dcrat | dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
Size

1.7MB
MD5

d071fe4e42941ead06b9be307d35dc02
SHA1

c3101cc5b520f7b29a1dddfbd5968fab06d7771b
SHA256

dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c
SHA512

30015a3d01c8171ab65953dd771d45b63bc8f89f8739bf75c522af208e1b7976b2cb94ee8fb69d9f4507749488f0be19d299480d934018ad2b082bcd6b627163
SSDEEP

49152:T+gYXZTD1VXUqzX7VwjvMoh1IFyuyigWnMzm6sDBKvG:+THUxUoh1IF9gl2/

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5048	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	2148	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	2148	schtasks.exe	82

DCRat payload 6 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1240-1-0x0000000000870000-0x0000000000A30000-memory.dmp	dcrat
behavioral2/files/0x0007000000023cc4-30.dat	dcrat
behavioral2/files/0x0008000000023ccc-47.dat	dcrat
behavioral2/files/0x000c000000023c99-58.dat	dcrat
behavioral2/files/0x000c000000023cb7-102.dat	dcrat
behavioral2/memory/4036-268-0x0000000000B90000-0x0000000000D50000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3928	powershell.exe
3384	powershell.exe
4460	powershell.exe
4656	powershell.exe
4660	powershell.exe
1216	powershell.exe
2096	powershell.exe
5012	powershell.exe
1160	powershell.exe
5016	powershell.exe
4344	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	upfc.exe

Executes dropped EXE 8 IoCs

pid	Process
4036	upfc.exe
5036	upfc.exe
4208	upfc.exe
1152	upfc.exe
4140	upfc.exe
4832	upfc.exe
4520	upfc.exe
3764	upfc.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\RCXC2C7.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\Internet Explorer\OfficeClickToRun.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Program Files\7-Zip\Lang\upfc.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Program Files\Internet Explorer\OfficeClickToRun.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Program Files\Internet Explorer\e6c9b481da804f	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Program Files\Java\66fc9ff0ee96c2	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC025.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\Java\RCXC569.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Program Files\7-Zip\Lang\ea1d8f6d871115	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\Internet Explorer\RCXC345.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\Java\RCXC56A.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\upfc.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Program Files\Java\sihost.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCXC0A3.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Program Files\Java\sihost.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\ShellComponents\6ccacd8608530f	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Windows\es-ES\RCXC7EC.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Windows\es-ES\smss.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Windows\es-ES\smss.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Windows\es-ES\69ddcba757bf72	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Windows\ShellComponents\Idle.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Windows\ShellComponents\RCXCA7F.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Windows\ShellComponents\Idle.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dfs-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_2a1745907e2bef2b\fontdrvhost.exe	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Windows\es-ES\RCXC7FC.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
File opened for modification	C:\Windows\ShellComponents\RCXCA7E.tmp	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	upfc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2948	schtasks.exe
1140	schtasks.exe
4980	schtasks.exe
912	schtasks.exe
1620	schtasks.exe
1984	schtasks.exe
2552	schtasks.exe
3372	schtasks.exe
2164	schtasks.exe
2348	schtasks.exe
3732	schtasks.exe
1616	schtasks.exe
5048	schtasks.exe
624	schtasks.exe
968	schtasks.exe
4448	schtasks.exe
1456	schtasks.exe
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
3384	powershell.exe
3384	powershell.exe
1216	powershell.exe
1216	powershell.exe
4460	powershell.exe
4460	powershell.exe
3928	powershell.exe
3928	powershell.exe
4660	powershell.exe
4660	powershell.exe
5016	powershell.exe
5016	powershell.exe
4344	powershell.exe
4344	powershell.exe
2096	powershell.exe
2096	powershell.exe
4656	powershell.exe
4656	powershell.exe
1160	powershell.exe
1160	powershell.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
5012	powershell.exe
5012	powershell.exe
4656	powershell.exe
1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
1216	powershell.exe
3384	powershell.exe
4344	powershell.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	4036	upfc.exe
Token: SeDebugPrivilege	5036	upfc.exe
Token: SeDebugPrivilege	4208	upfc.exe
Token: SeDebugPrivilege	1152	upfc.exe
Token: SeDebugPrivilege	4140	upfc.exe
Token: SeDebugPrivilege	4832	upfc.exe
Token: SeDebugPrivilege	4520	upfc.exe
Token: SeDebugPrivilege	3764	upfc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4460	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	102
PID 1240 wrote to memory of 4460	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	102
PID 1240 wrote to memory of 3928	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	103
PID 1240 wrote to memory of 3928	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	103
PID 1240 wrote to memory of 3384	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	104
PID 1240 wrote to memory of 3384	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	104
PID 1240 wrote to memory of 4344	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	105
PID 1240 wrote to memory of 4344	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	105
PID 1240 wrote to memory of 5016	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	106
PID 1240 wrote to memory of 5016	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	106
PID 1240 wrote to memory of 1160	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	107
PID 1240 wrote to memory of 1160	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	107
PID 1240 wrote to memory of 5012	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	108
PID 1240 wrote to memory of 5012	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	108
PID 1240 wrote to memory of 2096	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	109
PID 1240 wrote to memory of 2096	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	109
PID 1240 wrote to memory of 1216	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	110
PID 1240 wrote to memory of 1216	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	110
PID 1240 wrote to memory of 4660	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	111
PID 1240 wrote to memory of 4660	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	111
PID 1240 wrote to memory of 4656	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	112
PID 1240 wrote to memory of 4656	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	112
PID 1240 wrote to memory of 4036	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	124
PID 1240 wrote to memory of 4036	1240	dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe	124
PID 4036 wrote to memory of 1944	4036	upfc.exe	125
PID 4036 wrote to memory of 1944	4036	upfc.exe	125
PID 4036 wrote to memory of 4544	4036	upfc.exe	126
PID 4036 wrote to memory of 4544	4036	upfc.exe	126
PID 1944 wrote to memory of 5036	1944	WScript.exe	133
PID 1944 wrote to memory of 5036	1944	WScript.exe	133
PID 5036 wrote to memory of 2348	5036	upfc.exe	134
PID 5036 wrote to memory of 2348	5036	upfc.exe	134
PID 5036 wrote to memory of 1268	5036	upfc.exe	135
PID 5036 wrote to memory of 1268	5036	upfc.exe	135
PID 2348 wrote to memory of 4208	2348	WScript.exe	138
PID 2348 wrote to memory of 4208	2348	WScript.exe	138
PID 4208 wrote to memory of 4388	4208	upfc.exe	139
PID 4208 wrote to memory of 4388	4208	upfc.exe	139
PID 4208 wrote to memory of 1456	4208	upfc.exe	140
PID 4208 wrote to memory of 1456	4208	upfc.exe	140
PID 4388 wrote to memory of 1152	4388	WScript.exe	141
PID 4388 wrote to memory of 1152	4388	WScript.exe	141
PID 1152 wrote to memory of 3492	1152	upfc.exe	142
PID 1152 wrote to memory of 3492	1152	upfc.exe	142
PID 1152 wrote to memory of 4696	1152	upfc.exe	143
PID 1152 wrote to memory of 4696	1152	upfc.exe	143
PID 3492 wrote to memory of 4140	3492	WScript.exe	144
PID 3492 wrote to memory of 4140	3492	WScript.exe	144
PID 4140 wrote to memory of 696	4140	upfc.exe	145
PID 4140 wrote to memory of 696	4140	upfc.exe	145
PID 4140 wrote to memory of 2176	4140	upfc.exe	146
PID 4140 wrote to memory of 2176	4140	upfc.exe	146
PID 696 wrote to memory of 4832	696	WScript.exe	147
PID 696 wrote to memory of 4832	696	WScript.exe	147
PID 4832 wrote to memory of 1300	4832	upfc.exe	148
PID 4832 wrote to memory of 1300	4832	upfc.exe	148
PID 4832 wrote to memory of 1504	4832	upfc.exe	149
PID 4832 wrote to memory of 1504	4832	upfc.exe	149
PID 1300 wrote to memory of 4520	1300	WScript.exe	150
PID 1300 wrote to memory of 4520	1300	WScript.exe	150
PID 4520 wrote to memory of 3476	4520	upfc.exe	151
PID 4520 wrote to memory of 3476	4520	upfc.exe	151
PID 4520 wrote to memory of 1144	4520	upfc.exe	152
PID 4520 wrote to memory of 1144	4520	upfc.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe
"C:\Users\Admin\AppData\Local\Temp\dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Program Files\7-Zip\Lang\upfc.exe
  "C:\Program Files\7-Zip\Lang\upfc.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9e3a16d-cb96-4825-bd10-37a474e6cf97.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Program Files\7-Zip\Lang\upfc.exe
      "C:\Program Files\7-Zip\Lang\upfc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5036
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e89aca6-0c50-4fa2-8f04-7b9dc5939470.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2348
      - C:\Program Files\7-Zip\Lang\upfc.exe
        
        "C:\Program Files\7-Zip\Lang\upfc.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d2a2299-63a0-4ead-b72c-b25763eb60af.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Program Files\7-Zip\Lang\upfc.exe
        
        "C:\Program Files\7-Zip\Lang\upfc.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b50954a-d0f6-4c5d-b39c-a68a90eefd50.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Program Files\7-Zip\Lang\upfc.exe
        
        "C:\Program Files\7-Zip\Lang\upfc.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc7ecb45-f481-4f02-8597-d5e279d65971.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Program Files\7-Zip\Lang\upfc.exe
        
        "C:\Program Files\7-Zip\Lang\upfc.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c0a1943-f527-4eae-8cd7-967d260c59c1.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Program Files\7-Zip\Lang\upfc.exe
        
        "C:\Program Files\7-Zip\Lang\upfc.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12dce935-12b5-4693-9e75-aabc7b84d93a.vbs"
        15⤵
        
        PID:3476
        
        C:\Program Files\7-Zip\Lang\upfc.exe
        
        "C:\Program Files\7-Zip\Lang\upfc.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3764
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a1e5f25-1181-4d89-9aa0-fbd23f4d5a90.vbs"
        17⤵
        
        PID:1704
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe87ce38-ab23-4a72-9226-07abaf3b6e17.vbs"
        17⤵
        
        PID:2060
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4683aeb1-ac8a-43d7-8c74-576c213d32b1.vbs"
        15⤵
        
        PID:1144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28dc6471-4f6b-4b48-8b7d-615fbfbee4e8.vbs"
        13⤵
        
        PID:1504
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc15b845-2bf3-44f3-8938-14a3c7d1a290.vbs"
        11⤵
        
        PID:2176
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0fa3ac8-be44-410b-affe-30b8104c1ea4.vbs"
        9⤵
        
        PID:4696
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\567b76c0-107d-41f1-a1da-5d61edc28ec8.vbs"
        7⤵
        
        PID:1456
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a39e8de8-17ca-4937-9afd-8bc73a9bdaeb.vbs"
        5⤵
        
        PID:1268
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db6f9e77-34e2-4c73-9697-014afa1e8662.vbs"
    3⤵
    PID:4544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Java\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellComponents\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\ShellComponents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\ShellComponents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\upfc.exe

Filesize
1.7MB

MD5
f28af48ac83e7c1fd47f40fa9f3448ac

SHA1
a245dc62d92ce5112a2c48ab718a6ca0b401ea43

SHA256
51616ccc8d00b8cbb55a1673262786c5279033e8658e5a13684d880af6476dab

SHA512
f4fe34d53ef6b998911b3d63b4d5b0ddd2e5f515bace3eeb3af6097d0ff66056c6607452f263c88306df2215660f2e2039acfcd2796c6ab46c3e156fbff07952

Download Submit
C:\Program Files\Internet Explorer\OfficeClickToRun.exe

Filesize
1.7MB

MD5
96e22234b0cf7f52b6d5eb515504a644

SHA1
b43695f896d89997452f012560d383e3bc41b089

SHA256
3b355fdabd11d1fa6ab4c031aedd756c35ac8ba33760be1cb705cea4963e9a40

SHA512
01656fa4f79f5ee6b6b00876ca886bd48da1eee07d3f23b27ed9b819593a102678fc03b0c6ff203d699f697477bc3a4b540ee562380e62688d01c88713fb09a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\upfc.exe.log

Filesize
1KB

MD5
4a667f150a4d1d02f53a9f24d89d53d1

SHA1
306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97

SHA256
414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd

SHA512
4edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ecceac16628651c18879d836acfcb062

SHA1
420502b3e5220a01586c59504e94aa1ee11982c9

SHA256
58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

SHA512
be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\12dce935-12b5-4693-9e75-aabc7b84d93a.vbs

Filesize
712B

MD5
c3213ee0a1c1c940b463595d8ceae1a0

SHA1
659dfa7146707b441cdc697f10f56611282818e5

SHA256
b2809116e013a9bc52fe51e5c3825dc524f1954418af9c1a0621eb90fda09145

SHA512
49ad211f822da32aa5b181bef8875e39d978cbcd2fcac40f8810d5d82a3d638e48b32d45dbad14b5c58e0d1b2592a0eebe6aa6022f1dd63b184b571e733e7dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1d2a2299-63a0-4ead-b72c-b25763eb60af.vbs

Filesize
712B

MD5
049a44ff3ccab63c0d71b14bba8daf29

SHA1
8fecc0af2a8f6749d6be6cf2210bbe7ed048e697

SHA256
7ce275b5acf97151c2236ef85ba4487b2792e7d5cd2a3baef781a57723d3fd8c

SHA512
0c8e5ed60043370916f3978f7929a4c0eb02c3e34cae26b7f286d19b9b0bb9d50513256ec089dc4704148b805a24b9ccf2188152857bad53470fc1374395f132

Download Submit
C:\Users\Admin\AppData\Local\Temp\4c0a1943-f527-4eae-8cd7-967d260c59c1.vbs

Filesize
712B

MD5
7c92f973dcc376bebf8c62a8102003b5

SHA1
a70c470b5801c2c292b073c8f5a21cac34c616d7

SHA256
e862879a1e160e0fd2f1042c188b719801dccbe506c2f9aee090d97e6c89e962

SHA512
90ff84196afc28effd238d74cbd5ef216fac1abeba7cf66d13e15fe93d95e3455b3d5f0b557dde3d6b6f2546bb6387b753f1668f71ef939018a09da25e4f7541

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b50954a-d0f6-4c5d-b39c-a68a90eefd50.vbs

Filesize
712B

MD5
45d0068df5d645fec8007420b52ca30e

SHA1
1a627f4595f4410cac37a1651aec8727b1800e9f

SHA256
c502636adb99febccd26a373c7e557a7d846ad01a0b00fcc7e1420709bb1ef9f

SHA512
12245aae947106b22a0699ad87c998d0d26e46640e41c5fc6dbd581c6554290f053ecd288185222fc333e2b675ff4e8b1a531f198cfd58dc7758a1cfe0cc8f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\6a1e5f25-1181-4d89-9aa0-fbd23f4d5a90.vbs

Filesize
712B

MD5
52c43c7ffeff865b0facfd016670d6c2

SHA1
47f0b7ed4da4e16b3adde69b77c1b0ff69156459

SHA256
8026da6df3f8ba7a8fcb1ce95959aae8ef1c2b869c0d61e1adcaa52a9ca64c90

SHA512
58ee297b7b1aaa79c91ff87c9bdf658adac1968fce5c74438b1f4cf9a4e6aa930f08d4008bfc69fc7e6d4104f48cfc352401eef3cab5dd707f8be256a309dfa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7e89aca6-0c50-4fa2-8f04-7b9dc5939470.vbs

Filesize
712B

MD5
95e40c219ad52f27e122bedce7843146

SHA1
68bd4f756ff0c9033e293a8c55227a8f58ce1530

SHA256
d512a0b300c08c7ac4f10db605050ed9e073ebf15f798812f37b2e2f1fc5e899

SHA512
6744f51a4b0434753c0290c5ab42b63ea7599731e8b7d5f17e4cc6de775bd6325ce9a653226009e7ddb0555757c36d14a41e60c3c747100d19062c128dad5f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hp2p4med.sdo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cc7ecb45-f481-4f02-8597-d5e279d65971.vbs

Filesize
712B

MD5
2225b1846ac0547a5a0d7d6c1f8656b2

SHA1
e57a875dbb7bdcdecf677d01d2845834c5637052

SHA256
32428c99a25f4478d204b7b8686fe53d21735d97b94d0b4a1c378059322f7099

SHA512
17aef90fd23626d5a431b7661ce3a485f5268007cd8eb3e402bc2d87ccbd48ddd4681e286224d542eb95c941939591d4239c4d47b7c4ec787aca614fbc84bef0

Download Submit
C:\Users\Admin\AppData\Local\Temp\d9e3a16d-cb96-4825-bd10-37a474e6cf97.vbs

Filesize
712B

MD5
b8a82f1ce5e4fb6636faf021a459c514

SHA1
fd2c138c69e8b217705b7ab1a83a0fb90bfabb06

SHA256
a894dc8adb3b3012c294b2273cf35be284255312b69e5c6d97ee3ae8e8d367f0

SHA512
336b9ee378c0e9a20392a8ab148bf3f76cf67cdd6ec4e8ae176637483bd33539816e0305e8638202990bc3ac04aa01607d73e276f009715ed24b5960c6271c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\db6f9e77-34e2-4c73-9697-014afa1e8662.vbs

Filesize
488B

MD5
0652ac5f105c5e2c4f6916ad400ff825

SHA1
84d6351da8623b5d90016de28a3bdc1590de813e

SHA256
3c0f1a6924e29d5cac0fa028cff9fef84d7337d5a7418ffbe302b40f167de3d3

SHA512
507ef04c61360a367c1d50ae31e4b2ed8088a30ca5141ef4583089a1d49eba3c6ffca41a0f9ce05b79d4a4ee869868276cd00968274a3058d3fd889c4a6058dd

Download Submit
C:\Users\Public\Desktop\taskhostw.exe

Filesize
1.7MB

MD5
dd83e0aab28800c074528408046a19fe

SHA1
867f8ba828123db0362ce5dc3dabd4e3579de20a

SHA256
09f341ffe890c870e3ac19248fff45c7c9fe8c5465a1158ce09ace0c6108de79

SHA512
63612579491c26c1af84416521ecaa143661a578de8936b8089e24311469a73a0c2ba817c8d12ec92078a9e0ea0c35ea87dd938f9d25860cd0bc6672ed7ac4a8

Download Submit
C:\Windows\ShellComponents\Idle.exe

Filesize
1.7MB

MD5
d071fe4e42941ead06b9be307d35dc02

SHA1
c3101cc5b520f7b29a1dddfbd5968fab06d7771b

SHA256
dcf5dfc2327f09370f1821cf94c3dbba3e3431f9f0e315cfd7f64c76c872cf3c

SHA512
30015a3d01c8171ab65953dd771d45b63bc8f89f8739bf75c522af208e1b7976b2cb94ee8fb69d9f4507749488f0be19d299480d934018ad2b082bcd6b627163

Download Submit
memory/1216-167-0x000002496ADC0000-0x000002496ADE2000-memory.dmp

Filesize
136KB

Download
memory/1240-18-0x000000001BF90000-0x000000001BF9C000-memory.dmp

Filesize
48KB

Download
memory/1240-6-0x000000001B550000-0x000000001B560000-memory.dmp

Filesize
64KB

Download
memory/1240-14-0x000000001B640000-0x000000001B64C000-memory.dmp

Filesize
48KB

Download
memory/1240-105-0x00007FFD37FB3000-0x00007FFD37FB5000-memory.dmp

Filesize
8KB

Download
memory/1240-13-0x000000001C290000-0x000000001C7B8000-memory.dmp

Filesize
5.2MB

Download
memory/1240-15-0x000000001BE60000-0x000000001BE6A000-memory.dmp

Filesize
40KB

Download
memory/1240-219-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/1240-229-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/1240-1-0x0000000000870000-0x0000000000A30000-memory.dmp

Filesize
1.8MB

Download
memory/1240-269-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/1240-2-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/1240-12-0x000000001B5C0000-0x000000001B5D2000-memory.dmp

Filesize
72KB

Download
memory/1240-23-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/1240-16-0x000000001BE70000-0x000000001BE7E000-memory.dmp

Filesize
56KB

Download
memory/1240-0-0x00007FFD37FB3000-0x00007FFD37FB5000-memory.dmp

Filesize
8KB

Download
memory/1240-20-0x00007FFD37FB0000-0x00007FFD38A71000-memory.dmp

Filesize
10.8MB

Download
memory/1240-17-0x000000001BE80000-0x000000001BE88000-memory.dmp

Filesize
32KB

Download
memory/1240-10-0x000000001B5B0000-0x000000001B5B8000-memory.dmp

Filesize
32KB

Download
memory/1240-9-0x000000001B5A0000-0x000000001B5AC000-memory.dmp

Filesize
48KB

Download
memory/1240-8-0x000000001B560000-0x000000001B570000-memory.dmp

Filesize
64KB

Download
memory/1240-7-0x000000001B580000-0x000000001B596000-memory.dmp

Filesize
88KB

Download
memory/1240-5-0x0000000002C20000-0x0000000002C28000-memory.dmp

Filesize
32KB

Download
memory/1240-19-0x000000001BFE0000-0x000000001BFEC000-memory.dmp

Filesize
48KB

Download
memory/1240-4-0x000000001B5D0000-0x000000001B620000-memory.dmp

Filesize
320KB

Download
memory/1240-3-0x0000000002C00000-0x0000000002C1C000-memory.dmp

Filesize
112KB

Download
memory/3764-373-0x000000001B120000-0x000000001B132000-memory.dmp

Filesize
72KB

Download
memory/4036-270-0x000000001BFF0000-0x000000001C002000-memory.dmp

Filesize
72KB

Download
memory/4036-268-0x0000000000B90000-0x0000000000D50000-memory.dmp

Filesize
1.8MB

Download
memory/4832-350-0x000000001B030000-0x000000001B042000-memory.dmp

Filesize
72KB

Download