dcrat | 11d8980ca6e1f41a7ede9bf1aca61638bbf024ac1a38eb4b0424f6dbc79d991d

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Size

1.9MB
MD5

6b9554367a439d39a00a0dff9a08b123
SHA1

e1d22cde90c297c10f4fcba5b3980e5d551eb0b3
SHA256

3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9
SHA512

72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720
SSDEEP

49152:xh0kcmcdp/caMMlawkBXRInaKYRouPbWGQ2:xhbcmcfM/N1RSavoujWH

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\spoolsv.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\spoolsv.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhostw.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\spoolsv.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhostw.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\spoolsv.exe\", \"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhostw.exe\", \"C:\\Users\\Default User\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3288	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3428	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4684	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	264	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	4220	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	4220	schtasks.exe	83

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1824	powershell.exe
4576	powershell.exe
3988	powershell.exe
4896	powershell.exe
2268	powershell.exe
3828	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\spoolsv.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\spoolsv.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhostw.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Mozilla Firefox\\fonts\\taskhostw.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Default User\\RuntimeBroker.exe\""	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC94EC12679CE341FEBD4CC78C6C19127F.TMP	csc.exe
File created	\??\c:\Windows\System32\hnaorh.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\fonts\taskhostw.exe	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
File created	C:\Program Files\Mozilla Firefox\fonts\ea9f0e6c9e2dcd	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
File created	C:\Program Files (x86)\Microsoft\Edge\spoolsv.exe	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
File created	C:\Program Files (x86)\Microsoft\Edge\f3b6ecef712a24	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3288	PING.EXE
5116	PING.EXE
4548	PING.EXE
4748	PING.EXE
3656	PING.EXE
2552	PING.EXE
4456	PING.EXE
4608	PING.EXE
3912	PING.EXE
1712	PING.EXE

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1712	PING.EXE
3288	PING.EXE
4748	PING.EXE
3656	PING.EXE
2552	PING.EXE
3912	PING.EXE
5116	PING.EXE
4548	PING.EXE
4456	PING.EXE
4608	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1508	schtasks.exe
3008	schtasks.exe
752	schtasks.exe
4700	schtasks.exe
4692	schtasks.exe
4320	schtasks.exe
3428	schtasks.exe
1712	schtasks.exe
3416	schtasks.exe
960	schtasks.exe
264	schtasks.exe
1840	schtasks.exe
1820	schtasks.exe
3116	schtasks.exe
4684	schtasks.exe
3288	schtasks.exe
4512	schtasks.exe
3752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	116	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	3916	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	1380	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	3816	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	220	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	620	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	5100	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	4720	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	4188	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	3188	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	3924	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	2448	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	2408	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
Token: SeDebugPrivilege	2248	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1392	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	87
PID 1528 wrote to memory of 1392	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	87
PID 1392 wrote to memory of 3228	1392	csc.exe	89
PID 1392 wrote to memory of 3228	1392	csc.exe	89
PID 1528 wrote to memory of 4576	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	105
PID 1528 wrote to memory of 4576	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	105
PID 1528 wrote to memory of 1824	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	106
PID 1528 wrote to memory of 1824	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	106
PID 1528 wrote to memory of 3828	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	107
PID 1528 wrote to memory of 3828	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	107
PID 1528 wrote to memory of 2268	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	108
PID 1528 wrote to memory of 2268	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	108
PID 1528 wrote to memory of 4896	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	109
PID 1528 wrote to memory of 4896	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	109
PID 1528 wrote to memory of 3988	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	110
PID 1528 wrote to memory of 3988	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	110
PID 1528 wrote to memory of 4416	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	117
PID 1528 wrote to memory of 4416	1528	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	117
PID 4416 wrote to memory of 3104	4416	cmd.exe	119
PID 4416 wrote to memory of 3104	4416	cmd.exe	119
PID 4416 wrote to memory of 3288	4416	cmd.exe	120
PID 4416 wrote to memory of 3288	4416	cmd.exe	120
PID 4416 wrote to memory of 116	4416	cmd.exe	128
PID 4416 wrote to memory of 116	4416	cmd.exe	128
PID 116 wrote to memory of 1196	116	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	134
PID 116 wrote to memory of 1196	116	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	134
PID 1196 wrote to memory of 3796	1196	cmd.exe	136
PID 1196 wrote to memory of 3796	1196	cmd.exe	136
PID 1196 wrote to memory of 4748	1196	cmd.exe	137
PID 1196 wrote to memory of 4748	1196	cmd.exe	137
PID 1196 wrote to memory of 3916	1196	cmd.exe	139
PID 1196 wrote to memory of 3916	1196	cmd.exe	139
PID 3916 wrote to memory of 4344	3916	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	142
PID 3916 wrote to memory of 4344	3916	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	142
PID 4344 wrote to memory of 3828	4344	cmd.exe	144
PID 4344 wrote to memory of 3828	4344	cmd.exe	144
PID 4344 wrote to memory of 3656	4344	cmd.exe	145
PID 4344 wrote to memory of 3656	4344	cmd.exe	145
PID 4344 wrote to memory of 1380	4344	cmd.exe	150
PID 4344 wrote to memory of 1380	4344	cmd.exe	150
PID 1380 wrote to memory of 4884	1380	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	153
PID 1380 wrote to memory of 4884	1380	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	153
PID 4884 wrote to memory of 1352	4884	cmd.exe	155
PID 4884 wrote to memory of 1352	4884	cmd.exe	155
PID 4884 wrote to memory of 2552	4884	cmd.exe	156
PID 4884 wrote to memory of 2552	4884	cmd.exe	156
PID 4884 wrote to memory of 3816	4884	cmd.exe	158
PID 4884 wrote to memory of 3816	4884	cmd.exe	158
PID 3816 wrote to memory of 4188	3816	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	161
PID 3816 wrote to memory of 4188	3816	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	161
PID 4188 wrote to memory of 2496	4188	cmd.exe	163
PID 4188 wrote to memory of 2496	4188	cmd.exe	163
PID 4188 wrote to memory of 3104	4188	cmd.exe	164
PID 4188 wrote to memory of 3104	4188	cmd.exe	164
PID 4188 wrote to memory of 220	4188	cmd.exe	166
PID 4188 wrote to memory of 220	4188	cmd.exe	166
PID 220 wrote to memory of 2400	220	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	168
PID 220 wrote to memory of 2400	220	3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe	168
PID 2400 wrote to memory of 3388	2400	cmd.exe	170
PID 2400 wrote to memory of 3388	2400	cmd.exe	170
PID 2400 wrote to memory of 5116	2400	cmd.exe	171
PID 2400 wrote to memory of 5116	2400	cmd.exe	171
PID 2400 wrote to memory of 620	2400	cmd.exe	173
PID 2400 wrote to memory of 620	2400	cmd.exe	173

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
"C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\44k4a3w1\44k4a3w1.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7465.tmp" "c:\Windows\System32\CSC94EC12679CE341FEBD4CC78C6C19127F.TMP"
    3⤵
    PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\fonts\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i7eBtVP5zJ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3104
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
    "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SScKKiGWPN.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1196
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3796
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        5⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3916
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5kD435lcwQ.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3828
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        7⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AhXa08j1h6.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1352
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        9⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xtlNdaBxkU.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        11⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cRBFrjfuSR.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3388
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        13⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hNUloleJD7.bat"
        14⤵
        
        PID:5036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        15⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qTmai1Dpby.bat"
        16⤵
        
        PID:968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        17⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6KfhU02lmW.bat"
        18⤵
        
        PID:4488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        19⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NVJoNfH6eh.bat"
        20⤵
        
        PID:3376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:216
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        21⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nLkpgeVQrJ.bat"
        22⤵
        
        PID:1068
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:2996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        23⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DqZM2URRQk.bat"
        24⤵
        
        PID:1784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:3432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        25⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HY3kVmQ00V.bat"
        26⤵
        
        PID:2976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        27⤵
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hNUloleJD7.bat"
        28⤵
        
        PID:3816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe"
        29⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\Edge\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\fonts\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a93" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a93" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\RuntimeBroker.exe

Filesize
1.9MB

MD5
6b9554367a439d39a00a0dff9a08b123

SHA1
e1d22cde90c297c10f4fcba5b3980e5d551eb0b3

SHA256
3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

SHA512
72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9.exe.log

Filesize
1KB

MD5
af6acd95d59de87c04642509c30e81c1

SHA1
f9549ae93fdb0a5861a79a08f60aa81c4b32377b

SHA256
7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

SHA512
93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Temp\5kD435lcwQ.bat

Filesize
230B

MD5
f7b3b6ac31bcbea1576ab48f2d39de75

SHA1
109f94b5d5589df944ba529fe8ab8fe0505c5678

SHA256
d216a334df7c37e6a1903f98241c5acb26bdb4ba182c9b1da9cb8102cf852ea6

SHA512
380af574af358bc11a139f6019077580e1f72da0268bf20dd84847f15440e9a6aa6ae6c268889d81348255e1b79c1ca577495414447db7883413ff0e893e8ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6KfhU02lmW.bat

Filesize
278B

MD5
61ec676859c92cee4203c6d73bf73443

SHA1
191e82cc6468ac4bd28b0a23654c4dffc0b03657

SHA256
5f6b8c69306df5c903855e2d1b1536083e8a16c20a356e29720805bbdb426235

SHA512
f6db108f63df5ebf28b8c6e920fb8b99e08c8a89250d36ab16b66f7e9407741454b2a4ac7f89da67fb7cd6e131ff7e0121220ba16881eea82c5a9ea56541a205

Download Submit
C:\Users\Admin\AppData\Local\Temp\AhXa08j1h6.bat

Filesize
230B

MD5
38a2be6a89a273976ec12799365cac8c

SHA1
d40bf0709ea057505b2bbb67d01dcb4b10aa6871

SHA256
4ce16a8bcf1e5e1441b1378a5f278606e46f3ad02575b5e3b1e9a561f7b57a57

SHA512
8124230188b72f105d214df845979cea5ad02cc700355d519d88fdbf3bbe27eb0571c4c0220137e8c381d2ace0f38273fb41dfe3051c447c32ef9c84889daa04

Download Submit
C:\Users\Admin\AppData\Local\Temp\DqZM2URRQk.bat

Filesize
230B

MD5
5c5b9acf2367dfcce28ef8461c43b857

SHA1
e14c508d46ec06fc64e7cc4d5858f55efb3bef4b

SHA256
04f9ac75bc0c2c12ec36729600c722bb6c56aa6996bcbd04318359f94fc9ef2f

SHA512
e5588330a2bf8e557a3166b3e9dbae5998a7666b945618ec1d94a48a38fe50440a9c3325a5503a4aee780f7703680cf6029f29320626a76f54a1ef773c874039

Download Submit
C:\Users\Admin\AppData\Local\Temp\HY3kVmQ00V.bat

Filesize
230B

MD5
a4f9d4d350add8c8519d959d4433223f

SHA1
5ccc903e31dc0c8bf616991fad097075cd2686b0

SHA256
ab10494ef660a2242ad76db3ef6d1d994ab3a622bdf0592f88c2edcdb28443fc

SHA512
e01ebd81c0359f38668e940b22fde86d11ccc6be4b1c950bee02163d9f6437f6970144a4c20b217eea166933f678c752f7fe424648549d3b2c927ec3e352c4d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\NVJoNfH6eh.bat

Filesize
230B

MD5
4f5f40cce005cf145a84184f4c634c03

SHA1
d3794b15025de34b6bb57e5b28d935089fdd7260

SHA256
01314e4ef146048ff9f138f9182a962570cc884c85f7b65880a98b4d718ad4d2

SHA512
cd9b07d7a00dabd8fb219e0cba364c4f9ab85dd258684c91ea2ad87a15bfb9f811bcbc0a00f13842319ecf621bc88fe5373f32a69dae79d72d106756be2c0245

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7465.tmp

Filesize
1KB

MD5
43dbb9194ca69ab4e69863a73e8fb69f

SHA1
ffb5c8e1e06d6ce924de554a6851aeb76600fb6b

SHA256
a0deadd93dbc4f99634e808c853cb531ac6c2ce9c59bedd94bbcaedeca84179c

SHA512
a2dda4a220b4d7f1d7b746ddde253cdda5dcaabc2fd013336c2ded83162ad0fa63b4ea9952ef517ddd7fafdb3b92d4d74e7d729406bdd85a61d6a24e4357fe6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SScKKiGWPN.bat

Filesize
230B

MD5
05412ae45ac840be2ca9a648fc696051

SHA1
5595d980783369c97985eb65da710616e377c8fb

SHA256
932863dbc715ffae6cd857c355cc55c9c3821ba8789a49f3be7615008adcad06

SHA512
cc31e5a9d195ae3812261b3d8b03d9724eeb19780c290137019486890cac239e5dcc98c3d9053dd2688990c44d0ae76f826767b9cf46a107a2fc97dc0044a047

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2woejgzu.3em.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cRBFrjfuSR.bat

Filesize
230B

MD5
fd57989adb4f877c18649c569cf3fcfc

SHA1
9b23967ace3bed295a00bb13f3f0e4f9a989b505

SHA256
90d1b5ecb451199369dc12a819ea049f9ed245b915f54748b3955ee97ecb2825

SHA512
53e181fb5b9af9c172d11509f7d1f954d190c722fa97755cca6014bae5257b08036f5fa9eda83b9a554c4907863a30b8ead1844222013d1fd4600ff2a899ffc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hNUloleJD7.bat

Filesize
230B

MD5
2da79ded516862e0af58586d4e0249a4

SHA1
a09b6a9a979d007bf0df3249882ad637fb786a95

SHA256
5aa0459645f27db2969f2eacc643f1eaaa055e23a9a2dfeba6937ba61cb30ee7

SHA512
f107aeea1dcabbff217a754be6cd8138531f7bf74843aed4dbe38d3b12f541f50ea86618e5d6dc309e6f68f4a4a942a2cbd3e5c8506b80c0a4e0bd003ec73720

Download Submit
C:\Users\Admin\AppData\Local\Temp\i7eBtVP5zJ.bat

Filesize
230B

MD5
9b9686efdf0c45c991d319a5794db0f6

SHA1
13bd2c25cc9febacc63f2d75e1477b40e03969a4

SHA256
007e3b3aeb905100d920bbc8f37927bf858bd9bab8923b34d5c58855ba364d72

SHA512
c241ea9ca0c03c4c2f7690d73f35b02b29bdc08ac11f43546f180baf7a8c8e22279669cbbe8afd1e0f63b40cfc2d7821c0326c8d653d502cab496c160e295e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\nLkpgeVQrJ.bat

Filesize
278B

MD5
75693b3e0e8a9dd8d9b762912321087c

SHA1
4272f66255df12f220524fd13e3cf7c9d6b0e76c

SHA256
e5e434b183a95fcf64d38c36181759378d6fa438bc02c3482da53c9d9c2aabb7

SHA512
c5c56e7ee8f0886a5b9f4a125cfa71b2d157206da2eaddd70eb1f6d28071050508d52c1ad2dd4d7dde65d816122913aa01c07cd90ca8615c399eed5b8f260843

Download Submit
C:\Users\Admin\AppData\Local\Temp\qTmai1Dpby.bat

Filesize
278B

MD5
a5462250812c5ca5b1499789d1b888dd

SHA1
8a19faa696d85fb9f24943836e24e18eafbe7e36

SHA256
d9cdfcbd654d1264bbb195e6429f3b954c947ee1dfcce12edf6b59d85b29a551

SHA512
2042f80cc9831f58043786330cd28ebd513f90fb7d4a02c4daf7c12146ae8ddaca87324bfeb378bdd0427bf6ecc63aef31f65b941be742fc4cfda680741d224b

Download Submit
C:\Users\Admin\AppData\Local\Temp\xtlNdaBxkU.bat

Filesize
278B

MD5
a10a5957eb9fd7df8389f0ae3f49142b

SHA1
184ae7ffd95d54facbf89d876055e053f7ed1756

SHA256
f11b2f08edd2ef665f1adde8b75c01e10342c32cbf4d591eb28f920a09eb44c0

SHA512
ca978e39800dfb84ac07179ae4a088d0f06079bf2dcb20599de3b58550aa3f467532dc51e74cbd8b5c9b78ee3da4951235fba359329cfbdcee0c745ded36f163

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\44k4a3w1\44k4a3w1.0.cs

Filesize
371B

MD5
a80b5505f6f57840f5458e4186dddea7

SHA1
0e42217aa1c95adb4259d1bf9e0dab1129989663

SHA256
e9782dc46aaee3822af26213fd7fb613136129e179c5ab6f80c594f6f83ca5ca

SHA512
c94c1a8e58aa41b8ebf300389670f1ef69ac65c999e13030bae601abf0cbde34e0969f45829780fabf743f684b889fd5901be7d3d4d812d4cb71659b84f60f37

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\44k4a3w1\44k4a3w1.cmdline

Filesize
235B

MD5
fef54810eaae33a144026e993999eed0

SHA1
717379ddee35bec0afd08c69d297acebdc160c11

SHA256
de2a087d05cbd4ce4971c04e98610541fe13e7cfe57e4f7aae1dfbe350f741fa

SHA512
175c7948a10f4303fb2f559ed5cab29ea60ad92917ee3826b7b74211626eac129f505648d250c2ab6bfc3eb8697cf0503f75f9cf0f8c3ed4e4e5c944f1ee7988

Download Submit
\??\c:\Windows\System32\CSC94EC12679CE341FEBD4CC78C6C19127F.TMP

Filesize
1KB

MD5
65d5babddb4bd68783c40f9e3678613f

SHA1
71e76abb44dbea735b9faaccb8c0fad345b514f4

SHA256
d61a59849cacd91b8039a8e41a5b92a7f93e2d46c90791b9ba6b5f856008cd8f

SHA512
21223e9a32df265bb75093d1ebaa879880a947d25ac764f3452b9104893b05f2c8fe4150cb2465681df7a0554dcefdb7f623aaf54772ade878270f453ebc1bcf

Download Submit
memory/116-139-0x000000001CD00000-0x000000001CE6A000-memory.dmp

Filesize
1.4MB

Download
memory/1528-67-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-7-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-1-0x0000000000B90000-0x0000000000D84000-memory.dmp

Filesize
2.0MB

Download
memory/1528-37-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-39-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-36-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-33-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-23-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-22-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-21-0x000000001BA10000-0x000000001BA1C000-memory.dmp

Filesize
48KB

Download
memory/1528-15-0x0000000002F20000-0x0000000002F2C000-memory.dmp

Filesize
48KB

Download
memory/1528-0-0x00007FF91EF03000-0x00007FF91EF05000-memory.dmp

Filesize
8KB

Download
memory/1528-19-0x0000000002FA0000-0x0000000002FAE000-memory.dmp

Filesize
56KB

Download
memory/1528-2-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-17-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Filesize
48KB

Download
memory/1528-10-0x000000001BA40000-0x000000001BA90000-memory.dmp

Filesize
320KB

Download
memory/1528-11-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-13-0x000000001B9F0000-0x000000001BA08000-memory.dmp

Filesize
96KB

Download
memory/1528-9-0x000000001B9D0000-0x000000001B9EC000-memory.dmp

Filesize
112KB

Download
memory/1528-38-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-6-0x0000000002F10000-0x0000000002F1E000-memory.dmp

Filesize
56KB

Download
memory/1528-4-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1528-3-0x00007FF91EF00000-0x00007FF91F9C1000-memory.dmp

Filesize
10.8MB

Download
memory/1824-61-0x0000021EFDE90000-0x0000021EFDEB2000-memory.dmp

Filesize
136KB

Download
memory/3916-152-0x000000001B810000-0x000000001B912000-memory.dmp

Filesize
1.0MB

Download