Analysis
-
max time kernel
900s -
max time network
895s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/01/2025, 04:14 UTC
General
-
Target
d49f9a9a6f4d5c60ae2c35aafe7d105a.exe
-
Size
4.2MB
-
MD5
d49f9a9a6f4d5c60ae2c35aafe7d105a
-
SHA1
8a192f01c06d2b67437c8789bdf564864d11eefc
-
SHA256
91a5d06a6ddc1dbc0d573871082b21c0ef5d260987d760bff9b1d19966d0c32d
-
SHA512
fc90ac8848cbc7231bbe6d1c4e974f375d5af137a157d2553e516059270748f5162c1ea51f282850d4572eef6956fc8e6e9cead1a105286c712251ff43d1a440
-
SSDEEP
98304:hbE+vSZLE4Cj/L7gHNchtcv4zTk24eDeRRXcaiJ:hw+KL6fwscQTk24eWRXhY
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 45 IoCs
-
DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 18 IoCs
-
Checks whether UAC is enabled 1 TTPs 30 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 16 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 45 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d49f9a9a6f4d5c60ae2c35aafe7d105a.exeC:\Users\Admin\AppData\Local\Temp\d49f9a9a6f4d5c60ae2c35aafe7d105a.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Bridgebrowserdriversession\8Q1TNfuIkORrb6IwpocDiochN.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Bridgebrowserdriversession\7RIlKJCBYDYjVU5Wl3rLZ.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Bridgebrowserdriversession\ComProviderreview.exe"C:\Bridgebrowserdriversession\ComProviderreview.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rxc6Z07b4w.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c57f3aa8-8d1d-4079-a55f-db4e3c7a2bc7.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\37291806-4895-4ed2-ae18-c437a4a350fb.vbs"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ec9bb26-e0a4-400f-a0e1-fd42eee7ae66.vbs"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\701409e5-c60b-4f2d-9ff6-b074b6e4d4b8.vbs"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fec192c-9fd9-42e6-a5a9-bd55b6fe52c0.vbs"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7134004f-4a86-4eb1-8ac6-483caaea637c.vbs"17⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52520c5c-1e2f-4533-a42d-65b744f1da6a.vbs"19⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8283e63-e84f-42ff-8c9d-5cb0703a0e58.vbs"21⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52ee5bd7-14b9-41ac-9a7e-408256f6523b.vbs"23⤵
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15c023a7-4ba8-4992-bd38-a1d9274a2126.vbs"25⤵
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb8ae8cd-a347-4d88-8696-f2b72c3de1bf.vbs"27⤵
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f190d1b-bd5a-44c5-a80f-b770ceb3cda1.vbs"29⤵
-
C:\Program Files (x86)\Windows Portable Devices\services.exe"C:\Program Files (x86)\Windows Portable Devices\services.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e25616c-76c0-4cc0-a5c8-688e934fea3f.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ddc70f03-8814-4386-9796-f0ac83bd36f3.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80eae688-23fe-4c73-b6ec-fc186c56e3bf.vbs"25⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f8145f4-ccc6-4602-b8f4-7a8fc3268a99.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5c886e9e-c491-4986-ac80-9e1c2b54fdd6.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b332e42d-28dc-4e62-9c8c-9cd8482f2b23.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b00108a2-d9d7-479d-8f6e-e55330db2e73.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c3ad79f-2bec-4722-b119-c40aa7a5c276.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab03519f-1b4d-4f13-a2e5-e048a3675869.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6aca3d1-a59d-4278-8103-b7b67ff3596d.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c5411e5-a353-46c7-bdf8-646a9c64e4f6.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a6029b3-dfcf-40f3-a528-a62f04cec8f2.vbs"7⤵
-
-
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Desktop\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ComProviderreviewC" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ComProviderreview.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ComProviderreview" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ComProviderreview.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ComProviderreviewC" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ComProviderreview.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\IdentityCRL\INT\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\IdentityCRL\INT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\VideoLAN\VLC\plugins\misc\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\misc\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\plugins\misc\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ComProviderreview.exe"C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ComProviderreview.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\IdentityCRL\INT\RuntimeBroker.exeC:\Windows\IdentityCRL\INT\RuntimeBroker.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\VideoLAN\VLC\plugins\misc\services.exe"C:\Program Files\VideoLAN\VLC\plugins\misc\services.exe"1⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\581f4070-c43c-4cc6-acfb-09a9900e9635.vbs"2⤵
-
C:\Program Files\VideoLAN\VLC\plugins\misc\services.exe"C:\Program Files\VideoLAN\VLC\plugins\misc\services.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\66c245d4-f905-4c7d-96ac-c0e089285c70.vbs"4⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f01635ad-4ca8-4002-87ec-79fc8687bc5e.vbs"4⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\56ed87fa-6cf5-45f1-b0fe-22c6ce5d1285.vbs"2⤵
-
Network
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse -
DNS71.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
DNSca54823.tw1.ruRemote address:8.8.8.8:53Requestca54823.tw1.ruIN AResponseca54823.tw1.ruIN A94.198.223.74
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS40.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request40.134.221.88.in-addr.arpaIN PTRResponse40.134.221.88.in-addr.arpaIN PTRa88-221-134-40deploystaticakamaitechnologiescom
-
DNS172.214.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
DNS208.143.182.52.in-addr.arpaRemote address:8.8.8.8:53Request208.143.182.52.in-addr.arpaIN PTRResponse
-
DNSca54823.tw1.ruRemote address:8.8.8.8:53Requestca54823.tw1.ruIN AResponseca54823.tw1.ruIN A94.198.223.74
-
94.198.223.74:80ca54823.tw1.ru -
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
94.198.223.74:80ca54823.tw1.ru
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:5371.31.126.40.in-addr.arpadns
DNS Request
71.31.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53154.239.44.20.in-addr.arpadns
DNS Request
154.239.44.20.in-addr.arpa
-
8.8.8.8:53ca54823.tw1.rudns
DNS Request
ca54823.tw1.ru
DNS Response
94.198.223.74
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:5340.134.221.88.in-addr.arpadns
DNS Request
40.134.221.88.in-addr.arpa
-
8.8.8.8:53172.214.232.199.in-addr.arpadns
DNS Request
172.214.232.199.in-addr.arpa
-
8.8.8.8:53208.143.182.52.in-addr.arpadns
DNS Request
208.143.182.52.in-addr.arpa
-
8.8.8.8:53ca54823.tw1.rudns
DNS Request
ca54823.tw1.ru
DNS Response
94.198.223.74
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165B
MD503feb686475df3981ff89eaf94c01678
SHA1d03d6234af5825c397755fd67e32606bab6e7050
SHA25638e603daba57e1db61b78fbca014e86b0273b43ec6a439d3c5b905679e949862
SHA5125f277d8988d502373d1b6b723153dd6681f20cbde9d68165bd559a954f60406a1c06a0f583a52c568738becf843236f09b47d3500433bad7fe8363e58846659b
-
Filesize
224B
MD51382f3e3f9f3a531c081f9216e1f3165
SHA163bb2176b3b553f2182fedc1b3e2bcdc33a4691b
SHA2569f7893fd255de70e98053c1ce04106912a686d110b3ba1034c6690ba7870253d
SHA51241ad75c7a21967f6463ae5b553088c82097f41aa0ba3ad19f0a65e25a1916e8dd2323e8b9e140170b55b025193d7d670a40b32b6b22ab83d0da4e058c11d9568
-
Filesize
3.7MB
MD58ba0bad0eb7bd09fde9fe57a8c63c884
SHA145a00cb30db1dbf2d6548e1a37cb88a304f46649
SHA256c050c1d626edf24ea41da7f4b74e20e39a3ae6a66f6a4bff685d6a1c308b600c
SHA5121c3fa87086fb385d753c5ba49245ddba87a343795b049444d9f21d1cd29adc9dc545f5ef3f92c7d89b9b0289af557524fe88411fefadedcfcd94069845b95041
-
Filesize
1KB
MD5655010c15ea0ca05a6e5ddcd84986b98
SHA1120bf7e516aeed462c07625fbfcdab5124ad05d3
SHA2562b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14
SHA512e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437
-
Filesize
1KB
MD549b64127208271d8f797256057d0b006
SHA1b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA2562a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
-
Filesize
512B
MD5acad0c32d8f81547ffb4f6d136ce19be
SHA16ab943e31c4493c3e5573ecb2a8442ae82a48c82
SHA256c60f5edaa88f9ae852bdcfd1ae506e4ddee16dc1384646af485089df60819f54
SHA512c585310ee8a780bb2f0568b2a06831b9e150c2780536c177561f51850cedfd67a1645e4e331e08eb8c81920ecdd84869836d586f2f8e30a269e633f063a1f857
-
Filesize
736B
MD597fc3ea2348f7b1261c53fe36c2f89cb
SHA17cb4332e73948b615df76eb7f02f11ac921e5ccc
SHA256a423efe92cedab4ecaa86dd54a779650d2e1d7ac0b54b660892f17c5502f862b
SHA5125dea2c9aecef8fc8e52a948eb1252817d26f0c8a4819380f60c7c4a323cacf91ea1dec49707681326524530a12062f52b92d69f75da5bffe78e6759bd8a3c9e9
-
Filesize
736B
MD52b6e00492c3fef8a39fc2262310883a4
SHA1fdcaae8f895e73fb65df896cb43ef1a3772917b0
SHA256c14820c10a8087cfb52752c13b80bc36390a5574bf28224ab2dfe6250aad0645
SHA5122afac6430260dea721ee4885da210a85da43ae13936ce8196866c25cc56092616ca83489e79c91420c876cbe3547f04c7342debf95de4e5aea93871612169855
-
Filesize
736B
MD5a9f9721d41fe44d70652bae40eeadbbb
SHA102bae1ff04780e0535d94d36f6446c49023562ee
SHA25667400236cbc891cb002d5d5cf07dcc8aed15a64e1bbf5d15491719f69cb84134
SHA5125ec1e59098321862d86ac58496a7f468179e9034de20bbe88dbda7382927a508177419cd5eb8b496641df7018702d1301f76fe41d5cfb8919dd4b72dc87ac02c
-
Filesize
736B
MD53296f3a7913dd86868b67a788c5a377c
SHA100f8e56f8475d4d5eb905cd70082d74c00b39cd5
SHA256da54e3604d7bf40853ffe196a4bbc24f15296bc2b90bdab01823240841a18833
SHA5127ff64572a26622910c61aaaca03d75eea681a3ac9067ff95d95f25da8606f0d48ac3de2976f777cd0847b3cd9eab5283a8188f4adf318fbbb0116c12810a41fc
-
Filesize
736B
MD56f576a6496d83487022b4523ac6841ed
SHA1723363e216808c45bd37e33bfd575e43efa51fed
SHA256d31214291c0cc883c7d0a9419113c3b33094499fa76073dac9bb13c79fcb3c59
SHA5124b6133c131e123543c90ed1d092db12cb98cbe550bbd2d11ea09f36f85790a836d86b4b0002db3308a40a61035f1fed033e06830e3cb2adca285b76c0c3f961d
-
Filesize
731B
MD5cc91a8b22e50a19febcce677cc8c97b7
SHA188545fc1c8076d84a0525af5ff453dbbcc99a3a8
SHA2569fb49784029075841864309641a8cde5d5a1d9112b2372e6a7fb1f5020e165dc
SHA512651119faa658e5f3cbe11662b10a7123e50a41237c2726e3db3432eecc75388f9f02c76750d84acef5d029976f2fc8dde2032887e2047d53f09814a46d743abf
-
Filesize
736B
MD5e7b76e866913d1d0a3b337e31e6dd8a6
SHA14907343beb730e32f49aab671818c6fc25a81394
SHA256793d0a088adda3795c34299287edb839df026ae440dd9cad16c931886ce35bb6
SHA51265cc861e1c3d55bdbbcb7ce4f0eb10119034a244c2d7529bfe94519d8c73b0eeb50018eac27f81b67a1bcc2438fef9f9221070679c253f2beec426c70ce90b31
-
Filesize
736B
MD5acf261f3d1de881b6f2b8996dda399c1
SHA147eb88340a07ba7e2ed96aba87c0a93677d941fa
SHA256f70f76c4c587d30875cecdab938a978b16089c93fdc0169a7c0fb3b106c86530
SHA512643b7ecfc514ca9bee076fb21b03f92035186820b97e5021edeb4e25656a028a1c9d8553418f01165b0f304079bc6392d1a37c19ecc9149c639858e63d605c84
-
Filesize
736B
MD5969289d6ea95ce256c4dc319747dcf8e
SHA163dd773c26069fd5cda6a0314b0fd7ca9dd4357f
SHA256916843d492c1843a09c3c16bc0f8621bff1a5747cd769e334622b72d7db1a300
SHA512267657312b13662a1b64c2bae9e83c54a1bff08626b192b561953eabb97f155c4f47e38e7c34ee028b2dfac84cd29360d7432fdb0beb2918b32371648219cc17
-
Filesize
736B
MD51c4be6d66098fb7e5c04bdd838008f71
SHA1dc60dd31a0e30ef82fdd7c4f5c8c78e867b3282a
SHA25614d66e2a9a4a0a9455f848ea3a288df4ed0755218a8843a4cda86128d44cbbd9
SHA5122d182c204608da2e87a7230d9a24de465d1c33052e7f0c50362cda1906482a65f333ab71abdbcc5f70145b42d86bb5a1be82159b7eaa5a21dfe3baf9ad07fab0
-
Filesize
736B
MD50c3038d5d3b1434a8667f85b1eaa7d57
SHA1cdb1436879219674aa68ddb5e7aed5ca3dc2487c
SHA256136c0accdc4745c339eb67e92a12b339305cc776a64e2634518c12c70d4786ec
SHA51291b3346a63ab18b582de43b4775f09ead54dd1c916631bcea48e585c8fd33ab7a2cfec0f62954fb5599a50132acf6b71ab43319850a42746664319e7ee290412
-
Filesize
736B
MD5f21e1894021fbd453dbc4d41b9ab51c8
SHA1e8c2a17bfdd2d6381d691ed0a566d298b4ab7530
SHA256cc54698f367b0c051eec033d551389a57ab00d15e0525c35b22d1f83bb201a66
SHA5126c22c73a2221710d6b228c90b443ee4ae149a4e123cb0af815f4429ddc8e7861c5c7c1769a84b2b253abba38f083f799ba011363902c3edb574160097dd52509
-
Filesize
736B
MD5c974049589b6febbbc97e0fe6e8cc1b9
SHA1a0148f6cca0e23e0a71119921891d76afc7c62dc
SHA2569a9ca28fe004945866a783ee8b48a997832f44615ff65a27077647e9a7b80e3d
SHA5122bd2fc63e6cdbf9e92e29c0aec5ff2d1ba23118530f703add258a546af12618390d7aca3bd8b74ab8756946ee2d4eebb494f47478d88c127702dc2afb5d5d2fb
-
Filesize
507B
MD54fb076e5db466ad9c1cf1d505c230c93
SHA1ba46caed625226662d476e82d3eaedd3fd794556
SHA25693a442dc694c0a7deceeadb18acef501c3ed509d2461e3f7ea579995d7c2a010
SHA5122647964db34ba81dea0af2a500954e9d784ed6db91dc532288ff901db814430987128e32fb1fea47561a56edc62a3a489bc19f3f78a306b768bed884b2dddb13
-
Filesize
225B
MD5588b36ad0349504f89ab58783e372bbe
SHA13d8e552697aede65d76b263eaeadedd348a748d5
SHA25619e023087d1df320b2cba5d40ba5d4614b29ef40b88c311efc1eb29e215778fd
SHA5126ee68fd75b2e2e0ad745eb0803902bf072a871737cb025f82e51bd454580fd6d87ac4b0d9c2cdb0228ee965ef5d14ac22e5960e9ea8f51172f32bf49ad821d27
-
Filesize
72KB
-
Filesize
344KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
5.2MB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
3.7MB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
56KB
-
Filesize
344KB
-
Filesize
72KB