dcrat | 3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2025 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinPerfcommon.exe
Size

1.9MB
MD5

6b9554367a439d39a00a0dff9a08b123
SHA1

e1d22cde90c297c10f4fcba5b3980e5d551eb0b3
SHA256

3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9
SHA512

72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720
SSDEEP

49152:xh0kcmcdp/caMMlawkBXRInaKYRouPbWGQ2:xhbcmcfM/N1RSavoujWH

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\dllhost.exe\", \"C:\\Users\\Public\\Videos\\spoolsv.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\dllhost.exe\", \"C:\\Users\\Public\\Videos\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\dllhost.exe\", \"C:\\Users\\Public\\Videos\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\lsass.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\dllhost.exe\", \"C:\\Users\\Public\\Videos\\spoolsv.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\lsass.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3292	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4872	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2824	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4164	436	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	436	schtasks.exe	82

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3588	powershell.exe
2548	powershell.exe
2632	powershell.exe
4892	powershell.exe
3376	powershell.exe
5072	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WinPerfcommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	spoolsv.exe

Executes dropped EXE 13 IoCs

pid	Process
2452	spoolsv.exe
3536	spoolsv.exe
3224	spoolsv.exe
4128	spoolsv.exe
2044	spoolsv.exe
1560	spoolsv.exe
4948	spoolsv.exe
1604	spoolsv.exe
4996	spoolsv.exe
4128	spoolsv.exe
3712	spoolsv.exe
448	spoolsv.exe
4568	spoolsv.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Public\\Videos\\spoolsv.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\lsass.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Public\\Videos\\spoolsv.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\wininit.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\1.3.147.37\\lsass.exe\""	WinPerfcommon.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC3FDD099DAA414D86B017D1FC8DF3A.TMP	csc.exe
File created	\??\c:\Windows\System32\ljh0xx.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\lsass.exe	WinPerfcommon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\lsass.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\6203df4a6bafc7	WinPerfcommon.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\56085415360792	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe	WinPerfcommon.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\5940a34987c991	WinPerfcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4536	PING.EXE
2572	PING.EXE
3360	PING.EXE
1380	PING.EXE
2472	PING.EXE
3504	PING.EXE
3908	PING.EXE
3348	PING.EXE
2636	PING.EXE
4868	PING.EXE
4752	PING.EXE

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	WinPerfcommon.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	spoolsv.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
1380	PING.EXE
3908	PING.EXE
4868	PING.EXE
3360	PING.EXE
2472	PING.EXE
2636	PING.EXE
3504	PING.EXE
4752	PING.EXE
4536	PING.EXE
2572	PING.EXE
3348	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2452	schtasks.exe
2796	schtasks.exe
2216	schtasks.exe
2980	schtasks.exe
2824	schtasks.exe
3292	schtasks.exe
1960	schtasks.exe
2116	schtasks.exe
3408	schtasks.exe
4872	schtasks.exe
4884	schtasks.exe
1544	schtasks.exe
5060	schtasks.exe
4624	schtasks.exe
1404	schtasks.exe
2252	schtasks.exe
1116	schtasks.exe
4164	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe
3308	WinPerfcommon.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	WinPerfcommon.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	2548	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2452	spoolsv.exe
Token: SeDebugPrivilege	3536	spoolsv.exe
Token: SeDebugPrivilege	3224	spoolsv.exe
Token: SeDebugPrivilege	4128	spoolsv.exe
Token: SeDebugPrivilege	2044	spoolsv.exe
Token: SeDebugPrivilege	1560	spoolsv.exe
Token: SeDebugPrivilege	4948	spoolsv.exe
Token: SeDebugPrivilege	1604	spoolsv.exe
Token: SeDebugPrivilege	4996	spoolsv.exe
Token: SeDebugPrivilege	4128	spoolsv.exe
Token: SeDebugPrivilege	3712	spoolsv.exe
Token: SeDebugPrivilege	448	spoolsv.exe
Token: SeDebugPrivilege	4568	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 216	3308	WinPerfcommon.exe	86
PID 3308 wrote to memory of 216	3308	WinPerfcommon.exe	86
PID 216 wrote to memory of 2028	216	csc.exe	88
PID 216 wrote to memory of 2028	216	csc.exe	88
PID 3308 wrote to memory of 2632	3308	WinPerfcommon.exe	104
PID 3308 wrote to memory of 2632	3308	WinPerfcommon.exe	104
PID 3308 wrote to memory of 2548	3308	WinPerfcommon.exe	105
PID 3308 wrote to memory of 2548	3308	WinPerfcommon.exe	105
PID 3308 wrote to memory of 3588	3308	WinPerfcommon.exe	106
PID 3308 wrote to memory of 3588	3308	WinPerfcommon.exe	106
PID 3308 wrote to memory of 5072	3308	WinPerfcommon.exe	107
PID 3308 wrote to memory of 5072	3308	WinPerfcommon.exe	107
PID 3308 wrote to memory of 4892	3308	WinPerfcommon.exe	108
PID 3308 wrote to memory of 4892	3308	WinPerfcommon.exe	108
PID 3308 wrote to memory of 3376	3308	WinPerfcommon.exe	109
PID 3308 wrote to memory of 3376	3308	WinPerfcommon.exe	109
PID 3308 wrote to memory of 1476	3308	WinPerfcommon.exe	116
PID 3308 wrote to memory of 1476	3308	WinPerfcommon.exe	116
PID 1476 wrote to memory of 4388	1476	cmd.exe	118
PID 1476 wrote to memory of 4388	1476	cmd.exe	118
PID 1476 wrote to memory of 4536	1476	cmd.exe	119
PID 1476 wrote to memory of 4536	1476	cmd.exe	119
PID 1476 wrote to memory of 2452	1476	cmd.exe	126
PID 1476 wrote to memory of 2452	1476	cmd.exe	126
PID 2452 wrote to memory of 224	2452	spoolsv.exe	127
PID 2452 wrote to memory of 224	2452	spoolsv.exe	127
PID 224 wrote to memory of 4244	224	cmd.exe	129
PID 224 wrote to memory of 4244	224	cmd.exe	129
PID 224 wrote to memory of 2572	224	cmd.exe	130
PID 224 wrote to memory of 2572	224	cmd.exe	130
PID 224 wrote to memory of 3536	224	cmd.exe	131
PID 224 wrote to memory of 3536	224	cmd.exe	131
PID 3536 wrote to memory of 1456	3536	spoolsv.exe	133
PID 3536 wrote to memory of 1456	3536	spoolsv.exe	133
PID 1456 wrote to memory of 4568	1456	cmd.exe	135
PID 1456 wrote to memory of 4568	1456	cmd.exe	135
PID 1456 wrote to memory of 3348	1456	cmd.exe	136
PID 1456 wrote to memory of 3348	1456	cmd.exe	136
PID 1456 wrote to memory of 3224	1456	cmd.exe	138
PID 1456 wrote to memory of 3224	1456	cmd.exe	138
PID 3224 wrote to memory of 4528	3224	spoolsv.exe	139
PID 3224 wrote to memory of 4528	3224	spoolsv.exe	139
PID 4528 wrote to memory of 4200	4528	cmd.exe	141
PID 4528 wrote to memory of 4200	4528	cmd.exe	141
PID 4528 wrote to memory of 3360	4528	cmd.exe	142
PID 4528 wrote to memory of 3360	4528	cmd.exe	142
PID 4528 wrote to memory of 4128	4528	cmd.exe	143
PID 4528 wrote to memory of 4128	4528	cmd.exe	143
PID 4128 wrote to memory of 4276	4128	spoolsv.exe	144
PID 4128 wrote to memory of 4276	4128	spoolsv.exe	144
PID 4276 wrote to memory of 4376	4276	cmd.exe	146
PID 4276 wrote to memory of 4376	4276	cmd.exe	146
PID 4276 wrote to memory of 1380	4276	cmd.exe	147
PID 4276 wrote to memory of 1380	4276	cmd.exe	147
PID 4276 wrote to memory of 2044	4276	cmd.exe	148
PID 4276 wrote to memory of 2044	4276	cmd.exe	148
PID 2044 wrote to memory of 408	2044	spoolsv.exe	149
PID 2044 wrote to memory of 408	2044	spoolsv.exe	149
PID 408 wrote to memory of 3692	408	cmd.exe	151
PID 408 wrote to memory of 3692	408	cmd.exe	151
PID 408 wrote to memory of 2472	408	cmd.exe	152
PID 408 wrote to memory of 2472	408	cmd.exe	152
PID 408 wrote to memory of 1560	408	cmd.exe	153
PID 408 wrote to memory of 1560	408	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe
"C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\strxlbci\strxlbci.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC0CF.tmp" "c:\Windows\System32\CSC3FDD099DAA414D86B017D1FC8DF3A.TMP"
    3⤵
    PID:2028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xygocHtpsh.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4388
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4536
- - C:\Users\Public\Videos\spoolsv.exe
    "C:\Users\Public\Videos\spoolsv.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4op7oIQpKO.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4244
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2572
    - - C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3536
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8WJVGZPNu9.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3348
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0KEJuvYQ32.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4200
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3360
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m3jNUitKc7.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1380
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3692
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2472
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bjcQ5hKx2L.bat"
        14⤵
        
        PID:4668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3232
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3000
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4948
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tuGXyMaJvX.bat"
        16⤵
        
        PID:2696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:4684
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2636
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat"
        18⤵
        
        PID:1572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3504
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EMqflE6MDZ.bat"
        20⤵
        
        PID:3464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3700
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:1140
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tuGXyMaJvX.bat"
        22⤵
        
        PID:3260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:2252
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3908
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Qwmke0eayG.bat"
        24⤵
        
        PID:4512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:2316
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\k9Xkw6Am4N.bat"
        26⤵
        
        PID:4580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4868
        
        C:\Users\Public\Videos\spoolsv.exe
        
        "C:\Users\Public\Videos\spoolsv.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4568
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AzylF6O5Hz.bat"
        28⤵
        
        PID:4388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:2668
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommon" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\csrss.exe

Filesize
1.9MB

MD5
6b9554367a439d39a00a0dff9a08b123

SHA1
e1d22cde90c297c10f4fcba5b3980e5d551eb0b3

SHA256
3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

SHA512
72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log

Filesize
1KB

MD5
935ecb30a8e13f625a9a89e3b0fcbf8f

SHA1
41cb046b7b5f89955fd53949efad8e9f3971d731

SHA256
2a7b829afe6a140bb37d24cc7711749c20cdaaf9cc7c4a182ff081180b4d99e9

SHA512
1210281612b0101ce63555a1a7855589ff68e1eac5b8a2461e10808c5b92c5dd111be72406c2923a94e10b687ceda43dc24d8c22a49dab40a4af793ee6b740aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
240B

MD5
5030a7256befbf8b35a8832532e8a02c

SHA1
41d91c3f137b4b2679e639db31fd6ed4b51db388

SHA256
53e00338288af96b9add3c13555d584ef8a5a04a2bae4f58c9423757d753f703

SHA512
b9f685bacdbf81bf0c1924536ed3918bda01bac1d61511934f5bd8d76e2f71813fed53f1db59d79b68e827547385d4bcff8cb4c703a955470d194c101b6ee867

Download Submit
C:\Users\Admin\AppData\Local\Temp\0KEJuvYQ32.bat

Filesize
162B

MD5
e9847026728e2693be3865a8f10ea3fe

SHA1
5421a36cd1adfadbeba9a5ed6b64536ffc889c4d

SHA256
6505a5b0e6623ec87a495abe8742333748e998f3c72865c08343407c68c1a49f

SHA512
61de650a69f8d03588d1dfe99f5cd92b3d357d874d2a10f90089cc5dea2b487812ada08b34a45d6f2863190a1e195b3fbac3c208545f95e848c25606b97ce071

Download Submit
C:\Users\Admin\AppData\Local\Temp\4op7oIQpKO.bat

Filesize
162B

MD5
906efeb2ca53e5a1a6d6f57ac388c67f

SHA1
8415a81a41927aaae3078c85b52753db1082db0c

SHA256
ab83adbabead99cd81afb513a37ee24c027af7b2b435b95047b46c21a4a6f0f2

SHA512
a76045aebb5cdf580c5d445d84afc9f66ea4b0c61be9563e13f8cefac160f1747656fb37535ac0024c6ffddcae94d1a02fed3adce33433955cdebce146c4ae39

Download Submit
C:\Users\Admin\AppData\Local\Temp\8WJVGZPNu9.bat

Filesize
162B

MD5
dcf793433645706cbbe6c0a79604a364

SHA1
cb9b70616ecc782cee72db97add326572869bc52

SHA256
6576520f068251c0c83621d2b533ee00517fda93a7e6a85d58a1afe365b0918e

SHA512
ad27ff5efbc2a4750970de2025cc4f7617802eff51cfa8fb9595c99a2a5dae0e93e09cc1e427f96c134073a0851d0e94de4d933ac75f57585168d27fdc212416

Download Submit
C:\Users\Admin\AppData\Local\Temp\AeLHIw7ndo.bat

Filesize
162B

MD5
3d392530fbcd6c75f7a578a6c046c62c

SHA1
0927b2d18ee799d492b95e79199c78fc55f211ec

SHA256
daf1deb294ce46e2ff721c0d23442fde1ee0b48b8584d22307e6333a028e4145

SHA512
f5543bb2cf5c6ce7a10f12c9475e5104e7ab9f0c643f4071000c820d73342f8218b980a2ad5951094e478d241d17ba7bbc358e0ce1089b64d4b9c38c8fc0db72

Download Submit
C:\Users\Admin\AppData\Local\Temp\AzylF6O5Hz.bat

Filesize
162B

MD5
1c682cf1458eb2ecfc88cd4a900fb8e5

SHA1
6fa618d90f69ca8a6fbdcc6951e85c38600f479a

SHA256
9df1829c6c6e72bc607d20fb9de02c0aab649cea8fac692aa09c9a2b9ce4e77f

SHA512
f7005119ca127c61bd6e7154bb7809a422ec162311fdb547d92536a737f9080615eed7c2e326dc930e1c9a3131869d7bea515b07cf0632cfa671fc8d0cbdffd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\EMqflE6MDZ.bat

Filesize
210B

MD5
628ddfbf135a5621c92f1bfe8a375ebb

SHA1
7c5cbaa79a95d606415255c8e99a4f636632a6e7

SHA256
1d96dd7b280b1b994b7387c2d84852a91c3b7eec5675aebb30f3dc4a22b4a98f

SHA512
d0db7297692df17425ebd05766c928c50deb9d682df6cf7af37ede1404177be8accc321e9467f14c092f0cfeac79e55f06facccccaecfb5d6dbe54270c3a6cdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qwmke0eayG.bat

Filesize
210B

MD5
462c038b3f8716f12ae039896f2cfbfc

SHA1
cc10fb2604c3b26e2e270a6dbd0c68bd3f503af4

SHA256
237253a17bbc10e33299971ad80980c399c8355a9ec877e82b916bd72a2ec460

SHA512
418041c1e41e40f6e6772301fd79d6f51d429ca8b0e3077f33007647a6e4d502a361ee11c89d0b647eab39a15dc81e5dfb7948dad950118b56b5f5492d1e7b08

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC0CF.tmp

Filesize
1KB

MD5
e6cd5be2d442a38c6e71a54972bd0cf3

SHA1
3e254e95f3e8cc72ecdbaf17a243ba51d58e6e07

SHA256
6fc7b9ddd89343234147fdd506bde76c5fa26790c3a622e2bf55ab896ae0cfc3

SHA512
a12dda02a566926e2d3af3d1d57087b3b7dc48f185c880e30130bca257714299d2d730dbe2866a6e03b7594132e57982f63614357decf8c6bea60ff41fd85c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5mftvdhp.yty.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bjcQ5hKx2L.bat

Filesize
210B

MD5
62d9985709a02ed1170c4aa7a1af3556

SHA1
f218e62f72ca53752ec347e8ebb075b31193b6fc

SHA256
8fa28518abae4598ec9bec43795e5988fb815924903eca16b9e78b564c44d9af

SHA512
59d6b1b52d6208840dda69e9ec808a4f1978cb8aff6f015719386cea3c87eb1b2dabeffad1261afc06150237de64f70b97876d472ec618fa1bd2bb7f6a04d93d

Download Submit
C:\Users\Admin\AppData\Local\Temp\k9Xkw6Am4N.bat

Filesize
162B

MD5
3de207151317b373066b283003d9dfc3

SHA1
a5c92accf5708d8bde9294c476be7f321bc462b4

SHA256
48c97f57003eac4e6c2dc7da1f45d75e6d360e4d509d1d56bb27ce88801e27c0

SHA512
bfd4c223a8461a3692d761bfc747f088c7b0222fcd219a9307fd47071cad1417886f03de1597b79d5ce5e47eafe0243a40583457f2bf23f9d2d6ea7389175168

Download Submit
C:\Users\Admin\AppData\Local\Temp\m3jNUitKc7.bat

Filesize
162B

MD5
3c026bc7b08d1107e3a86dacdd258ab4

SHA1
4dcde2856a1ead29ac6694d50cfd047f7df83dcd

SHA256
d90f723571f254aecc83f1a16200acf7eb722f57f6f7e1033e830eafb172478a

SHA512
2c273623a33e935199b646826a8d72e59dae5a6eae371bfd56b09ebf2a47057a3f28152ba0ab7aa805b1d756cdfc298e72179f5d639b17f356bc7a96bacc4976

Download Submit
C:\Users\Admin\AppData\Local\Temp\tuGXyMaJvX.bat

Filesize
162B

MD5
9233ddc9b362d67e365a8beb4f8e8bc5

SHA1
89523e3afc5144821631b56a691acbce28bde5d6

SHA256
acbb11d566d8b26818af1ded7f54dd7f832d1b3e80af788e52e6e800c9d54de6

SHA512
a2d0c621ee13294d03246183a94518569bfd666925ceb00d91d578a9564784a165f779007491274fadae04bfb52da97a9c8d492db3352bf53ba06bc088e0d286

Download Submit
C:\Users\Admin\AppData\Local\Temp\xygocHtpsh.bat

Filesize
162B

MD5
92bd2a57a918a867e3e11ff88cd0d0c9

SHA1
f34bdafc3a683061fa46f48a12131463c388fe89

SHA256
3e8c9c902a6bd2afbcbf492c64e0e38e224008309bf9e8a48a6f08eea7241171

SHA512
a885ce8d7c885c92b3cf5b00957789b42875867fefc351dccd54bf16215e9c444172c6c606a4be20a48d889d3f7c1768e00d0e8b341d3a4241b394dda4305fd7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\strxlbci\strxlbci.0.cs

Filesize
363B

MD5
7908461a3519b72b00f06dbba1e6e3a2

SHA1
3c4cf7cb4eadac4522f8a3f27f9b3a837d9a6fe0

SHA256
467f46b8b3c7b45d90e622e50a22df133f2ed1a2f9c995971aff93ccb576228e

SHA512
d562b114dab11333e3415e7c0aec1219dcde68067f1bbf6e4386b0d79d7b04155a33669eb7dbcdffd58cf868bc0f37f1b3ff2fe7c63016080918ed61d290db80

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\strxlbci\strxlbci.cmdline

Filesize
235B

MD5
1462062e30ede767348b9d60e4355871

SHA1
04b180b23c091fcc4269bb7c4357a9a690e0b1b3

SHA256
7ae46b358e114b2c226e46ce0b49d34d11086b88eb7a3b2c3f242ca2e573bb99

SHA512
8d69f0fa75d9d2908ce61b3c8539f74bbacad17b416c9c07c6c96beb07a121039625f3e56eec7e6f1394a4482b48b99c666919befa17184d2aef0f609805939c

Download Submit
\??\c:\Windows\System32\CSC3FDD099DAA414D86B017D1FC8DF3A.TMP

Filesize
1KB

MD5
2fd2b90e7053b01e6af25701a467eb1f

SHA1
68801a13cebba82c24f67a9d7c886fcefcf01a51

SHA256
12b900db56a20f01f0f1d65f46933971415d5b5675e59e8b02b3dae12aaa1527

SHA512
081d3a621e3664709867f3fdd82808364978f896fb007c0c8e6c8dfe25f2f2b8d37c9e0b2e4fb51c90bc6f691507b569e5d841ef3ca3bd38bd6adda2d30f32af

Download Submit
memory/3308-15-0x00000000029B0000-0x00000000029BC000-memory.dmp

Filesize
48KB

Download
memory/3308-0-0x00007FFD9C523000-0x00007FFD9C525000-memory.dmp

Filesize
8KB

Download
memory/3308-39-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-38-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-1-0x0000000000690000-0x0000000000884000-memory.dmp

Filesize
2.0MB

Download
memory/3308-83-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-31-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-22-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-21-0x0000000002A20000-0x0000000002A2C000-memory.dmp

Filesize
48KB

Download
memory/3308-19-0x0000000002A10000-0x0000000002A1E000-memory.dmp

Filesize
56KB

Download
memory/3308-17-0x00000000029C0000-0x00000000029CC000-memory.dmp

Filesize
48KB

Download
memory/3308-42-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-13-0x00000000029F0000-0x0000000002A08000-memory.dmp

Filesize
96KB

Download
memory/3308-11-0x000000001B430000-0x000000001B480000-memory.dmp

Filesize
320KB

Download
memory/3308-10-0x00000000029D0000-0x00000000029EC000-memory.dmp

Filesize
112KB

Download
memory/3308-8-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-7-0x0000000002990000-0x000000000299E000-memory.dmp

Filesize
56KB

Download
memory/3308-5-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-4-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-3-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/3308-2-0x00007FFD9C520000-0x00007FFD9CFE1000-memory.dmp

Filesize
10.8MB

Download
memory/4892-64-0x0000023A34610000-0x0000023A34632000-memory.dmp

Filesize
136KB

Download