Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 01:26

General

  • Target

    74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe

  • Size

    2.2MB

  • MD5

    812ac1ea0b1d66a93d0beca70cc28cbe

  • SHA1

    c5cff3dc9a2503521de74a7d4cda2f678f5bb575

  • SHA256

    74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3

  • SHA512

    01acc3b99130f0d263917e4e362caf25841b21e3a9a82ce40004db96239ebcc8762a57ebad020ed704213596a100d060475cd9fd61c5bd4df9a35ff14d4cc6f6

  • SSDEEP

    49152:K31tZUmbFNH1wLJDPqTo9lIS/MXU2F4/1l5eQ7K6:KltZUE6NDyTo9lv2F+VvK6

Malware Config

Signatures

  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Modifies WinLogon for persistence 2 TTPs 22 IoCs
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 15 IoCs
  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 44 IoCs
  • Checks whether UAC is enabled 1 TTPs 10 IoCs
  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe
    "C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1600
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fpJnj91JYj.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:844
        • C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe
          "C:\Users\Admin\AppData\Local\Temp\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe"
          3⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2812
          • C:\Users\Default User\WmiPrvSE.exe
            "C:\Users\Default User\WmiPrvSE.exe"
            4⤵
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1988
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec06fbc8-bcc4-4da1-ab1c-bde9f35de460.vbs"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2504
              • C:\Users\Default User\WmiPrvSE.exe
                "C:\Users\Default User\WmiPrvSE.exe"
                6⤵
                • UAC bypass
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:3064
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a512786c-2099-41da-a026-4d888191e1b4.vbs"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2036
                  • C:\Users\Default User\WmiPrvSE.exe
                    "C:\Users\Default User\WmiPrvSE.exe"
                    8⤵
                    • UAC bypass
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1916
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eccc6e67-44af-4c37-8c06-7c8f281ee8da.vbs"
                      9⤵
                        PID:2584
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10d92fc2-c7bb-418f-8b46-c7f66a357847.vbs"
                        9⤵
                          PID:2264
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\73bf45f9-79e6-4a67-b7ae-80b138998f3f.vbs"
                      7⤵
                        PID:2032
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2348bab9-65be-4933-be09-305e06cffec8.vbs"
                    5⤵
                      PID:2784
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2752
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2064
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1456
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\ja-JP\services.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2908
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\ja-JP\services.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:528
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\ja-JP\services.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1496
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\security\logs\wininit.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2140
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\security\logs\wininit.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2580
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\security\logs\wininit.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:2360
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2284
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2660
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1940
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2764
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2988
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\services.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2168
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Network Sharing\wininit.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2180
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\wininit.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1812
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Media Player\Network Sharing\wininit.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1900
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\wininit.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              PID:1608
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:332
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Templates\wininit.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1260
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Pictures\sppsvc.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1480
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Pictures\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2652
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Pictures\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2472
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2516
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2432
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\taskhost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2468
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2232
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1612
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1672
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\CSC\dllhost.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1132
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\CSC\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2548
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\CSC\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2536
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\smss.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:528
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2056
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2772
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Temp\Crashpad\attachments\sppsvc.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2908
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\attachments\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1456
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Temp\Crashpad\attachments\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1328
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\smss.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1148
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2016
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\smss.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:776
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Logs\Idle.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2416
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Logs\Idle.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2428
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\Logs\Idle.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2712
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\WmiPrvSE.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2032
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1804
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1872
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Favorites\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2456
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3" /sc ONLOGON /tr "'C:\Users\Public\Favorites\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1864
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Favorites\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2284
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2852
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1608
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\WmiPrvSE.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1916
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2096
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2208
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2636
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\PolicyDefinitions\dwm.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1204
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\dwm.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1284
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Windows\PolicyDefinitions\dwm.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2468
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 13 /tr "'C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1752
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1868
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e37" /sc MINUTE /mo 8 /tr "'C:\Windows\PolicyDefinitions\en-US\74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1536
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
              1⤵
              • DcRat
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1660
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Scheduled Task/Job: Scheduled Task
              PID:1664
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
              1⤵
              • DcRat
              • Scheduled Task/Job: Scheduled Task
              PID:896

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Internet Explorer\services.exe

              Filesize

              2.2MB

              MD5

              812ac1ea0b1d66a93d0beca70cc28cbe

              SHA1

              c5cff3dc9a2503521de74a7d4cda2f678f5bb575

              SHA256

              74b7f7ab11694433db9e6f10265127cb9ab239983f0442d6aea1a475713018e3

              SHA512

              01acc3b99130f0d263917e4e362caf25841b21e3a9a82ce40004db96239ebcc8762a57ebad020ed704213596a100d060475cd9fd61c5bd4df9a35ff14d4cc6f6

            • C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\explorer.exe

              Filesize

              2.2MB

              MD5

              78210645bb7f1ac5c28fe4f9f148e866

              SHA1

              80cb7b76c11d399b8abf29f571124277a9abb1f7

              SHA256

              852684c436ebdd7bd768f62e89323fa13ad798c2b964e13e7c66c099335cac2a

              SHA512

              06e47f133b387bb147768000658ab5641085f202a797161792d2df8669ee91773d460805d0b9b89b3f1812d3f5ee684160c628beeea8b446638f4c193c815b2b

            • C:\Users\Admin\AppData\Local\Temp\2348bab9-65be-4933-be09-305e06cffec8.vbs

              Filesize

              486B

              MD5

              c50c374c045aabcbc34eb93f6b6883e3

              SHA1

              4efe252ebd055d95257a93e7f32a87e7c81e1a39

              SHA256

              ee24a0f1ad17fbfe5454c8240dc7e09c457e3303fd19221946a153962f6d2eb3

              SHA512

              3466a2089dc025035d8e8a0432fd6dcff22ff9645d0bfecd1a83557c1a2cdcf7bea9d42bd3c04b7bdf996bde00ce66d6db8cb4baf0185ef4573cd0957dd2ec33

            • C:\Users\Admin\AppData\Local\Temp\a512786c-2099-41da-a026-4d888191e1b4.vbs

              Filesize

              710B

              MD5

              f63d3497992fa7262c9249fc37a3b57f

              SHA1

              abc92d86b2d92dc0274e4fa1d9acbb0b92379252

              SHA256

              7f0b3514d1744d59da0ee93e115f7e819052add51c8ef614ca44b7dd18c74e41

              SHA512

              847b02ec3499895d93a06e3aea516b781b4dc7fefa08efa02c8e41fb32db9c4ad213f3ee8eaa564b7c5ee8ed50b82be349703b8330f27da26d715b340a60f442

            • C:\Users\Admin\AppData\Local\Temp\ec06fbc8-bcc4-4da1-ab1c-bde9f35de460.vbs

              Filesize

              710B

              MD5

              9b1de80b02905f298fc8b1b4394ef977

              SHA1

              a6bc72e6f9de3d0622457d62ac0f6639ce609622

              SHA256

              dc3a4f1c7f5249881a389321f7957236001273b7f0fe2cde8118f414dc8cb744

              SHA512

              a040c900026026cfde10cba33a4ddca2797380b4ca653242271fc770996b0c90e0497ac32ca78b6f0e157df3e09e36ef49fe5482d1e87f5fc209830d983a9142

            • C:\Users\Admin\AppData\Local\Temp\eccc6e67-44af-4c37-8c06-7c8f281ee8da.vbs

              Filesize

              710B

              MD5

              8efc90547392c99feecace007134f1e5

              SHA1

              3282b93e2d106d7fe2b894eeb1dbc3aae2b9fec5

              SHA256

              785bb3a2338a361c31194d74a1308b05a240b3896147b6b7f1a929a7b78c2ffd

              SHA512

              c02645d44f09b8e4b10f4753c0bb255151a45458047b14ad6e6b545ea89bcf5a557fee17a2ff789435fce41fab0d9d767ef6de38a6ddc540927449d89be3ac8a

            • C:\Users\Admin\AppData\Local\Temp\fpJnj91JYj.bat

              Filesize

              267B

              MD5

              d01ebc18aed340249be869043ea1f1d8

              SHA1

              783a37eca3e4c0ecca463a8d614e6008a4aaa2d1

              SHA256

              cd1d341b5cd6d1130d8c517fa8a8a41c523d59c64d12b54ee309ea3d6fa6be46

              SHA512

              e7df21a76a81c319cf3a5afa8d9c715883d36081785a317317b54508c155bbb9604829608b529374660009e3cb8bbeb4d929574c468ab680862a65f446638782

            • C:\Windows\CSC\dllhost.exe

              Filesize

              2.2MB

              MD5

              0d7c14aadbecb63c01575806703869b0

              SHA1

              23ed811e342f5849a694cbd2ebd32baed4a7b13b

              SHA256

              98d820f1a4d69dab034a7856e5613323ef3660a7baebb1ace55f23849a4cbc1e

              SHA512

              c03e1c502387edc247bde2fbc199eea2f37ccd287a5b659a3ba196c374774c1ee317ba840c9555e2903e44a1c29559615af415ea266ef85b64cb5cabdbe94e97

            • C:\Windows\DigitalLocker\ja-JP\services.exe

              Filesize

              2.2MB

              MD5

              c5dc6560c449e7b32fb4e20f5fb90f6f

              SHA1

              841087ee7abfba0b63d4d4e5cba7e077f1a9693b

              SHA256

              34b1d20da529970d67bde5c4df0ca509fb1949edb8f9400afd6ca764c67dd807

              SHA512

              e8105b6109ece2524ed2c721ba71211557d6ac330f1cb6fa368e62c5f013eafc787afbbd1365ce5492fbf06239def340f84e1bdaca9bdb21ce18c9538a774309

            • memory/1600-10-0x0000000002130000-0x0000000002138000-memory.dmp

              Filesize

              32KB

            • memory/1600-27-0x000000001AD90000-0x000000001AD98000-memory.dmp

              Filesize

              32KB

            • memory/1600-11-0x00000000021C0000-0x00000000021D0000-memory.dmp

              Filesize

              64KB

            • memory/1600-12-0x00000000021D0000-0x00000000021DA000-memory.dmp

              Filesize

              40KB

            • memory/1600-13-0x00000000021E0000-0x00000000021EC000-memory.dmp

              Filesize

              48KB

            • memory/1600-14-0x00000000021F0000-0x00000000021F8000-memory.dmp

              Filesize

              32KB

            • memory/1600-15-0x0000000002200000-0x000000000220C000-memory.dmp

              Filesize

              48KB

            • memory/1600-16-0x0000000002210000-0x0000000002218000-memory.dmp

              Filesize

              32KB

            • memory/1600-18-0x0000000002220000-0x0000000002232000-memory.dmp

              Filesize

              72KB

            • memory/1600-19-0x0000000002250000-0x000000000225C000-memory.dmp

              Filesize

              48KB

            • memory/1600-20-0x00000000023F0000-0x00000000023FC000-memory.dmp

              Filesize

              48KB

            • memory/1600-21-0x0000000002400000-0x000000000240C000-memory.dmp

              Filesize

              48KB

            • memory/1600-22-0x0000000002410000-0x000000000241A000-memory.dmp

              Filesize

              40KB

            • memory/1600-23-0x0000000002420000-0x000000000242E000-memory.dmp

              Filesize

              56KB

            • memory/1600-24-0x0000000002430000-0x0000000002438000-memory.dmp

              Filesize

              32KB

            • memory/1600-25-0x0000000002440000-0x000000000244E000-memory.dmp

              Filesize

              56KB

            • memory/1600-26-0x000000001A9B0000-0x000000001A9BC000-memory.dmp

              Filesize

              48KB

            • memory/1600-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

              Filesize

              4KB

            • memory/1600-28-0x000000001ADA0000-0x000000001ADAC000-memory.dmp

              Filesize

              48KB

            • memory/1600-29-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

              Filesize

              9.9MB

            • memory/1600-9-0x0000000002120000-0x000000000212C000-memory.dmp

              Filesize

              48KB

            • memory/1600-8-0x0000000002100000-0x0000000002116000-memory.dmp

              Filesize

              88KB

            • memory/1600-7-0x00000000020F0000-0x0000000002100000-memory.dmp

              Filesize

              64KB

            • memory/1600-6-0x0000000000610000-0x0000000000618000-memory.dmp

              Filesize

              32KB

            • memory/1600-5-0x00000000005F0000-0x000000000060C000-memory.dmp

              Filesize

              112KB

            • memory/1600-189-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

              Filesize

              9.9MB

            • memory/1600-1-0x0000000000930000-0x0000000000B5E000-memory.dmp

              Filesize

              2.2MB

            • memory/1600-2-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

              Filesize

              9.9MB

            • memory/1600-4-0x0000000000460000-0x000000000046E000-memory.dmp

              Filesize

              56KB

            • memory/1600-3-0x00000000003D0000-0x00000000003DE000-memory.dmp

              Filesize

              56KB

            • memory/1988-244-0x0000000000E70000-0x000000000109E000-memory.dmp

              Filesize

              2.2MB

            • memory/2812-192-0x00000000001A0000-0x00000000003CE000-memory.dmp

              Filesize

              2.2MB

            • memory/3064-255-0x0000000001010000-0x000000000123E000-memory.dmp

              Filesize

              2.2MB