dcrat | 4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Size

1.5MB
MD5

7286e4a519fddbf2d91caa5f98d8cef7
SHA1

411cbd512ec8d764bc5a2a45d96604eaf96500ec
SHA256

4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647
SHA512

ce72777c31b6fcaa36180e7651b87f66736c2b88a567daddb1cbb96c7221b338171c1d5e6e6bf89863406c3af5d63bf464b90c7876c2e0991ad2b81220a07aee
SSDEEP

24576:0NNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:EzhWhCXQFN+0IEuQgyiVK

Score

10^/10

dcrat evasion execution infostealer persistence rat trojan

Malware Config

Signatures

DcRat 8 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		1356	schtasks.exe
		2136	schtasks.exe
		1416	schtasks.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File created	C:\Windows\System32\wscript\cc11b995f2a76d		4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
		2588	schtasks.exe
		2628	schtasks.exe
		2260	schtasks.exe

Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wscript\\winlogon.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wscript\\winlogon.exe\", \"C:\\ProgramData\\Package Cache\\csrss.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wscript\\winlogon.exe\", \"C:\\ProgramData\\Package Cache\\csrss.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\Replicate\\Security\\wininit.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wscript\\winlogon.exe\", \"C:\\ProgramData\\Package Cache\\csrss.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\Replicate\\Security\\wininit.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\dwm.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wscript\\winlogon.exe\", \"C:\\ProgramData\\Package Cache\\csrss.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\Replicate\\Security\\wininit.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\dwm.exe\", \"C:\\Windows\\System32\\dfscli\\lsass.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\wscript\\winlogon.exe\", \"C:\\ProgramData\\Package Cache\\csrss.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\Replicate\\Security\\wininit.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\dwm.exe\", \"C:\\Windows\\System32\\dfscli\\lsass.exe\", \"C:\\Users\\Admin\\Contacts\\dllhost.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2748	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2748	schtasks.exe	30

UAC bypass 3 TTPs 42 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
756	powershell.exe
1712	powershell.exe
2912	powershell.exe
2764	powershell.exe
760	powershell.exe
2680	powershell.exe
1592	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe

Executes dropped EXE 13 IoCs

pid	Process
1852	csrss.exe
1556	csrss.exe
1416	csrss.exe
700	csrss.exe
2188	csrss.exe
1652	csrss.exe
2412	csrss.exe
1456	csrss.exe
1536	csrss.exe
772	csrss.exe
1856	csrss.exe
2900	csrss.exe
2124	csrss.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\wscript\\winlogon.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ProgramData\\Package Cache\\csrss.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\dfscli\\lsass.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\dfscli\\lsass.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Contacts\\dllhost.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\wscript\\winlogon.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ProgramData\\Package Cache\\csrss.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\Replicate\\Security\\wininit.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\Replicate\\Security\\wininit.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\dwm.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\dwm.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\Contacts\\dllhost.exe\""	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe

Checks whether UAC is enabled 1 TTPs 28 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\dfscli\6203df4a6bafc7	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File opened for modification	C:\Windows\System32\wscript\RCX22BE.tmp	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File opened for modification	C:\Windows\System32\dfscli\RCX2B3A.tmp	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File opened for modification	C:\Windows\System32\dfscli\lsass.exe	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File created	C:\Windows\System32\wscript\winlogon.exe	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File opened for modification	C:\Windows\System32\wscript\winlogon.exe	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File created	C:\Windows\System32\wscript\cc11b995f2a76d	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File created	C:\Windows\System32\dfscli\lsass.exe	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Office14\1033\dwm.exe	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\6cb0b6c459d5d3	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCX2936.tmp	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\dwm.exe	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1416	schtasks.exe
2588	schtasks.exe
2628	schtasks.exe
2260	schtasks.exe
1356	schtasks.exe
2136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
1712	powershell.exe
756	powershell.exe
2764	powershell.exe
2912	powershell.exe
2680	powershell.exe
1592	powershell.exe
760	powershell.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe
1852	csrss.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1852	csrss.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	1556	csrss.exe
Token: SeDebugPrivilege	1416	csrss.exe
Token: SeDebugPrivilege	700	csrss.exe
Token: SeDebugPrivilege	2188	csrss.exe
Token: SeDebugPrivilege	1652	csrss.exe
Token: SeDebugPrivilege	2412	csrss.exe
Token: SeDebugPrivilege	1456	csrss.exe
Token: SeDebugPrivilege	1536	csrss.exe
Token: SeDebugPrivilege	772	csrss.exe
Token: SeDebugPrivilege	1856	csrss.exe
Token: SeDebugPrivilege	2900	csrss.exe
Token: SeDebugPrivilege	2124	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1712	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	37
PID 1088 wrote to memory of 1712	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	37
PID 1088 wrote to memory of 1712	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	37
PID 1088 wrote to memory of 2912	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	38
PID 1088 wrote to memory of 2912	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	38
PID 1088 wrote to memory of 2912	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	38
PID 1088 wrote to memory of 756	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	39
PID 1088 wrote to memory of 756	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	39
PID 1088 wrote to memory of 756	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	39
PID 1088 wrote to memory of 2764	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	42
PID 1088 wrote to memory of 2764	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	42
PID 1088 wrote to memory of 2764	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	42
PID 1088 wrote to memory of 1592	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	43
PID 1088 wrote to memory of 1592	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	43
PID 1088 wrote to memory of 1592	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	43
PID 1088 wrote to memory of 2680	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	44
PID 1088 wrote to memory of 2680	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	44
PID 1088 wrote to memory of 2680	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	44
PID 1088 wrote to memory of 760	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	45
PID 1088 wrote to memory of 760	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	45
PID 1088 wrote to memory of 760	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	45
PID 1088 wrote to memory of 1852	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	51
PID 1088 wrote to memory of 1852	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	51
PID 1088 wrote to memory of 1852	1088	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe	51
PID 1852 wrote to memory of 2500	1852	csrss.exe	52
PID 1852 wrote to memory of 2500	1852	csrss.exe	52
PID 1852 wrote to memory of 2500	1852	csrss.exe	52
PID 1852 wrote to memory of 3004	1852	csrss.exe	53
PID 1852 wrote to memory of 3004	1852	csrss.exe	53
PID 1852 wrote to memory of 3004	1852	csrss.exe	53
PID 2500 wrote to memory of 1556	2500	WScript.exe	54
PID 2500 wrote to memory of 1556	2500	WScript.exe	54
PID 2500 wrote to memory of 1556	2500	WScript.exe	54
PID 1556 wrote to memory of 2596	1556	csrss.exe	55
PID 1556 wrote to memory of 2596	1556	csrss.exe	55
PID 1556 wrote to memory of 2596	1556	csrss.exe	55
PID 1556 wrote to memory of 2216	1556	csrss.exe	56
PID 1556 wrote to memory of 2216	1556	csrss.exe	56
PID 1556 wrote to memory of 2216	1556	csrss.exe	56
PID 2596 wrote to memory of 1416	2596	WScript.exe	57
PID 2596 wrote to memory of 1416	2596	WScript.exe	57
PID 2596 wrote to memory of 1416	2596	WScript.exe	57
PID 1416 wrote to memory of 1936	1416	csrss.exe	58
PID 1416 wrote to memory of 1936	1416	csrss.exe	58
PID 1416 wrote to memory of 1936	1416	csrss.exe	58
PID 1416 wrote to memory of 1184	1416	csrss.exe	59
PID 1416 wrote to memory of 1184	1416	csrss.exe	59
PID 1416 wrote to memory of 1184	1416	csrss.exe	59
PID 1936 wrote to memory of 700	1936	WScript.exe	60
PID 1936 wrote to memory of 700	1936	WScript.exe	60
PID 1936 wrote to memory of 700	1936	WScript.exe	60
PID 700 wrote to memory of 2740	700	csrss.exe	61
PID 700 wrote to memory of 2740	700	csrss.exe	61
PID 700 wrote to memory of 2740	700	csrss.exe	61
PID 700 wrote to memory of 2108	700	csrss.exe	62
PID 700 wrote to memory of 2108	700	csrss.exe	62
PID 700 wrote to memory of 2108	700	csrss.exe	62
PID 2740 wrote to memory of 2188	2740	WScript.exe	63
PID 2740 wrote to memory of 2188	2740	WScript.exe	63
PID 2740 wrote to memory of 2188	2740	WScript.exe	63
PID 2188 wrote to memory of 2296	2188	csrss.exe	64
PID 2188 wrote to memory of 2296	2188	csrss.exe	64
PID 2188 wrote to memory of 2296	2188	csrss.exe	64
PID 2188 wrote to memory of 2360	2188	csrss.exe	65

System policy modification 1 TTPs 42 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe
"C:\Users\Admin\AppData\Local\Temp\4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe"
1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wscript\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Package Cache\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\dfscli\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Contacts\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\ProgramData\Package Cache\csrss.exe
  "C:\ProgramData\Package Cache\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1852
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f5dc698-40b7-43f5-8e87-b6a8a60f59fd.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\ProgramData\Package Cache\csrss.exe
      "C:\ProgramData\Package Cache\csrss.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1556
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dff164a4-7603-4083-8ec2-294d08fccece.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2596
      - C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1416
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5cf951f-2a74-4110-98dd-875275b8f9a9.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:700
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc067479-e668-4230-b584-4f1415866f65.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2188
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04071a85-ca6e-4da7-b659-eb25d801cbdf.vbs"
        11⤵
        
        PID:2296
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66a884d5-70a7-4461-9878-12f19ce2abf3.vbs"
        13⤵
        
        PID:2116
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2412
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\898ceca2-8dca-415a-a750-1389aa28f8b8.vbs"
        15⤵
        
        PID:1188
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3be86ed-196c-45f9-baf5-bdcaf2811036.vbs"
        17⤵
        
        PID:2724
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        18⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1536
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4bb5ca5-ae83-462b-973e-2b44cbf62133.vbs"
        19⤵
        
        PID:552
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        20⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:772
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2405209c-d14e-4f56-812b-0fc7c656d296.vbs"
        21⤵
        
        PID:2940
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        22⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3cdae29d-ab5a-45d8-8eeb-1b884e848355.vbs"
        23⤵
        
        PID:348
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        24⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7fcb6864-c5c8-4803-8f29-b7d787f305e9.vbs"
        25⤵
        
        PID:1416
        
        C:\ProgramData\Package Cache\csrss.exe
        
        "C:\ProgramData\Package Cache\csrss.exe"
        26⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2124
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cbecd3e3-c720-443e-bd87-610058799c1c.vbs"
        27⤵
        
        PID:2044
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8abb7fad-8189-41f1-af30-710b0a40f90d.vbs"
        27⤵
        
        PID:2052
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6afb15ab-0947-4b11-b38c-d46296225c54.vbs"
        25⤵
        
        PID:2168
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac79d0bc-8074-4a76-9152-799e73c387bd.vbs"
        23⤵
        
        PID:1076
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3263536-c363-4086-873a-a5109db4a5a6.vbs"
        21⤵
        
        PID:2860
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1aacfe6b-c624-4f19-a08c-424e8d8b9075.vbs"
        19⤵
        
        PID:2408
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27fa00a0-b645-4823-9e28-085da68333dd.vbs"
        17⤵
        
        PID:464
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2693d976-eb92-4732-b161-ec5aa597fe8f.vbs"
        15⤵
        
        PID:2456
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1df11c6-599b-4e03-a5d4-f281ba173dac.vbs"
        13⤵
        
        PID:1852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9dd02c1-f77f-458b-877a-3bebc41c51f0.vbs"
        11⤵
        
        PID:2360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e631122d-bf57-4c94-80a2-5f1bb13eec35.vbs"
        9⤵
        
        PID:2108
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc94176e-c536-4eeb-8b63-33a57dce6cb3.vbs"
        7⤵
        
        PID:1184
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a69c3e1e-3def-4ed2-9a4a-07d2c9ef12f4.vbs"
        5⤵
        
        PID:2216
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\250dbf53-6832-4283-a595-0a9b457ebc09.vbs"
    3⤵
    PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\wscript\winlogon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\Package Cache\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\Replicate\Security\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\dfscli\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\04071a85-ca6e-4da7-b659-eb25d801cbdf.vbs

Filesize
714B

MD5
55a379699f9fd28bb6ba5ad58b776163

SHA1
58f302cbb41d64687a58d8e9ac4c4e5dcebb96b6

SHA256
a9f48db871f29a69fea3764c2596da3c1f7a2925581ec2f28379fe97a78f7f19

SHA512
ca52d6faf3dd5a89778770ce0212cc4937bcedf7f0e7e4a701b0264c812b037e3a7ec282b60e055184c4b3a875baa4aec0d3cbe23fa03b47daedba21bb783086

Download Submit
C:\Users\Admin\AppData\Local\Temp\2405209c-d14e-4f56-812b-0fc7c656d296.vbs

Filesize
713B

MD5
a99f33dfd2d65db234906d96c1475fe3

SHA1
394f32a7ef968b837024d9ebe85d9accb4205063

SHA256
c75fb47a1db4f918ceeef26a7b8c8d0bd2b0005b26b5ca93a73f779de3051b23

SHA512
a2bad452354add828c71703348d240c705849707b492c24506ba664dd50cf260fa1058a8886d964d12e9966b8bf6d069d8919cef30c168315430a09a335316a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\250dbf53-6832-4283-a595-0a9b457ebc09.vbs

Filesize
490B

MD5
03ec7f18ab3c1bb94f7e5ab521422160

SHA1
c2ec1733a1294bc9aa5c5c48022c3c41a3b8a1f8

SHA256
db9fb43dbd17345bf6acd89e0032510d5cba41ab2bd8d2b082d3963bab5cc20e

SHA512
aea6decfacf6da858c8a7b4bda9e86e78f8019635f75152defbb5b46a39b4024aafeb51edad29db8bded39b237a05f9f05f9e729539e8381593153e39c72387d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3cdae29d-ab5a-45d8-8eeb-1b884e848355.vbs

Filesize
714B

MD5
1af4e561ae37d1463f57a64b3ff26223

SHA1
b9c02b26a19974d9ebf37b1ba59b9cfb98c25f6d

SHA256
2b39dccf11b6a960933e39e14195315cfc22fe1f53797818eeb1c5bf70052f8c

SHA512
745feb76c1cfc79f65d35117cad55566131f2c29bd969994c22bb7f707cbabb76e6e226fbe7d05d3ff4fb432a4fa0f9a014fe55d404619cb9282ad92f67604b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\66a884d5-70a7-4461-9878-12f19ce2abf3.vbs

Filesize
714B

MD5
47fd1812a9e71a0e7448c459ee8c90a3

SHA1
7cf07501b1ce99e67936e52bf9afebce029de981

SHA256
080d87df1489ded1a63bd19835669d8cc576ff1982f94ab754638db0389cd835

SHA512
417b5dc97d6d18b938f9212ff157f531b9a2f768ab3130ba90a3b35fb0a01ff3fcd8f15f4d9eb6a9dfd3cf6247d6ddc3cc516db231a28d8e27c2f40753a3bd22

Download Submit
C:\Users\Admin\AppData\Local\Temp\7f5dc698-40b7-43f5-8e87-b6a8a60f59fd.vbs

Filesize
714B

MD5
08ac6b0213158f57914240e7b8c91c2e

SHA1
f7ceefc43c01c1a5474714533ed2d0f0b117726f

SHA256
e345d5c9a37e67d6b640a4ee2abb3e7a2fca11cc8b717675458c9cfc78ecd4c0

SHA512
9cfdafeb2d1d2d75d24a2102516c4137efe8c63ad9b4215d0ebec3b61d1a39da7771c76e96670007a5695887064cb2d7805b5cdf9d8eb28d12666c114e976e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\7fcb6864-c5c8-4803-8f29-b7d787f305e9.vbs

Filesize
714B

MD5
3829dfa3d6b543a3853c9e8a9aa7be05

SHA1
c087fe93c77c1953915233851739c18276f3c63d

SHA256
27c4f0e39a2768dd704f94bdd3f742729f57c302f70d08eab8784d12fe4394f2

SHA512
dacd57013bcc136f21f7140e9ad49f7fe492d98efd2c0c571bad6e09f53044ac3674beff37045dea7162b59bca6a19b6810f4758fcf5c8859fa7453a315f6650

Download Submit
C:\Users\Admin\AppData\Local\Temp\898ceca2-8dca-415a-a750-1389aa28f8b8.vbs

Filesize
714B

MD5
d65efe3c2223d80b36c3f3c30585ad3c

SHA1
f75ba5cad43d7dfee1c8359aeab68c0585d0597b

SHA256
6abccd1b00da9a199daef8018ac3db455ff954af83a18b336214a7c2bf090a05

SHA512
2c3e88d7e617a654a4e1a008c8845a06a24ac641c87aa1b0cf268e09d1e1e23c112e2ee4b6caf2cc9d5018aa5856c8b1d4a6cd3d933ac8cd9631490fb585a917

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4bb5ca5-ae83-462b-973e-2b44cbf62133.vbs

Filesize
714B

MD5
df5a74d32aa2cec1e89cc9337f83a3b2

SHA1
aa9aad499a92ba53ddbfb86f8ae7cdc1a6fe130f

SHA256
2c65b30adf36b3849cb3fc13894c196118bb46059d2f51aff1fcaaca09e17bb0

SHA512
24beebf3928de5253afb9c50209768b7b293b7572b9d14148b76aca628027fe7a9e9435d062932262e8b4cc3d4c59f96fd16aa8c134f599bfdaaa6469a3c25b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5cf951f-2a74-4110-98dd-875275b8f9a9.vbs

Filesize
714B

MD5
9f47c4a149959633c15d679657ab7d38

SHA1
e37e27ca692cf430a7608868aa9a09d71a42e091

SHA256
39f669e9bca08c51957b0cddd6517a7d38eff8284d51d70ae2953a548a611681

SHA512
c7cb8a5201c8cbd419070d51d46bbe808b5a2ba1baaddd38604b5145fdee355c64c206691f89a3309c4e8a294de847147da02a8ebaf2848c9a81b0bf706dde3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbecd3e3-c720-443e-bd87-610058799c1c.vbs

Filesize
714B

MD5
959a0370af9b1bbcbca51dc461bf097e

SHA1
84769f0ec3c479ec0a61c660b765946528c5ec79

SHA256
24aca2765966689bd83f21ddb5f53df9f180f4c2128a3bc220003c896c55624f

SHA512
ff7c8743292e05982cbaea9d529c70f480c1606193db1d40832b29add393488bc48b4f75ddaf6c7f0ccad96d586b125e143443f8c491a68f72e316f634d21cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\dc067479-e668-4230-b584-4f1415866f65.vbs

Filesize
713B

MD5
a58cb6157b7120cb7a276bf963be8aa2

SHA1
7199db16196cfa9c351f31dc1dd52c6311d11cfb

SHA256
96da30f9d730dfe4b84d9f6574436289761000b8987d17374e6ec55196d3c4e1

SHA512
70f527eccafb595712382372f42568730b44671452f05f2350d0c7d644b518b3eeed965b533f42534c66e10ecc82a007b71cf1e6fc019c341892c74a0626d946

Download Submit
C:\Users\Admin\AppData\Local\Temp\dff164a4-7603-4083-8ec2-294d08fccece.vbs

Filesize
714B

MD5
9c57bb9c3a06cb00a860b0c876273ed8

SHA1
eea8ad3cd5bfae8ea774da142621cdfa721d083c

SHA256
b6c9c3bb944d1ecd855a164f1860789cbcbbe8164a42b023b9d9705ed78a9c1d

SHA512
429c3ff737a2d0c7541e58308ab67f5ed6716d2aeaa5455e2c2ca3f72e975ad434b3b9f2a2f015e85477956564f54384789471f1a5723a498bb82060585f570f

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3be86ed-196c-45f9-baf5-bdcaf2811036.vbs

Filesize
714B

MD5
8b4db462fb6793efba18551a3a206e47

SHA1
be130739bfa6ee65a6bbf5f6aca85303f69360e0

SHA256
d2426ce4e21fdf973ad0f22eae0f804e927af1d7cdd4c32c2576a5b070f91bef

SHA512
79fccaf735661c56aa701a733221ad9c11ffc733e0266275e019066b69769f59eb9e74ab2c931f948881928ca3d629b7c84307e95700b717574d87a3c5b56481

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b57306af9bd4767548983e0cf4acf126

SHA1
ca38e12a7a2fb9ea6e6591180c8c089eff3b400e

SHA256
4a9a54770b9ab92b4ddaff160bc6df240949597e315f35188708cb3cb5940cc7

SHA512
d0c334766355689cec402b9b2dcbb30b01e244bb92789a2ba1cff6862fe6d90b8a84ca56783402fa6df8e5faa0f1444a2ac453f6aff7240a048ada39253c69ca

Download Submit
C:\Windows\System32\dfscli\lsass.exe

Filesize
1.5MB

MD5
7286e4a519fddbf2d91caa5f98d8cef7

SHA1
411cbd512ec8d764bc5a2a45d96604eaf96500ec

SHA256
4800dbbb6e40da258de5740143bf7da9f4e87f16737cebcea24aab26b341c647

SHA512
ce72777c31b6fcaa36180e7651b87f66736c2b88a567daddb1cbb96c7221b338171c1d5e6e6bf89863406c3af5d63bf464b90c7876c2e0991ad2b81220a07aee

Download Submit
memory/756-96-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/772-228-0x0000000000830000-0x00000000009AE000-memory.dmp

Filesize
1.5MB

Download
memory/1088-10-0x00000000020F0000-0x0000000002100000-memory.dmp

Filesize
64KB

Download
memory/1088-0-0x000007FEF5063000-0x000007FEF5064000-memory.dmp

Filesize
4KB

Download
memory/1088-21-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/1088-1-0x00000000003E0000-0x000000000055E000-memory.dmp

Filesize
1.5MB

Download
memory/1088-16-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/1088-15-0x00000000021C0000-0x00000000021CA000-memory.dmp

Filesize
40KB

Download
memory/1088-2-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1088-9-0x00000000020E0000-0x00000000020EC000-memory.dmp

Filesize
48KB

Download
memory/1088-3-0x00000000003D0000-0x00000000003D8000-memory.dmp

Filesize
32KB

Download
memory/1088-123-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1088-14-0x00000000021B0000-0x00000000021BC000-memory.dmp

Filesize
48KB

Download
memory/1088-13-0x0000000002120000-0x000000000212A000-memory.dmp

Filesize
40KB

Download
memory/1088-12-0x0000000002110000-0x0000000002118000-memory.dmp

Filesize
32KB

Download
memory/1088-4-0x0000000000560000-0x0000000000572000-memory.dmp

Filesize
72KB

Download
memory/1088-11-0x0000000002100000-0x0000000002110000-memory.dmp

Filesize
64KB

Download
memory/1088-17-0x00000000021E0000-0x00000000021EC000-memory.dmp

Filesize
48KB

Download
memory/1088-24-0x000007FEF5060000-0x000007FEF5A4C000-memory.dmp

Filesize
9.9MB

Download
memory/1088-20-0x0000000002200000-0x000000000220C000-memory.dmp

Filesize
48KB

Download
memory/1088-18-0x00000000021F0000-0x00000000021F8000-memory.dmp

Filesize
32KB

Download
memory/1088-8-0x00000000020D0000-0x00000000020D8000-memory.dmp

Filesize
32KB

Download
memory/1088-5-0x0000000000580000-0x000000000058C000-memory.dmp

Filesize
48KB

Download
memory/1088-7-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/1088-6-0x0000000000570000-0x000000000057A000-memory.dmp

Filesize
40KB

Download
memory/1416-145-0x0000000000440000-0x0000000000452000-memory.dmp

Filesize
72KB

Download
memory/1456-204-0x0000000000030000-0x00000000001AE000-memory.dmp

Filesize
1.5MB

Download
memory/1536-216-0x0000000000810000-0x000000000098E000-memory.dmp

Filesize
1.5MB

Download
memory/1652-180-0x0000000000270000-0x00000000003EE000-memory.dmp

Filesize
1.5MB

Download
memory/1712-107-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/1852-97-0x0000000000E20000-0x0000000000F9E000-memory.dmp

Filesize
1.5MB

Download
memory/1856-240-0x0000000000C40000-0x0000000000DBE000-memory.dmp

Filesize
1.5MB

Download
memory/2188-168-0x0000000000210000-0x000000000038E000-memory.dmp

Filesize
1.5MB

Download
memory/2412-192-0x0000000001110000-0x000000000128E000-memory.dmp

Filesize
1.5MB

Download
memory/2900-252-0x0000000001100000-0x000000000127E000-memory.dmp

Filesize
1.5MB

Download