Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/01/2025, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
CrackLauncher.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CrackLauncher.exe
Resource
win10v2004-20241007-en
General
-
Target
CrackLauncher.exe
-
Size
6.5MB
-
MD5
dd045e7803ef620069b0e90d9128375f
-
SHA1
983de7fc238cac0de7b2d74b86617501dbbfc9c6
-
SHA256
b56efb3ca8906a817613e7e0899cffa1f5d23d39164153dc2567cf10a0314fb4
-
SHA512
3ef80acad4b09dbb84835520f249c3970f0574156e77155f496dddb46927d407773315f34c4c38277e34825ac6401159b5df06776140b20fb9f820f0a4859886
-
SSDEEP
196608:nuaAxSTZLvD6/x1R92cJUMo7xS6eUEMW42:nRAh5n9/GMolS6eyWZ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1560 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 264 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1864 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2240 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2380 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1752 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1104 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 804 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1316 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2312 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 716 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 556 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 784 2900 schtasks.exe 39 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 348 2900 schtasks.exe 39 -
DCRat payload 14 IoCs
resource yara_rule behavioral1/files/0x000700000001867d-42.dat family_dcrat_v2 behavioral1/memory/2620-47-0x0000000000400000-0x00000000004FD000-memory.dmp family_dcrat_v2 behavioral1/memory/1788-62-0x00000000000F0000-0x00000000001B6000-memory.dmp family_dcrat_v2 behavioral1/memory/2436-88-0x0000000001300000-0x00000000013C6000-memory.dmp family_dcrat_v2 behavioral1/memory/2560-109-0x0000000000110000-0x00000000001D6000-memory.dmp family_dcrat_v2 behavioral1/memory/2052-120-0x00000000012E0000-0x00000000013A6000-memory.dmp family_dcrat_v2 behavioral1/memory/1640-131-0x00000000002A0000-0x0000000000366000-memory.dmp family_dcrat_v2 behavioral1/memory/1292-142-0x0000000000360000-0x0000000000426000-memory.dmp family_dcrat_v2 behavioral1/memory/2040-153-0x0000000001190000-0x0000000001256000-memory.dmp family_dcrat_v2 behavioral1/memory/2248-214-0x00000000001D0000-0x0000000000296000-memory.dmp family_dcrat_v2 behavioral1/memory/3064-225-0x0000000000DE0000-0x0000000000EA6000-memory.dmp family_dcrat_v2 behavioral1/memory/2172-236-0x0000000000290000-0x0000000000356000-memory.dmp family_dcrat_v2 behavioral1/memory/1960-247-0x0000000000E70000-0x0000000000F36000-memory.dmp family_dcrat_v2 behavioral1/memory/1784-258-0x0000000001060000-0x0000000001126000-memory.dmp family_dcrat_v2 -
Executes dropped EXE 21 IoCs
pid Process 2784 svchost.exe 2568 explorer.exe 2648 yAMgrsRV0v.exe 1788 M9OpOHJOcY.exe 2436 M9OpOHJOcY.exe 1776 M9OpOHJOcY.exe 2560 M9OpOHJOcY.exe 2052 M9OpOHJOcY.exe 1640 M9OpOHJOcY.exe 1292 M9OpOHJOcY.exe 2040 M9OpOHJOcY.exe 2244 M9OpOHJOcY.exe 2068 M9OpOHJOcY.exe 1532 M9OpOHJOcY.exe 2612 M9OpOHJOcY.exe 1420 M9OpOHJOcY.exe 2248 M9OpOHJOcY.exe 3064 M9OpOHJOcY.exe 2172 M9OpOHJOcY.exe 1960 M9OpOHJOcY.exe 1784 M9OpOHJOcY.exe -
Loads dropped DLL 5 IoCs
pid Process 2708 CrackLauncher.exe 2652 Process not Found 2708 CrackLauncher.exe 2620 RegAsm.exe 2620 RegAsm.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2784 svchost.exe 2784 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2568 set thread context of 2620 2568 explorer.exe 35 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\dwm.exe M9OpOHJOcY.exe File created C:\Program Files (x86)\Microsoft Office\Stationery\1033\6cb0b6c459d5d3 M9OpOHJOcY.exe File created C:\Program Files\Windows Defender\ja-JP\csrss.exe M9OpOHJOcY.exe File created C:\Program Files\Windows Defender\ja-JP\886983d96e3d3e M9OpOHJOcY.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CrackLauncher.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1904 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1904 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 264 schtasks.exe 1864 schtasks.exe 2240 schtasks.exe 1316 schtasks.exe 348 schtasks.exe 2380 schtasks.exe 804 schtasks.exe 716 schtasks.exe 784 schtasks.exe 1560 schtasks.exe 1684 schtasks.exe 2188 schtasks.exe 1104 schtasks.exe 556 schtasks.exe 3064 schtasks.exe 1752 schtasks.exe 2356 schtasks.exe 2312 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2784 svchost.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 1788 M9OpOHJOcY.exe 2436 M9OpOHJOcY.exe 2436 M9OpOHJOcY.exe 2436 M9OpOHJOcY.exe 2436 M9OpOHJOcY.exe 2436 M9OpOHJOcY.exe 2436 M9OpOHJOcY.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 1788 M9OpOHJOcY.exe Token: SeDebugPrivilege 2436 M9OpOHJOcY.exe Token: SeDebugPrivilege 1776 M9OpOHJOcY.exe Token: SeDebugPrivilege 2560 M9OpOHJOcY.exe Token: SeDebugPrivilege 2052 M9OpOHJOcY.exe Token: SeDebugPrivilege 1640 M9OpOHJOcY.exe Token: SeDebugPrivilege 1292 M9OpOHJOcY.exe Token: SeDebugPrivilege 2040 M9OpOHJOcY.exe Token: SeDebugPrivilege 2244 M9OpOHJOcY.exe Token: SeDebugPrivilege 2068 M9OpOHJOcY.exe Token: SeDebugPrivilege 1532 M9OpOHJOcY.exe Token: SeDebugPrivilege 2612 M9OpOHJOcY.exe Token: SeDebugPrivilege 1420 M9OpOHJOcY.exe Token: SeDebugPrivilege 2248 M9OpOHJOcY.exe Token: SeDebugPrivilege 3064 M9OpOHJOcY.exe Token: SeDebugPrivilege 2172 M9OpOHJOcY.exe Token: SeDebugPrivilege 1960 M9OpOHJOcY.exe Token: SeDebugPrivilege 1784 M9OpOHJOcY.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2784 2708 CrackLauncher.exe 30 PID 2708 wrote to memory of 2784 2708 CrackLauncher.exe 30 PID 2708 wrote to memory of 2784 2708 CrackLauncher.exe 30 PID 2708 wrote to memory of 2784 2708 CrackLauncher.exe 30 PID 2708 wrote to memory of 2568 2708 CrackLauncher.exe 32 PID 2708 wrote to memory of 2568 2708 CrackLauncher.exe 32 PID 2708 wrote to memory of 2568 2708 CrackLauncher.exe 32 PID 2708 wrote to memory of 2568 2708 CrackLauncher.exe 32 PID 2708 wrote to memory of 2568 2708 CrackLauncher.exe 32 PID 2708 wrote to memory of 2568 2708 CrackLauncher.exe 32 PID 2708 wrote to memory of 2568 2708 CrackLauncher.exe 32 PID 2568 wrote to memory of 2596 2568 explorer.exe 34 PID 2568 wrote to memory of 2596 2568 explorer.exe 34 PID 2568 wrote to memory of 2596 2568 explorer.exe 34 PID 2568 wrote to memory of 2596 2568 explorer.exe 34 PID 2568 wrote to memory of 2596 2568 explorer.exe 34 PID 2568 wrote to memory of 2596 2568 explorer.exe 34 PID 2568 wrote to memory of 2596 2568 explorer.exe 34 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2568 wrote to memory of 2620 2568 explorer.exe 35 PID 2620 wrote to memory of 1788 2620 RegAsm.exe 37 PID 2620 wrote to memory of 1788 2620 RegAsm.exe 37 PID 2620 wrote to memory of 1788 2620 RegAsm.exe 37 PID 2620 wrote to memory of 1788 2620 RegAsm.exe 37 PID 2784 wrote to memory of 1464 2784 svchost.exe 38 PID 2784 wrote to memory of 1464 2784 svchost.exe 38 PID 2784 wrote to memory of 1464 2784 svchost.exe 38 PID 1788 wrote to memory of 1032 1788 M9OpOHJOcY.exe 58 PID 1788 wrote to memory of 1032 1788 M9OpOHJOcY.exe 58 PID 1788 wrote to memory of 1032 1788 M9OpOHJOcY.exe 58 PID 1032 wrote to memory of 3048 1032 cmd.exe 60 PID 1032 wrote to memory of 3048 1032 cmd.exe 60 PID 1032 wrote to memory of 3048 1032 cmd.exe 60 PID 1032 wrote to memory of 1784 1032 cmd.exe 61 PID 1032 wrote to memory of 1784 1032 cmd.exe 61 PID 1032 wrote to memory of 1784 1032 cmd.exe 61 PID 1032 wrote to memory of 2436 1032 cmd.exe 62 PID 1032 wrote to memory of 2436 1032 cmd.exe 62 PID 1032 wrote to memory of 2436 1032 cmd.exe 62 PID 2436 wrote to memory of 2996 2436 M9OpOHJOcY.exe 63 PID 2436 wrote to memory of 2996 2436 M9OpOHJOcY.exe 63 PID 2436 wrote to memory of 2996 2436 M9OpOHJOcY.exe 63 PID 2996 wrote to memory of 2508 2996 cmd.exe 65 PID 2996 wrote to memory of 2508 2996 cmd.exe 65 PID 2996 wrote to memory of 2508 2996 cmd.exe 65 PID 2996 wrote to memory of 1424 2996 cmd.exe 66 PID 2996 wrote to memory of 1424 2996 cmd.exe 66 PID 2996 wrote to memory of 1424 2996 cmd.exe 66 PID 2996 wrote to memory of 1776 2996 cmd.exe 67 PID 2996 wrote to memory of 1776 2996 cmd.exe 67 PID 2996 wrote to memory of 1776 2996 cmd.exe 67 PID 1776 wrote to memory of 3060 1776 M9OpOHJOcY.exe 68 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵PID:1464
-
-
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2596
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Roaming\yAMgrsRV0v.exe"C:\Users\Admin\AppData\Roaming\yAMgrsRV0v.exe"4⤵
- Executes dropped EXE
PID:2648
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4SWemvR2cI.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\system32\chcp.comchcp 650016⤵PID:3048
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1784
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UE63U4pwcK.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\system32\chcp.comchcp 650018⤵PID:2508
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:1424
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dmjHjjptz9.bat"9⤵PID:3060
-
C:\Windows\system32\chcp.comchcp 6500110⤵PID:2796
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1904
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8JExSyzmRo.bat"11⤵PID:2764
-
C:\Windows\system32\chcp.comchcp 6500112⤵PID:824
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:2388
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\h2sGrcN1Zw.bat"13⤵PID:2476
-
C:\Windows\system32\chcp.comchcp 6500114⤵PID:1992
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:1580
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YkVt9kOuik.bat"15⤵PID:596
-
C:\Windows\system32\chcp.comchcp 6500116⤵PID:328
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:1864
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1292 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bgR6NVhjy4.bat"17⤵PID:1708
-
C:\Windows\system32\chcp.comchcp 6500118⤵PID:1232
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:2336
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qWxuQCq4fF.bat"19⤵PID:2128
-
C:\Windows\system32\chcp.comchcp 6500120⤵PID:2516
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:1648
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AC4J3hngkK.bat"21⤵PID:1012
-
C:\Windows\system32\chcp.comchcp 6500122⤵PID:1872
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:2084
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2068 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eJ0bRSTnly.bat"23⤵PID:2452
-
C:\Windows\system32\chcp.comchcp 6500124⤵PID:3020
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:660
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1532 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3NuRVv1Ng8.bat"25⤵PID:2720
-
C:\Windows\system32\chcp.comchcp 6500126⤵PID:2552
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2668
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4kHW8Esv2t.bat"27⤵PID:2892
-
C:\Windows\system32\chcp.comchcp 6500128⤵PID:3068
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:1924
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aehWhM7TGU.bat"29⤵PID:2476
-
C:\Windows\system32\chcp.comchcp 6500130⤵PID:2160
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:1456
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2248 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xj8aQTjKDO.bat"31⤵PID:1560
-
C:\Windows\system32\chcp.comchcp 6500132⤵PID:2216
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:1956
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HaE3Dx3E3n.bat"33⤵PID:2356
-
C:\Windows\system32\chcp.comchcp 6500134⤵PID:1224
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:234⤵PID:772
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\b2RsHXtgrT.bat"35⤵PID:2692
-
C:\Windows\system32\chcp.comchcp 6500136⤵PID:2696
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:236⤵PID:1492
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\X8rw0eVXoN.bat"37⤵PID:316
-
C:\Windows\system32\chcp.comchcp 6500138⤵PID:848
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:238⤵PID:2616
-
-
C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\ja-JP\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\ja-JP\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\1033\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\1033\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\Stationery\1033\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "M9OpOHJOcYM" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "M9OpOHJOcY" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "M9OpOHJOcYM" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\M9OpOHJOcY.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
221B
MD55f2660226b2debcb7b3cf60cb24e1f28
SHA1fe41cc1ebb9b787a092983d3973b938b63333e02
SHA256e04f13011e908e0fd54f33768b6dd71f6d978db20b34e355fd6282065d2e05dc
SHA51266cec8220dd36545d17795ec7861685db03a1bbb76546bd87b77dbcf16ea23d00a5561626a2b305726d006dc059ba34d31f753e8991741e3c974896198b52949
-
Filesize
221B
MD5440bfd5ca0b780366a9bc2ef5cdfd716
SHA10c06cacab5de3fec139f44890fbf57def551ada5
SHA2568cfc1735f45f022273d0f063b2a38cf7a27c4996711078f31bb84c70f8fd6980
SHA512d8b34feb98c4d48255014f5856fdb3a903f0d64ee73022c98aa69074e0fcf0054cb0f9d9b023c012a8491563680bc6f2e81ee1edf6f065cb85a77d481d959c68
-
Filesize
221B
MD5f1f10c4b1122261d38d5e66414a117c0
SHA128c0a1780be59547f11cd5de6d54b8f5b6743a31
SHA256a3cd13950a498eb6380b23bdd714e250cad4fa1bcf4786dbed92dd4d06ae4f3c
SHA5121e4acf9bf7e8149bf5bcee2299fa0cb96acfe508ef89b17812590ff0455f149ad581163a632dd3f90cb58bd4d0a6eede71312b805b2f0d8c1e03dbb88f8cca89
-
Filesize
221B
MD58c147ce6d1360012cf77114300c710ce
SHA1b139ac6a3f0f2b8449f7887a10ac3037ecfabd5d
SHA25685cc4684a6467d2309f6193f929e6a2efad01dccff6858cbcbaff4c2b19f425e
SHA5122fb455f2086fd6a7307ba88268fb27b1a90c8233c6b755248c99973770df53f2d920a4f82f32a6e3dfb72672cae4869794c5da2fdf0c2dba484b6af769cd3e9c
-
Filesize
221B
MD5419ec075f639317390f3ffa35e4d21b0
SHA18f8e9ba7e7b60b81b9eb136c162251aa55339ba2
SHA256854a6e9bb9fca3c28f60d4fb10c85c93651d2c0dd512eb9967dd8acb544bd676
SHA51214bad89934e9a0094e8fc04c723099c3e224febf5faaf428b1ae042069481273e6c410ba01d205a24e5a2d577056ab4a465aafa140ede8c96b6f5451d628dbdd
-
Filesize
221B
MD5c8519d6c716997679d8193a593bc294c
SHA110f91ca97b4d279e058288df3df344ec68f9002c
SHA256d3440a71b266f7154e3fee2abab65e535e73c39b1a4a601e409ff1ffbb93d2ea
SHA5120e8fd17ade4bf056404cbb984ea3c80df3d9745efaeae9f9a765230572fda564750f452e780c7ff39b7fe9aedda4799bed12605f88b27a9ebe8de8eba1669125
-
Filesize
221B
MD5eac3ba668ba3df3efa302e98c7409165
SHA187701a72ef79b6f824badf6dfe249ca4d7f93c60
SHA2568b729777a6d3b06a5b5d2cb496ce01f6083f20ff565b704a88b6a5c120071109
SHA512552b76f757dde4328ae9934c8f65f53ee97d0bc13b7ccccf9d76d5069e0503ef5e3b813c3fddf5012b3daf9a5dd931f70b785ad26d9e5cf3521deab3caa847e1
-
Filesize
221B
MD5ddee561308d37c0d6aa703bb20ee2514
SHA1d950cf729b9f984eda9067f72aa427248882ac87
SHA256d03e96b171f8747ad93fb2abb9a0e070fb1c259ca5b48569c782d7c839f6b846
SHA51226067281eb00668a9138253c85640e49f9e6e4b0a50840fc5ab892ba59dd42ee45bdd2928044dc63a8f18bef60b949cdcf480d6a7f49ddc57f6ff17c2055f350
-
Filesize
221B
MD517d0675c7b52b11bd5eea4651ee47fba
SHA1fba82ecc160e82682d68794a3dcec617b29a6317
SHA256fcdbe3cb0d0e7148a889e7ecbd9d60f998fb6e8e1e5a8bf061c6e4e5171414f0
SHA512bdf22f2541c2aef5a15053541b509b6e65d87e064255a468a3c84cc1dc688c294748a9908ee7a8c80bfca36c99810c8bd1eddddfaa01eb2e3075c9801b5186c0
-
Filesize
221B
MD536976c3f74d1795fe75b0323e0639702
SHA19da2ca378817dd77baa9b07213a6a9d45ce44bc7
SHA256231a241d6797cec86fb9cb7e191cd702c0c1b3d57958b4caafaf584bd03a7e15
SHA512e248a3408ebdf3e5531467750e8dcea81ad353e0bbd1c017fda455c1792cd1807bcc4ead33b3587c1c37887387882af842d0d6d8b40d1bf7cc884879cf1c3ea3
-
Filesize
221B
MD576954a405a931b3884f6ad5271592c33
SHA154e178bafbd1beeee41af0628312cec07ec53ef5
SHA2568154201e26674dcede793209705c627e58b3d3ea76a7e2f231aff42c6542d519
SHA5121c1e16e1c6b274615378b235d4ccf05035e9be889bf4067d857db9468b5c151988d0d211afe17147e760c4ae28fb43da8b68e5b85074a78ebe7a708391f9f2ac
-
Filesize
221B
MD506e9fc41904cf41eb861b3d3ac7f4118
SHA158b2592f227116b34337c417651389e7d7b00737
SHA2561e3607ede488b1e4415845a21f83b52cd6dfe6b577bc05571ff26e1dcfbaa10f
SHA51272feb501e1b3093b96ed7377ad4aa8db1575a5197f298f6c7be4225310da03afb6a62b5fabe9082b55b2bdd77755ebba457ef1eace9b326361b44afefa2fda8a
-
Filesize
221B
MD5cc0e8a21eac9746cbfd66f654588e4ad
SHA1c01b47ade047d22b0bf67e13ead58fb9594afe3a
SHA256cb655363ec34f377cd6635f270c4aba428e875f1ca7a1c3dca323869f3c8b1ca
SHA5124d25dbce3907f34f7f6b189d8decaeb047a348b123f6651719fb984438349143c73bb9727667e77dbbdfd2743a75fbd5daf9b7ff7c292585352ca9a1106a7671
-
Filesize
173B
MD57f095c64ad7e454409aa3a2e9561435b
SHA10674ad5ed084021d7de6810be286e18363f9ea99
SHA256c979f076f14e77f0a146d97e42337047250b95df3c61bf7e98a68426445d425f
SHA51290729c256d814087662eeaa8e258b42074ebba92087461af6a58d5fc86617e7a96030294bf6ff84d36625db49c09ee03ae547a2e2e368a281a4e7653fe4393c7
-
Filesize
221B
MD5ed773fbe453d8b9deb687b71051087a1
SHA199b7a1aa88de3357c9b085134e375cc6ae33757b
SHA256e6ff2cd6c418f92eab7cd8c60edf0a87fc6e1a8d69954e6af802b2d8d7af4831
SHA512689ed53d62739f9137511fa32b63e1c4242166e867615a507ace82c7face76f446e07425dca0d8057acd93a9fbcd0e96e633b05f726748977abb74f3d1c2e221
-
Filesize
1009KB
MD537248e1253355bc6e356e31346f35e30
SHA176a4c49df25f3621ef38426d726eafd9f67be20b
SHA256917c39f77f2a2851383d506c884cc114a992c5e15d0c2993625a4b9186e26ad4
SHA5121e4f5eb77fed7a1a25f6684fcd42b3097e666ea942995027cf9eab3d4f176eed8c2c9f561cf6e53e8769890fcbf08e559cbe9c05d42ae8ce2dbecb8c7733fd08
-
Filesize
221B
MD544496ff1597b76545841a53a8d54bc03
SHA1c71b9595a0c7d4dab6836c0eac56244c993a1ab6
SHA2568c233a45ec23a768238ea0c58810f1888134bf78b838b183a967419743657f43
SHA512a4d41bedaf730f4ba1524aeca00344563c62201fca8a9400d88f7604e1723a77ddc1d223b37e2bf98227fb26fd466ae1abad004e33eb633c8beacd1683a09b56
-
Filesize
221B
MD502bee0bf3c21d31ad918561fcf4b835d
SHA1400d632f05b68593e1aba56f97004c3934a7a77d
SHA256284166172cc80b05ec0f693eb8424bfd688ed3d3b8653c09b741919876350f75
SHA512ac961453718713ef3bdbb1e8feeb9ac21c38cf194520eb979ef09c0fc2756658c44dff40839fe2ab8d1fbba309504aabe07ec90075d3843f1fdbbc1f63f465de
-
Filesize
18KB
MD5f3edff85de5fd002692d54a04bcb1c09
SHA14c844c5b0ee7cb230c9c28290d079143e00cb216
SHA256caf29650446db3842e1c1e8e5e1bafadaf90fc82c5c37b9e2c75a089b7476131
SHA512531d920e2567f58e8169afc786637c1a0f7b9b5c27b27b5f0eddbfc3e00cecd7bea597e34061d836647c5f8c7757f2fe02952a9793344e21b39ddd4bf7985f9d
-
Filesize
5.5MB
MD552aaa8c3fd6b813b713ae05ab9e4829c
SHA1d4ac8addbe5e15e867afe58f4bbb8319395ad38e
SHA2560c30d4cb510304d4ce140952f8ce316056cc4bc552cef78a81fd5301aecc1fd2
SHA512c39bba95a8554f1115d0362bad33901fd87e00d5de7671cd48d7b537c97889882b9009a83948087cf8516a32588e4ef831531977740b17a2791cec927934fdd8
-
Filesize
768KB
MD5e3aae84e507657a2a81745500460f5f7
SHA1dd53b7b8b0eab343f1ed3f0983326bc433304110
SHA256b8f3077a6dd5d704139f7ccfe6e453adf3ebc0100c617fd2c9f3c51650a0ea25
SHA5124bee0f7325bdb02528e78d21f65ccbdc9450316d6681022ddc6c85540a4a6b22c4cc4cfda36824a4e5c17a9b1f66845b61c82d822806dde1e006b9cee7da5d66