Overview

overview

10

Static

static

10

3aa1bbd17d...5b.exe

windows7-x64

10

3aa1bbd17d...5b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-12-2024 10:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3aa1bbd17d68b0b67b7423f1fe09b05b.exe

  • Size

    2.2MB

  • MD5

    3aa1bbd17d68b0b67b7423f1fe09b05b

  • SHA1

    61c43b8f31a51d772fd39d5caa87699d74971a43

  • SHA256

    7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

  • SHA512

    7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014

  • SSDEEP

    49152:mx4QdTmxnMJUh+pDY92IXc3Mx+HqXQJc2cv1TDlH:QdPpDYbNiIP2cvxZH

Score
10/10
dcratevasioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Process spawned unexpected child process 12 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 45 IoCs
    evasiontrojan
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 30 IoCs
    evasiontrojan
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 45 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe
    "C:\Users\Admin\AppData\Local\Temp\3aa1bbd17d68b0b67b7423f1fe09b05b.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4716
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WBYhT1obAD.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:3960
        • C:\Program Files (x86)\Windows Defender\wininit.exe
          "C:\Program Files (x86)\Windows Defender\wininit.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4888
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\235055a4-cc5a-4f85-8e12-97732ff87464.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5068
            • C:\Program Files (x86)\Windows Defender\wininit.exe
              "C:\Program Files (x86)\Windows Defender\wininit.exe"
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2360
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\61d506a2-8e86-4257-879b-e9ba7a44003c.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:396
                • C:\Program Files (x86)\Windows Defender\wininit.exe
                  "C:\Program Files (x86)\Windows Defender\wininit.exe"
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1228
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b47598e-dc69-4a7b-9e69-175c21c56fbb.vbs"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2456
                    • C:\Program Files (x86)\Windows Defender\wininit.exe
                      "C:\Program Files (x86)\Windows Defender\wininit.exe"
                      9⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:3088
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\290662b5-9db1-4405-b6ec-d7d242150ce0.vbs"
                        10⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1856
                        • C:\Program Files (x86)\Windows Defender\wininit.exe
                          "C:\Program Files (x86)\Windows Defender\wininit.exe"
                          11⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:3048
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8461f71b-f43c-4615-a016-9830b551257c.vbs"
                            12⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1832
                            • C:\Program Files (x86)\Windows Defender\wininit.exe
                              "C:\Program Files (x86)\Windows Defender\wininit.exe"
                              13⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:1052
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec069271-7842-4219-9c7e-58e32e5311de.vbs"
                                14⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2660
                                • C:\Program Files (x86)\Windows Defender\wininit.exe
                                  "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                  15⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:4824
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a84d6574-516f-4c9d-8cef-f3acf2ff76f3.vbs"
                                    16⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1672
                                    • C:\Program Files (x86)\Windows Defender\wininit.exe
                                      "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                      17⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:4536
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2c4dc58-3798-4320-9063-2ddb27b12783.vbs"
                                        18⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:3256
                                        • C:\Program Files (x86)\Windows Defender\wininit.exe
                                          "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                          19⤵
                                          • UAC bypass
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Checks whether UAC is enabled
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:744
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90e28189-da87-4f55-93fa-90757cdf9ec8.vbs"
                                            20⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:812
                                            • C:\Program Files (x86)\Windows Defender\wininit.exe
                                              "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                              21⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:1464
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f4420ed-7f80-4823-84ab-df12bff47296.vbs"
                                                22⤵
                                                  PID:1228
                                                  • C:\Program Files (x86)\Windows Defender\wininit.exe
                                                    "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                                    23⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:2052
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1882783-02ce-435f-8d26-0d1ceb2e9d28.vbs"
                                                      24⤵
                                                        PID:2520
                                                        • C:\Program Files (x86)\Windows Defender\wininit.exe
                                                          "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                                          25⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • System policy modification
                                                          PID:1440
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70c96618-5a34-4623-808c-3b9469fe5be1.vbs"
                                                            26⤵
                                                              PID:1200
                                                              • C:\Program Files (x86)\Windows Defender\wininit.exe
                                                                "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                                                27⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:1136
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e21a8de-3aca-4dab-889d-7723c89f75f9.vbs"
                                                                  28⤵
                                                                    PID:672
                                                                    • C:\Program Files (x86)\Windows Defender\wininit.exe
                                                                      "C:\Program Files (x86)\Windows Defender\wininit.exe"
                                                                      29⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:2384
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffba553d-18cf-4735-828e-df4090cf5325.vbs"
                                                                        30⤵
                                                                          PID:3728
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3710cbc-126f-41e6-9c90-2296f11759eb.vbs"
                                                                          30⤵
                                                                            PID:3332
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6b49094f-9312-421f-b6fb-341cfd8d5f42.vbs"
                                                                        28⤵
                                                                          PID:4256
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\834a2d19-7eb8-41c6-b05a-bfd5ab9d8502.vbs"
                                                                      26⤵
                                                                        PID:4240
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71465217-95c4-4405-817d-4f5bfc76205e.vbs"
                                                                    24⤵
                                                                      PID:2464
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4dd45b04-fadd-4006-8230-d82f1a281b67.vbs"
                                                                  22⤵
                                                                    PID:2484
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae41d4f5-bafa-4579-a8da-fa4e88e6487f.vbs"
                                                                20⤵
                                                                  PID:1944
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a712494e-9346-4fbc-9f95-dccaf9d990ed.vbs"
                                                              18⤵
                                                                PID:4344
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\543fb153-eba5-4965-9b50-625c004b8e30.vbs"
                                                            16⤵
                                                              PID:1936
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f79a50e-1f34-439f-ad4d-05ed679c58f0.vbs"
                                                          14⤵
                                                            PID:2416
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23afe524-0c86-40a7-b680-d14a10e688c0.vbs"
                                                        12⤵
                                                          PID:4312
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca3c884a-eb13-4ac6-9db3-332ddf9bc45c.vbs"
                                                      10⤵
                                                        PID:2728
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a62994bc-4f98-495f-b99b-4b15b840eb6f.vbs"
                                                    8⤵
                                                      PID:4392
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7390fcfe-631d-489c-9151-6419d0d7b934.vbs"
                                                  6⤵
                                                    PID:2420
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b80fb463-482e-45ca-9196-d6af4cb46a1e.vbs"
                                                4⤵
                                                  PID:4708
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Registry.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4312
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1424
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5032
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1248
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4140
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3032
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\wininit.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:632
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:804
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Defender\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2616
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\lsass.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5056
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2352
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\ReadyBoot\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2252

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Winlogon Helper DLL

                                          1
                                          T1547.004

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Privilege Escalation

                                          Abuse Elevation Control Mechanism

                                          1
                                          T1548

                                          Bypass User Account Control

                                          1
                                          T1548.002

                                          Boot or Logon Autostart Execution

                                          2
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Winlogon Helper DLL

                                          1
                                          T1547.004

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Scheduled Task

                                          1
                                          T1053.005

                                          Defense Evasion

                                          Abuse Elevation Control Mechanism

                                          1
                                          T1548

                                          Bypass User Account Control

                                          1
                                          T1548.002

                                          Impair Defenses

                                          1
                                          T1562

                                          Disable or Modify Tools

                                          1
                                          T1562.001

                                          Modify Registry

                                          4
                                          T1112

                                          Credential Access

                                          Discovery

                                          Query Registry

                                          2
                                          T1012

                                          System Information Discovery

                                          3
                                          T1082

                                          Lateral Movement

                                          Collection

                                          Command and Control

                                          Exfiltration

                                          Impact

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Program Files (x86)\Windows Defender\wininit.exe
                                            Filesize

                                            2.2MB

                                            MD5

                                            3aa1bbd17d68b0b67b7423f1fe09b05b

                                            SHA1

                                            61c43b8f31a51d772fd39d5caa87699d74971a43

                                            SHA256

                                            7362f82084bcdf47b0927674ad678f66214e8d4f2783a0b9338ee4eb773c3474

                                            SHA512

                                            7ae82411565104b15cc0de4cc8315d93301befbb28b1e36e3c50d46c8ba9fb1ff8eb361e12cd9d32771e2a5ecbee9b026aca0105473a9fe5a877fc2744b32014

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wininit.exe.log
                                            Filesize

                                            1KB

                                            MD5

                                            49b64127208271d8f797256057d0b006

                                            SHA1

                                            b99bd7e2b4e9ed24de47fb3341ea67660b84cca1

                                            SHA256

                                            2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77

                                            SHA512

                                            f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\0b47598e-dc69-4a7b-9e69-175c21c56fbb.vbs
                                            Filesize

                                            727B

                                            MD5

                                            fc0df33bcd5bfe15bc88a008f7d77cc3

                                            SHA1

                                            0644b0b15f31797c8f40c9e5bd74040512d0c2ff

                                            SHA256

                                            ef51ab8b112f67e5ef9437f2fe6c374096692fbca81ed0c24c95c39d9587d702

                                            SHA512

                                            cf66441c4c646f97b6f07b84515bf5190aa1bfeb650702dd8588a70a08c741e5d1ed30e0e0cea1a2b7894e7e19966362e1867b9a3b5ddddd0372ce2ae4de03e4

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\0f4420ed-7f80-4823-84ab-df12bff47296.vbs
                                            Filesize

                                            727B

                                            MD5

                                            5e4289241d6d0013f0b7d4c4636ef9f0

                                            SHA1

                                            1932d0fe83f04c2e8541a92bb27e37fb28ccaea8

                                            SHA256

                                            48d6a0624bbb49ef7b48508ac668cc422c1ea6d84f0ec904189e61fce90da3a0

                                            SHA512

                                            b9cedd61fccef1f317eeb3f9f47360a58ce5f1776fda7dd1df41ca5fbe6e7994196bb247b18bef5889c764c73e999ce3262a5455888e10a3a8256fd6678cd02a

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\235055a4-cc5a-4f85-8e12-97732ff87464.vbs
                                            Filesize

                                            727B

                                            MD5

                                            0c8d1527a923c8d28397a14673d0797f

                                            SHA1

                                            3e1505d4a46e09a8b38d2895a63ed52be41a14aa

                                            SHA256

                                            78cb244c43b02542594873480dedf68aaed43a79222d40c0e2ad062808ace0ba

                                            SHA512

                                            e0329bc5464e4954bb08a1a107001efb4f0010c29bd89f531d9b675914b84dd12aeed707ec67da214074c33299546dbd01c67160904ad0ad4c04d02b708a8a85

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\290662b5-9db1-4405-b6ec-d7d242150ce0.vbs
                                            Filesize

                                            727B

                                            MD5

                                            d356e6e0890165817aef381d5f16e5d2

                                            SHA1

                                            3ed79aa1822243c3384ebf2b2b29f5d28736c04d

                                            SHA256

                                            9ffe1442733c5efd32be272f4b04063686f009fc7b97f096eaefe03e847e2f9a

                                            SHA512

                                            a96b23202d2d96fb2ee9fa175af75681c4d97b770f584e77938356e997458a70e603622df50c098b13a2dde03a55e8aab9a2a79d9d6876e57cf824a6e9d70459

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\2e21a8de-3aca-4dab-889d-7723c89f75f9.vbs
                                            Filesize

                                            727B

                                            MD5

                                            1946ed161e3c2cac074a9dc7e3fcc8d6

                                            SHA1

                                            271065f565516277699f766584b2ea619161dd1d

                                            SHA256

                                            5e6071dc203e87dd8dadcbd160553453bc78b19ab0c51527827ef99bcb77ce6a

                                            SHA512

                                            6107732a461358241548de4fab2929dd40e87c4b0178f8d4770bbfafd97e1fb57c1cf258380088583c4cdd24e71ff8d39b0f8d73aeda34200693fbe6cbef1642

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\61d506a2-8e86-4257-879b-e9ba7a44003c.vbs
                                            Filesize

                                            727B

                                            MD5

                                            339c9e09cef61eb81866491612a456f5

                                            SHA1

                                            c4659d7152c31ed8ef60b54cbbde6c03e0d4dc96

                                            SHA256

                                            9de12cc504bcf46e8d89deee2693b213ba74af6e0f74ccd80abce9a0b24c06cc

                                            SHA512

                                            40c776e832057ec78b40fe4f7f0ac9dbac11f38a4658181a2d88086784fc44991b9ec6021b47c3e5b060ecd6adc63c24379621ba28fdb696d0bc055398c7452d

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\8461f71b-f43c-4615-a016-9830b551257c.vbs
                                            Filesize

                                            727B

                                            MD5

                                            752cbc7651168ae16dc786beade5b02b

                                            SHA1

                                            69b68f37dbc62fd6844a3b6238256e03439d139d

                                            SHA256

                                            87697e2eeaccc501c029f5cb4530dda9a474923864ff5534bc7cc853a2d22a7e

                                            SHA512

                                            240faf71be4fc7b431a7fbabd2ffd98fd840d21dc091616ee038191ecfe4ea9519b671cdf0acb1d10565aa69f368af59b5c8febaca7d2cc429b5c5cabb878abc

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\90e28189-da87-4f55-93fa-90757cdf9ec8.vbs
                                            Filesize

                                            726B

                                            MD5

                                            4661311a2f6f2e509f2e1ec743efb39c

                                            SHA1

                                            ddfd12edcbae0771ab5274407d09efbb0a3ecda6

                                            SHA256

                                            1ef312f048b822e15198f6eb0d4586d447ae5e853f3bbec05de72bb25713f2ee

                                            SHA512

                                            0209969249674b6d07f23d59c6611396fce5b98e1260c3f75c3b387712d1e5db612402e643976de4eb76aaa75f9c6cafd78610584fdef6ad126a748238cdb6fc

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\WBYhT1obAD.bat
                                            Filesize

                                            216B

                                            MD5

                                            e481bd2fd983f23e4c7e9e55fe9554b6

                                            SHA1

                                            8b5d93ee890150a9e426b04c8962ec573bf556c1

                                            SHA256

                                            68dae969e9db97172413b3e4f3161cadc60c22c239439cb0143e98dd1085ec71

                                            SHA512

                                            96586723c169b92304855b6639061f679a3e1429e41b57179b548ef392926f4cb27377b70e0890ec89aa7d0f14c61ea8cca2b26e0353d6116cf2fb3ef4b10492

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a2c4dc58-3798-4320-9063-2ddb27b12783.vbs
                                            Filesize

                                            727B

                                            MD5

                                            8c386dd8ad20072d2c5a9cdf5e2e3ec5

                                            SHA1

                                            1a6fe4f66269c8c9bf06270bb4f3d6cf126b6390

                                            SHA256

                                            bc9511f5734ce0b289e6cac3e9d77a4059e8d89872017b30b8aa9094c2528ee0

                                            SHA512

                                            91119cc7ea5f048c50fb05c9cdcbfbb2c9aaa204a6fefcf8488b28f2be664e92a8fd90628ab7dbe538565efe2e0e43186aa880ac9fd82034fa42aa44eae5247c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\a84d6574-516f-4c9d-8cef-f3acf2ff76f3.vbs
                                            Filesize

                                            727B

                                            MD5

                                            a3031ae9274389f34a1a9cfaa05b2660

                                            SHA1

                                            5f26422aaf7ab22a04fadb3818cc33340359aa80

                                            SHA256

                                            20dda7ebce2b1318a10f9bfe46b3624c9832ea600c00ff32fb559f6cb0b5de06

                                            SHA512

                                            1efea078e4377dc1b3b78095e802d1abae8403c7dc68f1d54be3c34228850987b54da24a9b7f5caf634aaf48c39c816e903f36e619baafe3ba9427a89f222ec9

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\b80fb463-482e-45ca-9196-d6af4cb46a1e.vbs
                                            Filesize

                                            503B

                                            MD5

                                            4f34076f051513fabf694e11ff8f905a

                                            SHA1

                                            255bef346e427f6250ba53d96d990247c4e2b558

                                            SHA256

                                            d89eecf750b9357f9bba6f8f1a12fa8ed1d1f9c13c97185aaa03ee461de0137e

                                            SHA512

                                            83655238b01fa93c1c109a88db934beb2339cbcd578bc69a4dd0ed3a29a0c96d9f894af4ef058659b3d41976f04e85d91f2a6d5171a9341392b88f0ef2fdc11c

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\ec069271-7842-4219-9c7e-58e32e5311de.vbs
                                            Filesize

                                            727B

                                            MD5

                                            0b8dcf7abd01b88ea4130ee172e263e0

                                            SHA1

                                            26fbaaff73adacdb7ddd398666c430a66f99a551

                                            SHA256

                                            7e8c2691db22cce62a887c557ab00f50330f60e043f881ceb3e8c93313100a2a

                                            SHA512

                                            256ed60e8342e30edbb1609be56022db3b797b6dd404c6ac44418302ca3740f7d6d3eeca4a1e321eaedb6af3678659b401e7be6821de606f1180f50f89c03616

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\f1882783-02ce-435f-8d26-0d1ceb2e9d28.vbs
                                            Filesize

                                            727B

                                            MD5

                                            0fd31a420ec68d830b1b679f52de9d53

                                            SHA1

                                            0d1300283909fb3871fd42f83c97f40c8f4cbe6e

                                            SHA256

                                            d16b2fb97dfee4d29ba0b47b368b7db4ee3191d332413163eb5a8ab3cc23e67d

                                            SHA512

                                            eb9898cb1eb90b30991ad09c025122179a3e25043e56169f3a278780231c5477ef3843fd734956a875430b22e440fd9a5f91172ae9b173a3c7c976b457b94057

                                            Download Submit

                                          • C:\Users\Admin\AppData\Local\Temp\ffba553d-18cf-4735-828e-df4090cf5325.vbs
                                            Filesize

                                            727B

                                            MD5

                                            bbc65c94ed94d3abcd7ff768f14e32c5

                                            SHA1

                                            9cedbcfe3e1dfa9c3a6cefc886302166df33a58b

                                            SHA256

                                            870642678a8394ecc5fcccf5a63aa829d1d7c92a879722af8b5949810ec786e7

                                            SHA512

                                            02909d3fabca211f2b1c93556016cece1f53add3c89ad0b7b54d718a68601108d6a0771483233607eb5ef1b83ad3e6a660127282ee906efb4781b05f28b68279

                                            Download Submit

                                          • memory/1052-124-0x000000001CA80000-0x000000001CB82000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download

                                          • memory/1228-87-0x000000001C3A0000-0x000000001C4A2000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download

                                          • memory/1464-160-0x000000001BAB0000-0x000000001BAC2000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/2052-172-0x000000001B0A0000-0x000000001B0B2000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/3048-112-0x000000001C300000-0x000000001C402000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download

                                          • memory/3088-89-0x000000001BDC0000-0x000000001BDD2000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/3088-100-0x000000001D0E0000-0x000000001D1E2000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download

                                          • memory/4716-15-0x000000001B2F0000-0x000000001B2FA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/4716-20-0x000000001B340000-0x000000001B352000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/4716-25-0x000000001B9B0000-0x000000001B9BC000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-27-0x000000001BAD0000-0x000000001BADC000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-28-0x000000001BAE0000-0x000000001BAEA000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/4716-29-0x000000001BBF0000-0x000000001BBFE000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/4716-31-0x000000001BC10000-0x000000001BC18000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-32-0x000000001BC20000-0x000000001BC2C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-30-0x000000001BC00000-0x000000001BC08000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-34-0x000000001BC40000-0x000000001BC4A000-memory.dmp

                                            Filesize

                                            40KB

                                            Download

                                          • memory/4716-33-0x000000001BC30000-0x000000001BC38000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-35-0x000000001BC50000-0x000000001BC5C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-49-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/4716-24-0x000000001B9A0000-0x000000001B9AC000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-23-0x000000001B990000-0x000000001B998000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-21-0x000000001BEC0000-0x000000001C3E8000-memory.dmp

                                            Filesize

                                            5.2MB

                                            Download

                                          • memory/4716-22-0x000000001B370000-0x000000001B37C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-18-0x000000001B320000-0x000000001B32C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-19-0x000000001B330000-0x000000001B338000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-26-0x000000001BAC0000-0x000000001BAC8000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-17-0x000000001B310000-0x000000001B318000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-16-0x000000001B300000-0x000000001B30C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-0-0x00007FF8470A3000-0x00007FF8470A5000-memory.dmp

                                            Filesize

                                            8KB

                                            Download

                                          • memory/4716-14-0x000000001B2E0000-0x000000001B2F0000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4716-13-0x000000001B170000-0x000000001B178000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-12-0x000000001B160000-0x000000001B16C000-memory.dmp

                                            Filesize

                                            48KB

                                            Download

                                          • memory/4716-11-0x000000001B150000-0x000000001B162000-memory.dmp

                                            Filesize

                                            72KB

                                            Download

                                          • memory/4716-10-0x000000001B140000-0x000000001B148000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-9-0x000000001B120000-0x000000001B136000-memory.dmp

                                            Filesize

                                            88KB

                                            Download

                                          • memory/4716-1-0x0000000000290000-0x00000000004CE000-memory.dmp

                                            Filesize

                                            2.2MB

                                            Download

                                          • memory/4716-7-0x000000001B100000-0x000000001B108000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-8-0x000000001B110000-0x000000001B120000-memory.dmp

                                            Filesize

                                            64KB

                                            Download

                                          • memory/4716-6-0x000000001B290000-0x000000001B2E0000-memory.dmp

                                            Filesize

                                            320KB

                                            Download

                                          • memory/4716-5-0x000000001B0E0000-0x000000001B0FC000-memory.dmp

                                            Filesize

                                            112KB

                                            Download

                                          • memory/4716-4-0x000000001B0D0000-0x000000001B0D8000-memory.dmp

                                            Filesize

                                            32KB

                                            Download

                                          • memory/4716-3-0x00000000026A0000-0x00000000026AE000-memory.dmp

                                            Filesize

                                            56KB

                                            Download

                                          • memory/4716-2-0x00007FF8470A0000-0x00007FF847B61000-memory.dmp

                                            Filesize

                                            10.8MB

                                            Download

                                          • memory/4824-136-0x000000001C7F0000-0x000000001C8F2000-memory.dmp

                                            Filesize

                                            1.0MB

                                            Download