Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/12/2024, 10:06

General

  • Target

    3aa1bbd17d68b0b67b7423f1fe09b05b.exe

  • Size

    2.2MB

  • MD5

    3aa1bbd17d68b0b67b7423f1fe09b05b

  • SHA1

    61c43b8f31a51d772fd39d5caa87699d74971a43

  • SHA256

    7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

  • SHA512

    7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014

  • SSDEEP

    49152:mx4QdTmxnMJUh+pDY92IXc3Mx+HqXQJc2cv1TDlH:QdPpDYbNiIP2cvxZH

Malware Config

Signatures

  • DcRat 31 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 10 IoCs
  • Process spawned unexpected child process 30 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 36 IoCs
  • DCRat payload 9 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 11 IoCs
  • Adds Run key to start application 2 TTPs 20 IoCs
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 36 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe
    "C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1860
    • C:\Users\Admin\SendTo\taskhost.exe
      "C:\Users\Admin\SendTo\taskhost.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:772
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8ab35106-d5ad-4530-a266-844e3b61f400.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Users\Admin\SendTo\taskhost.exe
          C:\Users\Admin\SendTo\taskhost.exe
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2256
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\288c35ac-6528-45ae-b3a3-9763afdbbf7e.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1668
            • C:\Users\Admin\SendTo\taskhost.exe
              C:\Users\Admin\SendTo\taskhost.exe
              6⤵
              • UAC bypass
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2560
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e67915fe-449f-4872-8923-aa3b3f9cf47e.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1540
                • C:\Users\Admin\SendTo\taskhost.exe
                  C:\Users\Admin\SendTo\taskhost.exe
                  8⤵
                  • UAC bypass
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:2880
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\399e6311-c3dc-4f52-8ca2-48a7577ca435.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1128
                    • C:\Users\Admin\SendTo\taskhost.exe
                      C:\Users\Admin\SendTo\taskhost.exe
                      10⤵
                      • UAC bypass
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:444
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60f65f81-f80e-4171-9877-0553e5244e97.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2140
                        • C:\Users\Admin\SendTo\taskhost.exe
                          C:\Users\Admin\SendTo\taskhost.exe
                          12⤵
                          • UAC bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:2904
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\093d96e2-81e4-4481-8787-fac5205801c5.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2660
                            • C:\Users\Admin\SendTo\taskhost.exe
                              C:\Users\Admin\SendTo\taskhost.exe
                              14⤵
                              • UAC bypass
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:2532
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9573d2f6-b1d9-4ca2-ad4f-d6444cd4f169.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1484
                                • C:\Users\Admin\SendTo\taskhost.exe
                                  C:\Users\Admin\SendTo\taskhost.exe
                                  16⤵
                                  • UAC bypass
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Suspicious use of AdjustPrivilegeToken
                                  • System policy modification
                                  PID:2068
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0cab5dd-4707-43ca-97ca-fbd88e1bf727.vbs"
                                    17⤵
                                      PID:1324
                                      • C:\Users\Admin\SendTo\taskhost.exe
                                        C:\Users\Admin\SendTo\taskhost.exe
                                        18⤵
                                        • UAC bypass
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:2520
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e08352f-9ab0-49df-b095-8a40ae794573.vbs"
                                          19⤵
                                            PID:2272
                                            • C:\Users\Admin\SendTo\taskhost.exe
                                              C:\Users\Admin\SendTo\taskhost.exe
                                              20⤵
                                              • UAC bypass
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:1012
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4595f9d1-b66f-4e01-abd1-d66335f79030.vbs"
                                                21⤵
                                                  PID:1076
                                                  • C:\Users\Admin\SendTo\taskhost.exe
                                                    C:\Users\Admin\SendTo\taskhost.exe
                                                    22⤵
                                                    • UAC bypass
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:2428
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a40a1bb-dd23-4aae-8896-7517cd25ee8c.vbs"
                                                      23⤵
                                                        PID:1980
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa7a4ff3-2da1-42a5-8ab8-18d8b53e083e.vbs"
                                                        23⤵
                                                          PID:2908
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7e51393-9a85-465d-b9f9-1e9ebd8afea2.vbs"
                                                      21⤵
                                                        PID:1876
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f050ff08-8aa0-4d4b-bdea-eb5aef56d205.vbs"
                                                    19⤵
                                                      PID:2280
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6017b138-fb0e-4e0e-8a9a-b046801c57a7.vbs"
                                                  17⤵
                                                    PID:2484
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a90ab2c1-b83c-4473-bb00-9b053beacf5f.vbs"
                                                15⤵
                                                  PID:548
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98861ff0-3354-4063-9999-1bcf1cf53a30.vbs"
                                              13⤵
                                                PID:852
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5b41d2b-920b-4916-b4a8-5e5a7219b8d7.vbs"
                                            11⤵
                                              PID:568
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20f91dd3-0f3c-47e5-b7a1-6350280b8d1a.vbs"
                                          9⤵
                                            PID:1572
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0907e37f-5aa1-4a7d-93d9-90470d2bbe1d.vbs"
                                        7⤵
                                          PID:2648
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4876a9fd-0ae8-4def-86cb-b3948aff9bd7.vbs"
                                      5⤵
                                        PID:2760
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2bea1de-d169-4d4d-9c80-b5ba15dd4501.vbs"
                                    3⤵
                                      PID:1228
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2700
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2548
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2512
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1936
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:628
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2988
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:596
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:792
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Journal\es-ES\Idle.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:584
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:292
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1868
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\dllhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2796
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2808
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2844
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1932
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1712
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1336
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\Chrome\Application\106.0.5249.119\lsass.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2460
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1740
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1572
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\CRMLog\lsass.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1508
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1080
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2032
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\SendTo\taskhost.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1872
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b3" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1992
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b" /sc ONLOGON /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:1972
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "3aa1bbd17d68b0b67b7423f1fe09b05b3" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\3aa1bbd17d68b0b67b7423f1fe09b05b.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2076
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2992
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2068
                                • C:\Windows\system32\schtasks.exe
                                  schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\dwm.exe'" /rl HIGHEST /f
                                  1⤵
                                  • DcRat
                                  • Process spawned unexpected child process
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:2916

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files (x86)\Windows Photo Viewer\es-ES\services.exe

                                  Filesize

                                  2.2MB

                                  MD5

                                  3aa1bbd17d68b0b67b7423f1fe09b05b

                                  SHA1

                                  61c43b8f31a51d772fd39d5caa87699d74971a43

                                  SHA256

                                  7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

                                  SHA512

                                  7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014

                                • C:\Users\Admin\AppData\Local\Temp\093d96e2-81e4-4481-8787-fac5205801c5.vbs

                                  Filesize

                                  710B

                                  MD5

                                  43fdf458ca2299bb2814c9cdd13638f0

                                  SHA1

                                  bd50ec589d9e3878962f4a111794bdb7a086c368

                                  SHA256

                                  a2936914865e43dbebdc3a0bc542e879a1d7210aa8ab025cad222d76c6af333a

                                  SHA512

                                  3d23fe1b0ccd5f157e215b0c9415ab8477c5c7e617428bba71a12e254fc3d08e70279bbe089c6d7aacda1c9f1c6fcfdfa7dd241f0ac34503cf2f53037973e771

                                • C:\Users\Admin\AppData\Local\Temp\288c35ac-6528-45ae-b3a3-9763afdbbf7e.vbs

                                  Filesize

                                  710B

                                  MD5

                                  c37d4cb478604890deafd59115e8a3a1

                                  SHA1

                                  9f05cf9ef45d0a4d17932c1183480ace90753443

                                  SHA256

                                  5623f5b6aa2faebc19514a1b7891d5ed89fb8331cda4f1635829a7ce1cbdd0df

                                  SHA512

                                  d08774eac87ee44d47566aced47be33e66e0cb4a9b70c4794a54cea10803b2fae538801821efd521d66fc7ca1e6db65e4b4570dce9137bf6a6cf9cf7c8ce5ac7

                                • C:\Users\Admin\AppData\Local\Temp\399e6311-c3dc-4f52-8ca2-48a7577ca435.vbs

                                  Filesize

                                  710B

                                  MD5

                                  b92f6ca6e485df15c39e835f3266abfd

                                  SHA1

                                  63e70e54cb2bb7df395fa9c0412a7e52ccc76811

                                  SHA256

                                  48fb22ca258e77480b1a98a7ff2e29ba69a95e9b19f61245629da5590f8f4aab

                                  SHA512

                                  f718768886071fa5eafbd99df7350e48505de23e46b85c14c17ed11d645e59f4e61a76568af7b69000b2bda5991b36b97dbd951ac460c71220a9ef33161e4dcf

                                • C:\Users\Admin\AppData\Local\Temp\4595f9d1-b66f-4e01-abd1-d66335f79030.vbs

                                  Filesize

                                  710B

                                  MD5

                                  0428b772990c38b2b6689443dd6592b8

                                  SHA1

                                  9af3a340492b12866ff184a2ab6540d2a38fb9b5

                                  SHA256

                                  b7d824abce0dcfeb3b710d5fb4972e5eb06940edd282b9b41344d07b6836d226

                                  SHA512

                                  f39125484f9cfa27aab1e2cf2fb7d2371f4ec795c0ac080b5d29152045e364fb3cee4550a38ec17c138e7a046e15cf03ebf90b0777c88647c4f46e0da8d13e31

                                • C:\Users\Admin\AppData\Local\Temp\60f65f81-f80e-4171-9877-0553e5244e97.vbs

                                  Filesize

                                  709B

                                  MD5

                                  6d0a920f6ba1c14baa7d191a0d3a388c

                                  SHA1

                                  af26b6027e2c0c501129d44d94c6d200b42de998

                                  SHA256

                                  9088f7e0ac4bfe7db889923ad011fdc0a905b300372fb0973632877deaea5de8

                                  SHA512

                                  fdaba7a177d4714ebd5619e04e0bc7cc8d5d45821aa82c3348cd6654ee9246508e2b8b630f8590fd3d207ddd4921db9d7f17495c5bdbf60563a67bfbeee0fa94

                                • C:\Users\Admin\AppData\Local\Temp\7a40a1bb-dd23-4aae-8896-7517cd25ee8c.vbs

                                  Filesize

                                  710B

                                  MD5

                                  8747493d21ab2f0ece118b33d66e9398

                                  SHA1

                                  40ccb5c6f14ac08754528e471e0812d4925979e7

                                  SHA256

                                  dfa09444abfd46dc4c9d2c02ab006d7c762150701227413d3e1b0ab8e413d13f

                                  SHA512

                                  80c042eb505c38db33ce75850a6080560bc7c7bcae216b9ee83397f87a0b3e6e7cc5a711c4d8ce65d83d3b1a62dbb6580a3da4feb7436e75792d558194de75a6

                                • C:\Users\Admin\AppData\Local\Temp\8ab35106-d5ad-4530-a266-844e3b61f400.vbs

                                  Filesize

                                  709B

                                  MD5

                                  9a0a490d71f6983f53ecfe69f21430d5

                                  SHA1

                                  7ee71240aec4a76ba584a153245f170100b08a5a

                                  SHA256

                                  7b0ef9b5d6f9740489fcb889c4b2fe94f2bb9ada70d5066afd744bd11f3e7152

                                  SHA512

                                  e3d8ed4fd650f1be0542e63b3cf3ff34b7af6fd4dcbefd63c40f2a95f0e52406b4def01ffa38d1f5ea1da0bb8f6f1fc4f4de9351e3a45a08a1e2dae679818fde

                                • C:\Users\Admin\AppData\Local\Temp\8e08352f-9ab0-49df-b095-8a40ae794573.vbs

                                  Filesize

                                  710B

                                  MD5

                                  c628042ebad85c9f5aa40bf924401558

                                  SHA1

                                  77073541745cdf589bcc5d9b676de10c6bf74dba

                                  SHA256

                                  a713cdf98570c85922792c7c1ead2c64576754453b9cbc42a9704118e3855f07

                                  SHA512

                                  970c30d4f03af332cf96937537207a1c1eb4af3d50b5d26ff7e47e06cf25c636a4217abb0405b97fa51faf9bf48c656b2844d11050f943c623885b202b322fec

                                • C:\Users\Admin\AppData\Local\Temp\9573d2f6-b1d9-4ca2-ad4f-d6444cd4f169.vbs

                                  Filesize

                                  710B

                                  MD5

                                  44d0b2f115052772a832d891dbf29ffd

                                  SHA1

                                  c72d426840c5f8d98dc43144a6733b1db8f0e8ef

                                  SHA256

                                  b7c3a74abe9da54a0c52eb86264696925ed404d8455b9adedac626243abe4bc3

                                  SHA512

                                  2ffe9bfe2a3b3ffc9aef4d172ba2d29853e82e591ddf7473daa333ce00e684ab104a7cd002442fbe5d7881c8e9ff8c3ca81592ca8e35169bb2e70a7c3ff6f8df

                                • C:\Users\Admin\AppData\Local\Temp\b0cab5dd-4707-43ca-97ca-fbd88e1bf727.vbs

                                  Filesize

                                  710B

                                  MD5

                                  43c41ff93a456d11df95fad22a6e01a1

                                  SHA1

                                  97bf955cf4d2ff011027c9ca79a2dfc6f077601f

                                  SHA256

                                  146e669e3ead8a81a6657160d603c8cb4576b5a802f8c08b009f0bbb57f1c408

                                  SHA512

                                  3817bccb9fb348ee05c5ee3769605ec657f9785bf76711a22cd36c3d0f200db98a3856ca5875414231d5e0f3add46678ce4a5a9c1c214ea0878776cee67879df

                                • C:\Users\Admin\AppData\Local\Temp\b2bea1de-d169-4d4d-9c80-b5ba15dd4501.vbs

                                  Filesize

                                  486B

                                  MD5

                                  689c6c22afb8a95c726a859f4d580918

                                  SHA1

                                  07aebbefa5306cce0b862489317437b8952e5a48

                                  SHA256

                                  2927140e870240dc927bb498a8e27aff6cce73f68feefedbf37666e5a908e42d

                                  SHA512

                                  c36c9ccd120e543d776b6fcd834ca4a18ed3f597bbe4633ab4d2a707702c6f2334efa81ecff0ed803ad1b8f752b5f66e6973e234b9b28157b58f7caaa58a8101

                                • C:\Users\Admin\AppData\Local\Temp\e67915fe-449f-4872-8923-aa3b3f9cf47e.vbs

                                  Filesize

                                  710B

                                  MD5

                                  c91b6b330d87176aa9e92a92658cd6fe

                                  SHA1

                                  db3dbeb0dd27b37cf3809343e3fe124c0046fffc

                                  SHA256

                                  47a5eb31446556bff6f2e187e337bf51022c85944af4191874b874c49ff5ef1e

                                  SHA512

                                  09259d591f7c811e2d8de52421965a8d4ca1152388334df94a4f091c378859f017f87fc1f6a8a8198b6e97595d8b79c3c8f143a6021aac1ed5019cffa1ac7223

                                • memory/444-105-0x0000000000310000-0x000000000054E000-memory.dmp

                                  Filesize

                                  2.2MB

                                • memory/444-106-0x0000000002150000-0x0000000002162000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/772-60-0x00000000011C0000-0x00000000013FE000-memory.dmp

                                  Filesize

                                  2.2MB

                                • memory/1012-167-0x0000000000050000-0x000000000028E000-memory.dmp

                                  Filesize

                                  2.2MB

                                • memory/1012-168-0x0000000002360000-0x0000000002372000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/1860-24-0x000000001AAF0000-0x000000001AAF8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-10-0x0000000002160000-0x0000000002172000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/1860-15-0x0000000002290000-0x000000000229C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-16-0x00000000022A0000-0x00000000022A8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-17-0x00000000022B0000-0x00000000022BC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-18-0x00000000022C0000-0x00000000022C8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-19-0x00000000022D0000-0x00000000022E2000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/1860-20-0x000000001AA70000-0x000000001AA7C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-21-0x000000001AA80000-0x000000001AA88000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-22-0x000000001AA90000-0x000000001AA9C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-23-0x000000001AAA0000-0x000000001AAAC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-25-0x000000001AAB0000-0x000000001AABC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-13-0x0000000002270000-0x0000000002280000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1860-27-0x000000001AAD0000-0x000000001AADE000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/1860-26-0x000000001AAC0000-0x000000001AACA000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/1860-28-0x000000001AAE0000-0x000000001AAE8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-30-0x000000001AEE0000-0x000000001AEEC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-29-0x000000001AED0000-0x000000001AED8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-31-0x000000001AEF0000-0x000000001AEF8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-12-0x0000000002150000-0x0000000002158000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-11-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-14-0x0000000002280000-0x000000000228A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/1860-9-0x00000000008F0000-0x00000000008F8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-8-0x00000000008D0000-0x00000000008E6000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/1860-32-0x000000001AF00000-0x000000001AF0A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/1860-33-0x000000001AF10000-0x000000001AF1C000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1860-61-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

                                  Filesize

                                  9.9MB

                                • memory/1860-0-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/1860-1-0x0000000000360000-0x000000000059E000-memory.dmp

                                  Filesize

                                  2.2MB

                                • memory/1860-7-0x00000000006D0000-0x00000000006E0000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1860-2-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

                                  Filesize

                                  9.9MB

                                • memory/1860-6-0x00000000006C0000-0x00000000006C8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/1860-3-0x0000000000340000-0x000000000034E000-memory.dmp

                                  Filesize

                                  56KB

                                • memory/1860-5-0x00000000006A0000-0x00000000006BC000-memory.dmp

                                  Filesize

                                  112KB

                                • memory/1860-4-0x0000000000350000-0x0000000000358000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/2068-143-0x0000000000370000-0x00000000005AE000-memory.dmp

                                  Filesize

                                  2.2MB

                                • memory/2428-180-0x00000000001E0000-0x000000000041E000-memory.dmp

                                  Filesize

                                  2.2MB

                                • memory/2428-181-0x0000000000920000-0x0000000000932000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2520-155-0x00000000013C0000-0x00000000015FE000-memory.dmp

                                  Filesize

                                  2.2MB

                                • memory/2532-131-0x0000000000480000-0x0000000000492000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2904-119-0x0000000000760000-0x0000000000772000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2904-118-0x0000000000F30000-0x000000000116E000-memory.dmp

                                  Filesize

                                  2.2MB