Overview

overview

10

Static

static

3

69b8694172...74.exe

windows7-x64

10

69b8694172...74.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-01-2025 01:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69b86941727bc8b758648b00a55e606f5e9efec117681a7a392d9fc669a55274.exe

  • Size

    1.5MB

  • MD5

    7b45d565ba6ca684897302d0eefc4b60

  • SHA1

    5a48de7a66d4d2b46d296a9049dbe8f61b401989

  • SHA256

    69b86941727bc8b758648b00a55e606f5e9efec117681a7a392d9fc669a55274

  • SHA512

    6b770cc9b06f8295bd2dc1d8f5d52c4ff60d0db36baa44511dc960886f0f3670a92c23bab570f14b22aae87f47a5466ce89a1a85032d1dae40bd3da1714284c9

  • SSDEEP

    24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:kzhWhCXQFN+0IEuQgyiVK

Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 51 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 34 IoCs
    evasiontrojan
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 17 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 51 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\69b86941727bc8b758648b00a55e606f5e9efec117681a7a392d9fc669a55274.exe
    "C:\Users\Admin\AppData\Local\Temp\69b86941727bc8b758648b00a55e606f5e9efec117681a7a392d9fc669a55274.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\69b86941727bc8b758648b00a55e606f5e9efec117681a7a392d9fc669a55274.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\pscript\winlogon.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\StartMenuExperienceHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2284
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3292
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\OfficeClickToRun.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2112
    • C:\Users\Default User\RuntimeBroker.exe
      "C:\Users\Default User\RuntimeBroker.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:900
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14f84251-ae97-49de-a01c-775cf18508e6.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Users\Default User\RuntimeBroker.exe
          "C:\Users\Default User\RuntimeBroker.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4556
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f15ca78e-6e6b-4179-80ae-d0d10831ca52.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3500
            • C:\Users\Default User\RuntimeBroker.exe
              "C:\Users\Default User\RuntimeBroker.exe"
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4640
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64452191-e939-4fcb-813d-7ef19f7d61cf.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:456
                • C:\Users\Default User\RuntimeBroker.exe
                  "C:\Users\Default User\RuntimeBroker.exe"
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:4724
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32eab51f-d0e9-471b-8542-f2a83424c7c0.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4120
                    • C:\Users\Default User\RuntimeBroker.exe
                      "C:\Users\Default User\RuntimeBroker.exe"
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:776
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbc0e9b2-a42a-4a46-bb2f-2efc557729a1.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4252
                        • C:\Users\Default User\RuntimeBroker.exe
                          "C:\Users\Default User\RuntimeBroker.exe"
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4504
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a32db4b-0894-4d30-8895-7c18d490e7f2.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4508
                            • C:\Users\Default User\RuntimeBroker.exe
                              "C:\Users\Default User\RuntimeBroker.exe"
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4516
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e359c3ad-4f0d-4e3e-b136-5283420ff421.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4312
                                • C:\Users\Default User\RuntimeBroker.exe
                                  "C:\Users\Default User\RuntimeBroker.exe"
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:3276
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ddaa4ab-4163-4833-85a2-ff51b6bcf9f0.vbs"
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3260
                                    • C:\Users\Default User\RuntimeBroker.exe
                                      "C:\Users\Default User\RuntimeBroker.exe"
                                      18⤵
                                      • UAC bypass
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:4412
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\858b4788-f849-40b4-8a89-8f013eee7810.vbs"
                                        19⤵
                                          PID:456
                                          • C:\Users\Default User\RuntimeBroker.exe
                                            "C:\Users\Default User\RuntimeBroker.exe"
                                            20⤵
                                            • UAC bypass
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • System policy modification
                                            PID:2928
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a2937db-c100-4554-8ac6-feb72ad44ace.vbs"
                                              21⤵
                                                PID:832
                                                • C:\Users\Default User\RuntimeBroker.exe
                                                  "C:\Users\Default User\RuntimeBroker.exe"
                                                  22⤵
                                                  • UAC bypass
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Checks whether UAC is enabled
                                                  • Modifies registry class
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • System policy modification
                                                  PID:2100
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29797ade-2b8a-4658-ba65-e8d7f51fa712.vbs"
                                                    23⤵
                                                      PID:1832
                                                      • C:\Users\Default User\RuntimeBroker.exe
                                                        "C:\Users\Default User\RuntimeBroker.exe"
                                                        24⤵
                                                        • UAC bypass
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:2824
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72123f3c-a1e0-4259-9895-16ff8c4f8dcd.vbs"
                                                          25⤵
                                                            PID:1168
                                                            • C:\Users\Default User\RuntimeBroker.exe
                                                              "C:\Users\Default User\RuntimeBroker.exe"
                                                              26⤵
                                                              • UAC bypass
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks whether UAC is enabled
                                                              • Modifies registry class
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              • System policy modification
                                                              PID:4292
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00ffe6d6-9e39-4b11-b0e2-8829ccf05935.vbs"
                                                                27⤵
                                                                  PID:4184
                                                                  • C:\Users\Default User\RuntimeBroker.exe
                                                                    "C:\Users\Default User\RuntimeBroker.exe"
                                                                    28⤵
                                                                    • UAC bypass
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    • Modifies registry class
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • System policy modification
                                                                    PID:4452
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\403ea79a-46c4-4708-86ed-47609edf451b.vbs"
                                                                      29⤵
                                                                        PID:484
                                                                        • C:\Users\Default User\RuntimeBroker.exe
                                                                          "C:\Users\Default User\RuntimeBroker.exe"
                                                                          30⤵
                                                                          • UAC bypass
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Checks whether UAC is enabled
                                                                          • Modifies registry class
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • System policy modification
                                                                          PID:3612
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\daa9a322-5e1f-42b0-8f1d-caafe6991061.vbs"
                                                                            31⤵
                                                                              PID:4008
                                                                              • C:\Users\Default User\RuntimeBroker.exe
                                                                                "C:\Users\Default User\RuntimeBroker.exe"
                                                                                32⤵
                                                                                • UAC bypass
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Checks whether UAC is enabled
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • System policy modification
                                                                                PID:4004
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd9490c2-3f7a-4aec-a85d-d6a148b503de.vbs"
                                                                                  33⤵
                                                                                    PID:2772
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b4eb1d08-a38c-4974-86df-b7975e680749.vbs"
                                                                                    33⤵
                                                                                      PID:2752
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ef894f0-ee93-4d78-99ff-bf4072e07ad4.vbs"
                                                                                  31⤵
                                                                                    PID:3708
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\135138cd-26f8-456a-ad53-20bfe5ff9109.vbs"
                                                                                29⤵
                                                                                  PID:4780
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35195f06-75a6-47aa-a6de-1c4a231795e6.vbs"
                                                                              27⤵
                                                                                PID:4420
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc55c6ab-d75b-49df-be19-bb654b92f63d.vbs"
                                                                            25⤵
                                                                              PID:1104
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\188dbbb5-fd9d-4368-b531-6491b470adce.vbs"
                                                                          23⤵
                                                                            PID:4036
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62005c32-92ef-4ac1-8eea-192ec9bc9788.vbs"
                                                                        21⤵
                                                                          PID:4956
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f823ab73-c6be-4844-9c1d-30ca13307f1f.vbs"
                                                                      19⤵
                                                                        PID:4188
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94de1695-f658-4757-842a-2ad1e31372f4.vbs"
                                                                    17⤵
                                                                      PID:3668
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ffc88ba-a8c1-4593-b482-76c98578e58a.vbs"
                                                                  15⤵
                                                                    PID:3940
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d205f3d6-b718-4343-b5ba-393a90a4803f.vbs"
                                                                13⤵
                                                                  PID:4796
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43b18d0f-3f2a-439d-9013-ca16e8cc26f7.vbs"
                                                              11⤵
                                                                PID:4316
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dffccfb3-bce8-494f-84a9-be6dce67dff9.vbs"
                                                            9⤵
                                                              PID:4496
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d765d716-04cd-40d7-ba19-1675f5248eab.vbs"
                                                          7⤵
                                                            PID:3188
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3bd180a-3e4f-41fb-be51-c301fcceeaa1.vbs"
                                                        5⤵
                                                          PID:2840
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a11a0f68-86ec-43eb-bda9-fd3f4f388412.vbs"
                                                      3⤵
                                                        PID:4940
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\pscript\winlogon.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:2040
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Tasks\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4892
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4992
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\OfficeClickToRun.exe'" /rl HIGHEST /f
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:3440

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Command and Scripting Interpreter

                                                  1
                                                  T1059

                                                  PowerShell

                                                  1
                                                  T1059.001

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Winlogon Helper DLL

                                                  1
                                                  T1547.004

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Privilege Escalation

                                                  Abuse Elevation Control Mechanism

                                                  1
                                                  T1548

                                                  Bypass User Account Control

                                                  1
                                                  T1548.002

                                                  Boot or Logon Autostart Execution

                                                  2
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Winlogon Helper DLL

                                                  1
                                                  T1547.004

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Scheduled Task

                                                  1
                                                  T1053.005

                                                  Defense Evasion

                                                  Abuse Elevation Control Mechanism

                                                  1
                                                  T1548

                                                  Bypass User Account Control

                                                  1
                                                  T1548.002

                                                  Impair Defenses

                                                  1
                                                  T1562

                                                  Disable or Modify Tools

                                                  1
                                                  T1562.001

                                                  Modify Registry

                                                  4
                                                  T1112

                                                  Credential Access

                                                  Discovery

                                                  Query Registry

                                                  2
                                                  T1012

                                                  System Information Discovery

                                                  3
                                                  T1082

                                                  Lateral Movement

                                                  Collection

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    baf55b95da4a601229647f25dad12878

                                                    SHA1

                                                    abc16954ebfd213733c4493fc1910164d825cac8

                                                    SHA256

                                                    ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                    SHA512

                                                    24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                    Filesize

                                                    2KB

                                                    MD5

                                                    d85ba6ff808d9e5444a4b369f5bc2730

                                                    SHA1

                                                    31aa9d96590fff6981b315e0b391b575e4c0804a

                                                    SHA256

                                                    84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                    SHA512

                                                    8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    944B

                                                    MD5

                                                    cadef9abd087803c630df65264a6c81c

                                                    SHA1

                                                    babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                                    SHA256

                                                    cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                                    SHA512

                                                    7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    944B

                                                    MD5

                                                    2e907f77659a6601fcc408274894da2e

                                                    SHA1

                                                    9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                    SHA256

                                                    385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                    SHA512

                                                    34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\00ffe6d6-9e39-4b11-b0e2-8829ccf05935.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    83a1214feecbe21ce720d31d9007a65c

                                                    SHA1

                                                    d469fff8b4e409f76160847113ce3ee52e69fcdf

                                                    SHA256

                                                    82856c419e45a2cd84689006899ec11a6f0eccdd910e466b76e1b69d0ef74c58

                                                    SHA512

                                                    6a4260337b322db3c93a0d70fc5551db3160941a0c4af524f001a8dbb54ec4cf150ad9698b0e8511b6d188dce59dd17426c7f518d0847e305fe6a9b4d7f57b70

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\0a2937db-c100-4554-8ac6-feb72ad44ace.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    2768ca02ded112e7302a5d94942093b8

                                                    SHA1

                                                    4dff3ec7fddc9d03546d8fb3a84294d8fab218bb

                                                    SHA256

                                                    cc422b3c2c65873ba34b4543a5636bc5042268befc195986606f697515be8dbe

                                                    SHA512

                                                    fc71523ab31bc002b6635cf9c9f0a22d2a5c9654b2430685595a5a92e46405211b9c6972c576410fd0ddc9d79205473ca18c82cbfd890ef1a3684cde632f9c59

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\0ddaa4ab-4163-4833-85a2-ff51b6bcf9f0.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    b0d3f2838cee9a9a91d6812677208d14

                                                    SHA1

                                                    e97b7b018116030357213c04f5913c7b750ba12a

                                                    SHA256

                                                    959522901bcee5a6a663bf9f1b20f44ed04b7091bd468fa39df819327f048920

                                                    SHA512

                                                    6e3559b649d1c463e40e3beecf86c3475fdfa8be4e6f1c7048d122b9fddfd78ad197f9a2d8bb20496a6300c629fd58edc7e0e5f68a50305af1e884ad22927b19

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\14f84251-ae97-49de-a01c-775cf18508e6.vbs
                                                    Filesize

                                                    714B

                                                    MD5

                                                    0ee7fae606796ac5073b4cee6bddfe1f

                                                    SHA1

                                                    7e06e31ff33a4e6e289132abf51f89c50d98f99b

                                                    SHA256

                                                    ef59069cf62fc3e8c20895fa16c57ae58a01ac1eabe6e7b086399c55f1769888

                                                    SHA512

                                                    5610fd5766a617daa5a5f07532396164dbeb1f1a4105888a16d998eaed9833105ddeed5741cba601bf4569b0096c4622c54b00a8a853f53c10aa57e1b4b3d376

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\29797ade-2b8a-4658-ba65-e8d7f51fa712.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    ea053eae15cc6e4906ba85121c2e4bf1

                                                    SHA1

                                                    e0418b6a97b7f9b951b4fb85b65387fd2490552a

                                                    SHA256

                                                    53720c99feaa9e1ee2d6be32ad188bd0e68869bba85279e16a4fdc427576b12a

                                                    SHA512

                                                    6b0fcc6a49542a1f176b709182a6747bc046cf3f528ddb2a069f228863ba39ebf273ce81c816cb8f337c12f038b67cc8cc84a4c28c587707d35c1c2dd1d6dd5f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\32eab51f-d0e9-471b-8542-f2a83424c7c0.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    d5052ab2b4ad97b4a79e74ed50f7f024

                                                    SHA1

                                                    5d7ae55f115f72b6453363d1149cc241bfa06c68

                                                    SHA256

                                                    ba49572ca4bd1654b5245005e5f0da65123274df7794ce0c04f9c1b685d9e61e

                                                    SHA512

                                                    84d454530750ea378839695f78b272faa14932863b59b80980c3c3efd29c051fd577e91735b942888250704989e625c246b1dcc45f9901c52c2880d6ff18281c

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\403ea79a-46c4-4708-86ed-47609edf451b.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    f775af58bf3503c4e352b48959d5499f

                                                    SHA1

                                                    5bcecb45caa167bd0da82685d0c3962f348dd730

                                                    SHA256

                                                    69827fa4797b743994de45a08b6d0fe38f426923ee3930d4561b009455b09120

                                                    SHA512

                                                    fe2090f54cf3893fa9771875cb84c2fd1c91ad8c90371ec6c08901d1c8e88a9001d9b29a7787a693e2e9305d7bff3eb9903cb32b96c38665fd71f6869bfb7b72

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\64452191-e939-4fcb-813d-7ef19f7d61cf.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    fdba1652bf45d53c9fb5a769c2c908cf

                                                    SHA1

                                                    5a58c15a15ba466076a7341e5f0c71c02cecebd3

                                                    SHA256

                                                    851c28ef9a2452622e31f209ee987a843f0d4f9fff46b5dec05678bc1dbcb423

                                                    SHA512

                                                    ea6c5d22766fc4266cf31ea8e1b35d2809a7759218d7636587557dfe58995dfd8a98daba7c67c2c6c1addc716eedad93061a7e13d2a57c4361fa0f9050d5ceea

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\6a32db4b-0894-4d30-8895-7c18d490e7f2.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    cd265aafdca04f2b9f0450d8db1847e4

                                                    SHA1

                                                    91909dc60cc5fb1d51c3a86ad090c5f276cc9f0f

                                                    SHA256

                                                    430f868e44796d782770e61c13d090e8e694a90d062d1b7840b9dee42bfd1b96

                                                    SHA512

                                                    1eb465c0a235163d3cb54831e1d6aa02b6b696da95a331adece119c0b0458c2b39adc02e21a9bf604eb7ab10e8bc060072494554cd0e23ca998e4096930d4921

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\72123f3c-a1e0-4259-9895-16ff8c4f8dcd.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    ee51332603e40cd7b3143f812fd36368

                                                    SHA1

                                                    55b8f6c0abca4744a1cee9bbf2ae8ca8ef1ac13e

                                                    SHA256

                                                    7fbdaed001f63d076a9bea01b8f2d8d076fd3030506f8c7d9eebba7edfdbcc7e

                                                    SHA512

                                                    0a9a448a11a0f44c4685c249feeb5c10100075a3b4a1516c74d41335baf57d77fccf762b391d1006449350bf8ea7ce0ee2d330664a8afb8b3b82c3a81c771114

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\858b4788-f849-40b4-8a89-8f013eee7810.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    e02669523e8e71803266a4987154a07f

                                                    SHA1

                                                    23df17af290bcf5db6ffd9d37e7a60df60bc8f77

                                                    SHA256

                                                    1e77a37ccc54d7a956f22406f7feb41f1927bb55259b4eddf9afbd48d3f3dccc

                                                    SHA512

                                                    984ceb2fa3769edc62a57037f47eeba61bba2f55a68d90cf3a0f7e70437fe8cb0f637a342f4b36a879e7fdb9b737e9d5fe72a597382af63edadf5ea2e7d29296

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cap302fm.3oz.ps1
                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\a11a0f68-86ec-43eb-bda9-fd3f4f388412.vbs
                                                    Filesize

                                                    491B

                                                    MD5

                                                    3381eb4ac6030945856aa542ad0ee990

                                                    SHA1

                                                    5eae01b552356c4861121064f6f1577ec819921f

                                                    SHA256

                                                    becfc1a9ae6b94a58b73989615f4d6836ed49f5de3ec84094a07d19b9feae712

                                                    SHA512

                                                    015b1913b7d2a8e2aa0b5ef6366c9572a4f2e47aaaf63912fc5b7df59560e78c5f5d4c884ad82f0a09bd9ac6b338b9ad6763f0d8e8704a5424f82214e09215d3

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\e359c3ad-4f0d-4e3e-b136-5283420ff421.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    2f47becc33ffe845f954e770a51ad0c7

                                                    SHA1

                                                    39c4db2f292be9d346bc1b5aec7cd63f425fdd94

                                                    SHA256

                                                    14f9603d8cf9924f49b146358ea4d53fdaaade2466b02de96b3ca6346e5f8f06

                                                    SHA512

                                                    00eb02c393e950a2515034373c20cb6ae1d2d9d8a9fdcb198f42436c42015ebbe073aca5276db7894a4681b8308bb9cb38f9280e0b0370abcea80f27d2f26db6

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\f15ca78e-6e6b-4179-80ae-d0d10831ca52.vbs
                                                    Filesize

                                                    715B

                                                    MD5

                                                    2f51008a15f9cd9c8435ed3e8f6a1d37

                                                    SHA1

                                                    eca40ab79e1d38ac6b29a89006c3d49f94973817

                                                    SHA256

                                                    dff63281f53ec67e85e430606ca5f2125556d9f9bbadb228392293dd6a0fc1c1

                                                    SHA512

                                                    2bd38c4ba5b2e8dbc888e46e85152c02cb57b03272e8e57e545ec1dbf2bc542da03523a3493bb4d824d3ee5d15f62fe3d6a0f885c28e3d9a37a194fa92188236

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\fbc0e9b2-a42a-4a46-bb2f-2efc557729a1.vbs
                                                    Filesize

                                                    714B

                                                    MD5

                                                    07a7855af8f390c9be31b5522e9e460a

                                                    SHA1

                                                    b878281b71b27fde8099455cc1feb45a1c545c6d

                                                    SHA256

                                                    129427bf0b1b1bad6b5006639f3dbda9e03e64819b2c4a6a46256cf0f86dfc9e

                                                    SHA512

                                                    e5f5dfaea532ae58a6af4efd033ba77939b7630a39e893dfa9d2a9f7b39f03ce949ff88184e93d8a765c21c9c8b3a4780cc4475bb304b9460faed30a688b2395

                                                    Download Submit

                                                  • C:\Windows\System32\pscript\winlogon.exe
                                                    Filesize

                                                    1.5MB

                                                    MD5

                                                    7b45d565ba6ca684897302d0eefc4b60

                                                    SHA1

                                                    5a48de7a66d4d2b46d296a9049dbe8f61b401989

                                                    SHA256

                                                    69b86941727bc8b758648b00a55e606f5e9efec117681a7a392d9fc669a55274

                                                    SHA512

                                                    6b770cc9b06f8295bd2dc1d8f5d52c4ff60d0db36baa44511dc960886f0f3670a92c23bab570f14b22aae87f47a5466ce89a1a85032d1dae40bd3da1714284c9

                                                    Download Submit

                                                  • memory/292-120-0x0000020E54A90000-0x0000020E54AB2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/900-184-0x000000001CD40000-0x000000001CD52000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/1056-12-0x000000001BCF0000-0x000000001BCF8000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/1056-2-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/1056-0-0x00007FFCE6AF3000-0x00007FFCE6AF5000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/1056-21-0x000000001BD70000-0x000000001BD78000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/1056-172-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/1056-20-0x000000001BD60000-0x000000001BD6C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/1056-18-0x000000001BD50000-0x000000001BD58000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/1056-17-0x000000001BD40000-0x000000001BD4C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/1056-36-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/1056-16-0x000000001BD30000-0x000000001BD38000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/1056-15-0x000000001BD20000-0x000000001BD2A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/1056-14-0x000000001BD10000-0x000000001BD1C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/1056-13-0x000000001BD00000-0x000000001BD0A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/1056-24-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/1056-7-0x0000000003300000-0x000000000330C000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/1056-10-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/1056-9-0x000000001BCC0000-0x000000001BCCC000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/1056-8-0x000000001BCA0000-0x000000001BCA8000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/1056-11-0x000000001BCE0000-0x000000001BCF0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/1056-6-0x00000000032E0000-0x00000000032EA000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/1056-5-0x00000000032F0000-0x00000000032FC000-memory.dmp

                                                    Filesize

                                                    48KB

                                                    Download

                                                  • memory/1056-3-0x0000000001A10000-0x0000000001A18000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/1056-1-0x0000000000FD0000-0x000000000114E000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1056-4-0x0000000001A20000-0x0000000001A32000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/1056-25-0x00007FFCE6AF0000-0x00007FFCE75B1000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                    Download

                                                  • memory/2824-307-0x000000001C9F0000-0x000000001CA02000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/4004-350-0x000000001B9F0000-0x000000001BA02000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/4292-319-0x000000001ADF0000-0x000000001AE02000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download