d4e7012

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESF3A7.tmp

Filesize
1KB

MD5
0de5be94b1b8311115b07069b37fd449

SHA1
5ab790db8a3d63fcc483b0681940c23e516b976a

SHA256
c3d7e74836c777d79c72be97dd6f025b3ec38904e6a2d23a8812d7c2b82c0c8f

SHA512
dd5c876a4a7e8c30f477e1e2db65319ac92629716b0d4bd0618e4e3bcb3f2fd991d01f3a9552476a7050863e6207a358f71c31533a443a0a64b5176ffbd96a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\YvmOC36wL2.bat

Filesize
163B

MD5
350b99da7a8291f5e701353ed2d5ff77

SHA1
68302a78d801aa99d2ebf8a0048f2216defb9df5

SHA256
e1c89285eb399f9da007c04787a721e9a41c0f59718df1710cb038b984b01496

SHA512
eb7453e06fad78e7441e1af2738b94e66b955282d04f337e2fb3ba552acaac06ac3966d0571938e27769944ec79577a74dd4fb6339624a7cfef7a93b102cce48

Download Submit
C:\Users\Admin\AppData\Local\Temp\mr59LjoxdD.bat

Filesize
163B

MD5
46465965d7af227eedde4fa258372bb7

SHA1
b57493dbf3223050207fd3456d218e0b98333abb

SHA256
5a46dec9796930dd73501bdd1bacd9aee57eb056834766f5df1f5d8ce55ab82a

SHA512
80021c48e27bdfde6bb0d4b932f2b51797026e793607de6cf2c28b014bae3d9efaaa37d64eb7b8c15f61a4262415403d658a0b9a342342cfe87b1cb849e81d5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wr1mxRbh1u.bat

Filesize
163B

MD5
7a50f0ff52f3fd0d616eaf05523d3bc9

SHA1
60f82bc8a28578f247b4cf4fd768580ab1deadba

SHA256
44b8c5d317975027080053aa5ba11925a1300d615140b9886673c7253ef02ab8

SHA512
2f7ccd750cf450c1d0e11fe12c6ea45a35573b6d7ecc5aa1e3d41f4f6ffe99e3d3446af6c5517693bc6449b95e89460a322f74c586fb89fc634f9e228cad89ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\ylDQV2JGYe.bat

Filesize
163B

MD5
e786f21df0cf05c26f8e8421392d2170

SHA1
e1378fc7d4ebefacbb325414b8e3ef103381fd14

SHA256
a075275e98bdcf52d0f31b9811c547d29d2cf5a1473fc1c9b7983bdcc4bb8c75

SHA512
ce764486125a8c3811ec92e05d6091e766bf34f9ac492523f67d04df4bc0d0c1bd62e6a2ecb8104c56329afb7a01727f907b6eaead207608bfea39217a7461e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\z03YznJ6kZ.bat

Filesize
163B

MD5
50017e03381d9d2e9b47b66557e129f6

SHA1
97d119b373d1488ae935122d5f78e2ac58f0df1c

SHA256
0cbad9d435eb3725a80eefc3a46151f22cab54e2f8be5abff7e20e6f243f774f

SHA512
db414dbad497affb00a1d2f5b8790b36d30cd0a58a135c7178c7ef3b346a0593b5316350b89a991e7f14419b1e6806f8bf7cc6461cd6401558b64048734dff26

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g0pa1qoz\g0pa1qoz.0.cs

Filesize
367B

MD5
58adfb8e0584e9a14514a5eb184f618b

SHA1
46f249158f2eaa9b983a8ab2092ff3ddbea7784c

SHA256
2dec764863ac6d8d84603b110326c62fe133f242f63a7bc8c6d34f0f36895e79

SHA512
aa5e280033f91cfb24448c3c3bd9b591e641c25caee36257641c5b7f534cc8f4e321b6adb015518709f20094870900c1cb95834a68ea356aa791005a2d0cef88

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g0pa1qoz\g0pa1qoz.cmdline

Filesize
235B

MD5
538f26ab18dda3c3a80237f8ab5f0513

SHA1
c56277511a4e2938633c5272eae445c2f0301366

SHA256
cf7e1b8dd0db77c87598c2e5a6e944a9ae1588a1096741027e250b57b62200fb

SHA512
3f454cb6ecf4e317539b84b761cb5b054d349b6e12ef3c3370d7bbede11bbcba6b86e491c0bf30be6975c0ec5b2d15bcbcadcfacec1942b6a7944fb0627c85c8

Download Submit
\??\c:\Windows\System32\CSC33A3A3692493476A8B4528DCBD9F2.TMP

Filesize
1KB

MD5
be99f41194f5159cc131a1a4353a0e0a

SHA1
f24e3bf06e777b4de8d072166cff693e43f2295c

SHA256
564d9051e5639603c83562a9ff2c2e478cc7e13d54faf39f761297bac78603bf

SHA512
51d1a50772bb7d689193e6a9b2e363185cf5438103644b2b68cf13e08274c5d99407b99f8cdc856143d28669f5ee4ee316041a8e33df42f55bfd181aa3f3c0f5

Download Submit
memory/536-65-0x0000000000F80000-0x0000000000F88000-memory.dmp

Filesize
32KB

Download
memory/1164-132-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/1472-165-0x0000000000EE0000-0x0000000000EE8000-memory.dmp

Filesize
32KB

Download
memory/1672-187-0x00000000023C0000-0x00000000023C8000-memory.dmp

Filesize
32KB

Download
memory/1776-77-0x0000000002690000-0x0000000002698000-memory.dmp

Filesize
32KB

Download
memory/2164-15-0x0000000001660000-0x000000000166E000-memory.dmp

Filesize
56KB

Download
memory/2164-22-0x00000000030A0000-0x00000000030AC000-memory.dmp

Filesize
48KB

Download
memory/2164-12-0x00007FFE58D93000-0x00007FFE58D95000-memory.dmp

Filesize
8KB

Download
memory/2164-20-0x000000001B9E0000-0x000000001B9F8000-memory.dmp

Filesize
96KB

Download
memory/2164-18-0x000000001BA70000-0x000000001BAC0000-memory.dmp

Filesize
320KB

Download
memory/2164-51-0x000000001C430000-0x000000001C5D9000-memory.dmp

Filesize
1.7MB

Download
memory/2164-17-0x00000000030E0000-0x00000000030FC000-memory.dmp

Filesize
112KB

Download
memory/2164-13-0x0000000000CB0000-0x0000000000E8A000-memory.dmp

Filesize
1.9MB

Download
memory/2232-143-0x0000000001720000-0x0000000001728000-memory.dmp

Filesize
32KB

Download
memory/2728-154-0x00000000014B0000-0x00000000014B8000-memory.dmp

Filesize
32KB

Download
memory/3220-176-0x0000000001490000-0x0000000001498000-memory.dmp

Filesize
32KB

Download
memory/3968-198-0x0000000002C10000-0x0000000002C18000-memory.dmp

Filesize
32KB

Download
memory/4284-110-0x0000000001520000-0x0000000001528000-memory.dmp

Filesize
32KB

Download
memory/4312-99-0x00000000010E0000-0x00000000010E8000-memory.dmp

Filesize
32KB

Download
memory/4360-121-0x0000000002D10000-0x0000000002D18000-memory.dmp

Filesize
32KB

Download
memory/4808-88-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download