dcrat | 88414350df955ae0d1c3e062ee97a4da79361ec71711c4c40273fa70a4ccce53

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe
Size

2.2MB
MD5

92d29106be881759ef6f045a3415137d
SHA1

9b307b4b98851c4325a1f2746c7827a0d14c7e36
SHA256

b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0
SHA512

43b526bd521ac72688dc7670c9c9ce323b39675620a0bf202d783906ac650fdc1bbefeb5876f97c5fcf525e6c5d39cc4b29ffd43acd4560baf0745126c5eec8e
SSDEEP

49152:IBJ+h0kcmcdp/caMMlawkBXRInaKYRouPbWGQ2L:yQhbcmcfM/N1RSavoujWHk

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\msproviderBrokerMonitornet\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\SearchApp.exe\", \"C:\\Program Files\\Windows Mail\\SppExtComObj.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\msproviderBrokerMonitornet\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\SearchApp.exe\", \"C:\\Program Files\\Windows Mail\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Contacts\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\msproviderBrokerMonitornet\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\SearchApp.exe\", \"C:\\Program Files\\Windows Mail\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Contacts\\WinPerfcommon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\msproviderBrokerMonitornet\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\SearchApp.exe\", \"C:\\Program Files\\Windows Mail\\SppExtComObj.exe\", \"C:\\Users\\Admin\\Contacts\\WinPerfcommon.exe\", \"C:\\Recovery\\WindowsRE\\cmd.exe\", \"C:\\msproviderBrokerMonitornet\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\msproviderBrokerMonitornet\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\msproviderBrokerMonitornet\\dllhost.exe\", \"C:\\Users\\All Users\\SoftwareDistribution\\SearchApp.exe\""	WinPerfcommon.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4508	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2288	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	4404	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4404	schtasks.exe	89

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5032	powershell.exe
4648	powershell.exe
960	powershell.exe
2988	powershell.exe
4380	powershell.exe
408	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WinPerfcommon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 13 IoCs

pid	Process
116	WinPerfcommon.exe
4372	dllhost.exe
4256	dllhost.exe
3656	dllhost.exe
4448	dllhost.exe
4236	dllhost.exe
4516	dllhost.exe
1916	dllhost.exe
1688	dllhost.exe
1592	dllhost.exe
4500	dllhost.exe
3960	dllhost.exe
904	dllhost.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\Contacts\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\msproviderBrokerMonitornet\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\msproviderBrokerMonitornet\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\msproviderBrokerMonitornet\\dllhost.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\SoftwareDistribution\\SearchApp.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows Mail\\SppExtComObj.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Windows Mail\\SppExtComObj.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\SoftwareDistribution\\SearchApp.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\Users\\Admin\\Contacts\\WinPerfcommon.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Recovery\\WindowsRE\\cmd.exe\""	WinPerfcommon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinPerfcommon = "\"C:\\msproviderBrokerMonitornet\\WinPerfcommon.exe\""	WinPerfcommon.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC3773DE7E42994E669221203F6229B5C.TMP	csc.exe
File created	\??\c:\Windows\System32\ip2t47.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\SppExtComObj.exe	WinPerfcommon.exe
File created	C:\Program Files\Windows Mail\e1ef82546f0b02	WinPerfcommon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2988	PING.EXE
3464	PING.EXE
1324	PING.EXE
5064	PING.EXE
3892	PING.EXE
5028	PING.EXE

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	WinPerfcommon.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	dllhost.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
3892	PING.EXE
5028	PING.EXE
2988	PING.EXE
3464	PING.EXE
1324	PING.EXE
5064	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1980	schtasks.exe
3604	schtasks.exe
4732	schtasks.exe
3652	schtasks.exe
4876	schtasks.exe
4600	schtasks.exe
3592	schtasks.exe
3464	schtasks.exe
4420	schtasks.exe
1284	schtasks.exe
2288	schtasks.exe
3144	schtasks.exe
4508	schtasks.exe
4360	schtasks.exe
2700	schtasks.exe
4744	schtasks.exe
4692	schtasks.exe
2472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe
116	WinPerfcommon.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	WinPerfcommon.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	4648	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	4372	dllhost.exe
Token: SeDebugPrivilege	4256	dllhost.exe
Token: SeDebugPrivilege	3656	dllhost.exe
Token: SeDebugPrivilege	4448	dllhost.exe
Token: SeDebugPrivilege	4236	dllhost.exe
Token: SeDebugPrivilege	4516	dllhost.exe
Token: SeDebugPrivilege	1916	dllhost.exe
Token: SeDebugPrivilege	1688	dllhost.exe
Token: SeDebugPrivilege	1592	dllhost.exe
Token: SeDebugPrivilege	4500	dllhost.exe
Token: SeDebugPrivilege	3960	dllhost.exe
Token: SeDebugPrivilege	904	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2728	2988	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe	83
PID 2988 wrote to memory of 2728	2988	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe	83
PID 2988 wrote to memory of 2728	2988	b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe	83
PID 2728 wrote to memory of 3048	2728	WScript.exe	99
PID 2728 wrote to memory of 3048	2728	WScript.exe	99
PID 2728 wrote to memory of 3048	2728	WScript.exe	99
PID 3048 wrote to memory of 116	3048	cmd.exe	101
PID 3048 wrote to memory of 116	3048	cmd.exe	101
PID 116 wrote to memory of 3452	116	WinPerfcommon.exe	105
PID 116 wrote to memory of 3452	116	WinPerfcommon.exe	105
PID 3452 wrote to memory of 2920	3452	csc.exe	107
PID 3452 wrote to memory of 2920	3452	csc.exe	107
PID 116 wrote to memory of 408	116	WinPerfcommon.exe	123
PID 116 wrote to memory of 408	116	WinPerfcommon.exe	123
PID 116 wrote to memory of 4648	116	WinPerfcommon.exe	124
PID 116 wrote to memory of 4648	116	WinPerfcommon.exe	124
PID 116 wrote to memory of 5032	116	WinPerfcommon.exe	125
PID 116 wrote to memory of 5032	116	WinPerfcommon.exe	125
PID 116 wrote to memory of 4380	116	WinPerfcommon.exe	126
PID 116 wrote to memory of 4380	116	WinPerfcommon.exe	126
PID 116 wrote to memory of 2988	116	WinPerfcommon.exe	127
PID 116 wrote to memory of 2988	116	WinPerfcommon.exe	127
PID 116 wrote to memory of 960	116	WinPerfcommon.exe	128
PID 116 wrote to memory of 960	116	WinPerfcommon.exe	128
PID 116 wrote to memory of 2116	116	WinPerfcommon.exe	135
PID 116 wrote to memory of 2116	116	WinPerfcommon.exe	135
PID 2116 wrote to memory of 4228	2116	cmd.exe	137
PID 2116 wrote to memory of 4228	2116	cmd.exe	137
PID 2116 wrote to memory of 3388	2116	cmd.exe	138
PID 2116 wrote to memory of 3388	2116	cmd.exe	138
PID 2116 wrote to memory of 4372	2116	cmd.exe	141
PID 2116 wrote to memory of 4372	2116	cmd.exe	141
PID 4372 wrote to memory of 4576	4372	dllhost.exe	143
PID 4372 wrote to memory of 4576	4372	dllhost.exe	143
PID 4576 wrote to memory of 428	4576	cmd.exe	145
PID 4576 wrote to memory of 428	4576	cmd.exe	145
PID 4576 wrote to memory of 4128	4576	cmd.exe	146
PID 4576 wrote to memory of 4128	4576	cmd.exe	146
PID 4576 wrote to memory of 4256	4576	cmd.exe	148
PID 4576 wrote to memory of 4256	4576	cmd.exe	148
PID 4256 wrote to memory of 1672	4256	dllhost.exe	150
PID 4256 wrote to memory of 1672	4256	dllhost.exe	150
PID 1672 wrote to memory of 2064	1672	cmd.exe	152
PID 1672 wrote to memory of 2064	1672	cmd.exe	152
PID 1672 wrote to memory of 5064	1672	cmd.exe	153
PID 1672 wrote to memory of 5064	1672	cmd.exe	153
PID 1672 wrote to memory of 3656	1672	cmd.exe	155
PID 1672 wrote to memory of 3656	1672	cmd.exe	155
PID 3656 wrote to memory of 4684	3656	dllhost.exe	157
PID 3656 wrote to memory of 4684	3656	dllhost.exe	157
PID 4684 wrote to memory of 1524	4684	cmd.exe	159
PID 4684 wrote to memory of 1524	4684	cmd.exe	159
PID 4684 wrote to memory of 3892	4684	cmd.exe	160
PID 4684 wrote to memory of 3892	4684	cmd.exe	160
PID 4684 wrote to memory of 4448	4684	cmd.exe	162
PID 4684 wrote to memory of 4448	4684	cmd.exe	162
PID 4448 wrote to memory of 3428	4448	dllhost.exe	165
PID 4448 wrote to memory of 3428	4448	dllhost.exe	165
PID 3428 wrote to memory of 2920	3428	cmd.exe	167
PID 3428 wrote to memory of 2920	3428	cmd.exe	167
PID 3428 wrote to memory of 4356	3428	cmd.exe	168
PID 3428 wrote to memory of 4356	3428	cmd.exe	168
PID 3428 wrote to memory of 4236	3428	cmd.exe	170
PID 3428 wrote to memory of 4236	3428	cmd.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe
"C:\Users\Admin\AppData\Local\Temp\b1996319c3b0fafa04179dd7b7de47c74be2dc3dc0d6aa04030b645970e1a9b0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\msproviderBrokerMonitornet\qGDN1Ee4B98z7IBsvEaYenHfp3i4NGluh1QU7ALIT.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\msproviderBrokerMonitornet\rS0XRrLecpgQD85mPzoGJptpB8S2GwiBTdu9z4xSSrCX90wlqwqwnpzpgY0I.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\msproviderBrokerMonitornet\WinPerfcommon.exe
      "C:\msproviderBrokerMonitornet/WinPerfcommon.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:116
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dmyzmexu\dmyzmexu.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3452
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F92.tmp" "c:\Windows\System32\CSC3773DE7E42994E669221203F6229B5C.TMP"
        6⤵
        
        PID:2920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\msproviderBrokerMonitornet\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4648
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Contacts\WinPerfcommon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BYPdDwG1pY.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2116
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4228
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3388
      - C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XKxUoGu8Hi.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:4128
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1XGPdNpiQu.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2064
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5064
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1XGPdNpiQu.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3892
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UVjCyjlRMB.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2920
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4356
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b2RsHXtgrT.bat"
        15⤵
        
        PID:2404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1792
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sRyZj7GC23.bat"
        17⤵
        
        PID:1776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4856
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4256
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GogtzRNUlL.bat"
        19⤵
        
        PID:1808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5028
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3LXAY36iRv.bat"
        21⤵
        
        PID:3652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3660
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2988
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2m5X78pZbp.bat"
        23⤵
        
        PID:4868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4772
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:4328
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4500
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OmY81XgjJ.bat"
        25⤵
        
        PID:1000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3600
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3464
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\G2aTXMUe3k.bat"
        27⤵
        
        PID:3592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:1916
        
        C:\msproviderBrokerMonitornet\dllhost.exe
        
        "C:\msproviderBrokerMonitornet\dllhost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WJ1wtP2ROC.bat"
        29⤵
        
        PID:2224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3172
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\msproviderBrokerMonitornet\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\msproviderBrokerMonitornet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\msproviderBrokerMonitornet\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\SoftwareDistribution\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Contacts\WinPerfcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommon" /sc ONLOGON /tr "'C:\Users\Admin\Contacts\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Contacts\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 5 /tr "'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommon" /sc ONLOGON /tr "'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WinPerfcommonW" /sc MINUTE /mo 12 /tr "'C:\msproviderBrokerMonitornet\WinPerfcommon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
935ecb30a8e13f625a9a89e3b0fcbf8f

SHA1
41cb046b7b5f89955fd53949efad8e9f3971d731

SHA256
2a7b829afe6a140bb37d24cc7711749c20cdaaf9cc7c4a182ff081180b4d99e9

SHA512
1210281612b0101ce63555a1a7855589ff68e1eac5b8a2461e10808c5b92c5dd111be72406c2923a94e10b687ceda43dc24d8c22a49dab40a4af793ee6b740aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\1XGPdNpiQu.bat

Filesize
169B

MD5
ba099991d9e39eb60b0832bc7150aafe

SHA1
e14aae5635a5fe63e615ec5881107c1461c54746

SHA256
9cadc4a7bd2cde80710fe8599cf943cdff48217f5ca4782c933ee91f27013320

SHA512
d3f6beabc07092b34961eb4dc41ae341b51610c2a665dc311cb68273cb871557280d40224e3263da1afc8d39376bac075730dc41dceb6602fac0736609bd0a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\2m5X78pZbp.bat

Filesize
217B

MD5
7210874ac3ec2a3b3708eae3c986bcb0

SHA1
7f6bcb09659c3c4d8a24c0c4dea073218596bcd0

SHA256
f036ba617def3eee1cb306b494f9fbc9ece4062220ac5e3f7b48812530fa585e

SHA512
8203d55391547ab4a43a6eb3cd94a3f6fd428e780cc6e0cc2da521cd87343eb86b1cf55b78118f178411b9e97681186f0ddeb8fbe7eeb2ce628bc1efc3a19529

Download Submit
C:\Users\Admin\AppData\Local\Temp\3LXAY36iRv.bat

Filesize
169B

MD5
5d1b1518131b3e688573f9ee72ca7fa1

SHA1
aa7f0dc48078cd0ca3f1272eae71984ea2ae41d4

SHA256
67b182982137ccd1c56d5a16318fd890b766b413cd11f00967af6924d1a063f3

SHA512
4385bdf340f9eb3f276ca2508258e4208a143969fc8b69f416ec25ff615ab8fe924e6d6dff0d4da864469c74d7e5900e0f95a7ff9fac3e950d0cd3e450e2bb84

Download Submit
C:\Users\Admin\AppData\Local\Temp\8OmY81XgjJ.bat

Filesize
169B

MD5
582b54e0c70b7f54c0b0b826df118dd2

SHA1
569f39aa6d61a81d63e6132bcb03d2f43b2cdd4f

SHA256
f4370883fc5cde5c9f2f3528f22c100ab8c4e2fea3f2cc4f64de5ce53084e3ba

SHA512
c36420f6cfc49e9fb31d155092f9a300ba624137af89cdbc9b8ed5f16e6d4b7abd8ea32b021f2b96cd8c6f054fdc91820906cd4108b42a7ba0e056e4799a934b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BYPdDwG1pY.bat

Filesize
217B

MD5
5aec589a54bf15e6e39afff7eba0036c

SHA1
de660221c1851b3bc92696a595bb4af3e50c206e

SHA256
a8437c8c80d038254ca7cca2be8fdf1cb1f7cad5d690112dee1864da92b321fa

SHA512
dc55ca4506058fca2d894b60f5312d7000540404c45868bdb0c9816403efb01c0c8aedb122326125f52769aa8b8f2395e1ae4380af34495f2b58844c21360528

Download Submit
C:\Users\Admin\AppData\Local\Temp\G2aTXMUe3k.bat

Filesize
217B

MD5
1bb8b17ab3762c2a1a858a3468f603c7

SHA1
4fb73382133fe08e6bbcee3d6462e8e46777db1c

SHA256
265c1093ac7e6d32b23b0644b467e11f9a725bf90804adeaf82328e85cb7f2ba

SHA512
288e7fead5ed76d85cb58a67c8bcd304417a3f06a636b033a9d97d48e3059654f3fa2301c10255ebec67a436c5ccaafa4168270552a49c5b7e08ca65f8a5d587

Download Submit
C:\Users\Admin\AppData\Local\Temp\GogtzRNUlL.bat

Filesize
169B

MD5
756bea1907acd6dad9616f7236acceb4

SHA1
5a983a5a5837a2ac23e33782b9195a32683f6b83

SHA256
697397099878e724b49d9b52a8de0f936e955862fa4500a8e692337d4d2326d0

SHA512
7664225eb811956cfec28d7ccaef0826b53b71b5ade6c8850913e2025744f58a0e356a9e788a3b55b9d41a243465956679045aad074084f1fa6b7c4e366f1bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4F92.tmp

Filesize
1KB

MD5
ca0980a3eecef52e8d312472bc1944b0

SHA1
5fcd36ba0c6bf4d1fdece90fd03df96fa3328e8c

SHA256
db76052dd2a3ca4f4b42e3444929f6e9c0b174837b5315c2b73db5465f05b386

SHA512
5a0f843de77c198d9a68bba628d6e7f7c7f956e9860ed8d1ecb3e6ec20dc5c41fa0651ae4576a17674f5c57506be644249442150561c7c502930f77fd919734f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UVjCyjlRMB.bat

Filesize
217B

MD5
8f74de5cbaea11344e8383426b7b5aa0

SHA1
bd7bb0f13f5acfe246e8435da282434b3df4ddde

SHA256
b20297d23fca1f873e907b0c1440694f087ca72f579a00c7dad77a2b4ef05cb8

SHA512
3051ad1a5f5d03fdf91d4721027ab34ae6fb53bf59ded767dfff911683f426e3774643f618f3e9ea4d57076f1033864ba6ee365282044d5093aba3a27ca75acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\WJ1wtP2ROC.bat

Filesize
169B

MD5
b389fedfbce7de89b293e654d4f34c5c

SHA1
8f261bb80b27772ef034ddd8802310fb0ffffbba

SHA256
0d0caf005f4a2ba3d2718b1e04c39110bee1e58eecd0fa998880b63b4c6b8950

SHA512
2f65cac90051f9ccafc4b6d2c4f4990757c2df6d56b014f9d9698e630d5e4c28d4aa74bc6428aa8b41ee88d775f0728d07ef800095900f72ce93fd28a1ff6b08

Download Submit
C:\Users\Admin\AppData\Local\Temp\XKxUoGu8Hi.bat

Filesize
217B

MD5
e90b25665fb5d281ffb0d76f144c5c55

SHA1
2972b4c75e20feac5042c9378a0411ab9e3a153b

SHA256
f16424ec3a82c251d69219281945fd855b8e9ec2a240b7adabf3b7a109261c0b

SHA512
0f3cbbfc87fede0763bf7ed2cb79c4de654f763d8ab74bbd02ec4bab7c51f665d62d16477ff65c1c323a2e66a516be6dc8259e925ef88db359bbec69316e1ac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjjhyf5i.ipz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b2RsHXtgrT.bat

Filesize
217B

MD5
bf806b2fc09d0d156fefd30bc90fbf5c

SHA1
1d9dfd2242e923ae8a9b8e531b3cbdce3a9fa748

SHA256
5c421e5a19c05d068ab53a19fbb10d44d5fe99094992c2665a061e8726c7c59a

SHA512
58cedf6e2e0680d28c0eff5dbac180c604b6b20edcc979dbc8ea483bd8efecf22e1902ebdf4239ebf14b476bc158f56250b025340aef5a35d9d7a6e6ef82cd35

Download Submit
C:\Users\Admin\AppData\Local\Temp\sRyZj7GC23.bat

Filesize
217B

MD5
7a01a629b4f94110f9e272076ff0a9ff

SHA1
14265aeefdc983aa217e432ac0455388183ea22d

SHA256
b412bda35fb8e14b4c2d432ad88dfe975b32371396272b32e56abba3cb312dba

SHA512
4f60f89475f5ce8d70385f2bbbd7b66693c3c715cff9f8d07e34dade8e61707dff8ee7ccb919240400834de2d464a60b09a3aa400b468f461a3a3f739c0e7e5e

Download Submit
C:\msproviderBrokerMonitornet\WinPerfcommon.exe

Filesize
1.9MB

MD5
6b9554367a439d39a00a0dff9a08b123

SHA1
e1d22cde90c297c10f4fcba5b3980e5d551eb0b3

SHA256
3332277b9e53375e998ccf981cdb0519fea7721b5e79a3d7a60b83f448f6c0a9

SHA512
72ffbca1a2aa7cd2bb6b963d97b43d7d5eab9a11d09c647c7679e71877927b8c021e28cd1e28ae9ac5300c8621ba97aae6699e1abddc58be89c9bb3e84d1c720

Download Submit
C:\msproviderBrokerMonitornet\qGDN1Ee4B98z7IBsvEaYenHfp3i4NGluh1QU7ALIT.vbe

Filesize
265B

MD5
f8b56b683c6faa5b9eb7f37f01af8c29

SHA1
89e4357ccde76fe35aa3cbac952bb68d691ae9cd

SHA256
bd73b65e256773c9cf879c504b7d426573587b5c7b03bec2d6fccfddaccf1721

SHA512
321b6a63d3dca1e52a65a47ab3d3a83d0d7ee59b28f29274b128d9b7f5c49f2cfaac4f70d3981ee55821cbbdc3234bf4d721cbe3f64a888250ac4c297eb9f768

Download Submit
C:\msproviderBrokerMonitornet\rS0XRrLecpgQD85mPzoGJptpB8S2GwiBTdu9z4xSSrCX90wlqwqwnpzpgY0I.bat

Filesize
103B

MD5
a1c6e7d957b0b22c92c7b314d10e894d

SHA1
0f20c6fa17a304e0a20947d6e6f368406a19fc25

SHA256
bf06f59116a3066353fe51051b9701fb34dda96e7b80f24d8e6fc6b18bd01723

SHA512
20985dacbb86ac9862da8483978b579c0ccdb3dff4f23aee019b006669fd1230a684b2bd12fb43ab489343ad7aff1fd0a8228890135e1854f9e2a106b7514e02

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dmyzmexu\dmyzmexu.0.cs

Filesize
373B

MD5
07a9e492825bf13973f29151a14ae045

SHA1
fe794858830b91bd09147f05597ea7a07e339d34

SHA256
d2342ce934d6507965b8df56460ef65e7542bf2b53e95f1e96d059122002f7bb

SHA512
9eafec8f6df04d8e0d1b9fa8f3f4104a997b682ac7b996788ed5d1e7ce997c3d7affd782bf4c104a330bb18b9e66c1786d62f16f4bf05f48303f80ef9d5f3113

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dmyzmexu\dmyzmexu.cmdline

Filesize
235B

MD5
606e96f0f0c8aa4d5f676fe860904504

SHA1
3da16bdbc3ebc2017aecb0d3186b41bca6b766dd

SHA256
7651024c4616ae476e10d8a4bec8bad341550cc1d1e82b58c90001e195b6e3d0

SHA512
30546fefd8d72dd9c3db850a5d6ed2b777bf2433942a7a77a6a6176e25cc71a14cd1476af18272462d142c531aaa35f4d202ed2e26e78f7b1a9cc5cd94b8c948

Download Submit
\??\c:\Windows\System32\CSC3773DE7E42994E669221203F6229B5C.TMP

Filesize
1KB

MD5
034b083b6729ade0b138a24cbdd66c6d

SHA1
299c5a9dd91498cfc4226a5fe6d52ea633c2d148

SHA256
8e3aa7a68c0bfea6cae11fe40e79aa1483bc2e43c4c3fd11fcebca1f7bcea0d2

SHA512
43f68ec3211f2d1eb3a095713b3988a5b45a6fb03136876431edd3b25b628f904079557cbb60d0107c0444551db274c8e6817d63a543e8a7e390206af64d1cc3

Download Submit
memory/116-20-0x000000001BBF0000-0x000000001BC08000-memory.dmp

Filesize
96KB

Download
memory/116-22-0x000000001BBB0000-0x000000001BBBC000-memory.dmp

Filesize
48KB

Download
memory/116-18-0x000000001BF70000-0x000000001BFC0000-memory.dmp

Filesize
320KB

Download
memory/116-24-0x000000001BBC0000-0x000000001BBCC000-memory.dmp

Filesize
48KB

Download
memory/116-26-0x000000001BF20000-0x000000001BF2E000-memory.dmp

Filesize
56KB

Download
memory/116-17-0x000000001BBD0000-0x000000001BBEC000-memory.dmp

Filesize
112KB

Download
memory/116-15-0x000000001BA90000-0x000000001BA9E000-memory.dmp

Filesize
56KB

Download
memory/116-13-0x0000000000CA0000-0x0000000000E94000-memory.dmp

Filesize
2.0MB

Download
memory/116-12-0x00007FFD0ADA3000-0x00007FFD0ADA5000-memory.dmp

Filesize
8KB

Download
memory/116-28-0x000000001BF30000-0x000000001BF3C000-memory.dmp

Filesize
48KB

Download
memory/116-94-0x000000001C720000-0x000000001C8C9000-memory.dmp

Filesize
1.7MB

Download
memory/960-56-0x0000028B6D860000-0x0000028B6D882000-memory.dmp

Filesize
136KB

Download