Overview

overview

10

Static

static

3

e83194ac6a...f1.exe

windows7-x64

10

e83194ac6a...f1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2025, 12:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe
  • Size 1.5MB
  • Sample250118-n698fasncw
  • SHA256 e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratevasionexecutioninfostealerpersistencerattrojan

Malware Config

Signatures

  • DcRat 9 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Modifies WinLogon for persistence 2 TTPs 7 IoCs
    persistence
  • Process spawned unexpected child process 7 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 51 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 17 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 34 IoCs
    evasiontrojan
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 17 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 51 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe
    "C:\Users\Admin\AppData\Local\Temp\e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe"
    1⤵
    • DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\StartMenuExperienceHost.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\csrss.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1668
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Registry.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:680
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\dwm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1460
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\mfc110kor\SppExtComObj.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4496
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\KBDHELA2\dwm.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1656
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\RemoteSystemToastIcon.contrast-white\RuntimeBroker.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3184
    • C:\Windows\System32\mfc110kor\SppExtComObj.exe
      "C:\Windows\System32\mfc110kor\SppExtComObj.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4464
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3decb2dd-640a-4212-906b-c00c698bebb0.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\System32\mfc110kor\SppExtComObj.exe
          C:\Windows\System32\mfc110kor\SppExtComObj.exe
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4876
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1e4e7d7-faef-4968-bc84-bb37ecaa36cc.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5072
            • C:\Windows\System32\mfc110kor\SppExtComObj.exe
              C:\Windows\System32\mfc110kor\SppExtComObj.exe
              6⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4172
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3390f92a-225d-49f2-a653-bdcf722266fd.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2040
                • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                  C:\Windows\System32\mfc110kor\SppExtComObj.exe
                  8⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1816
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\16bb47fa-e7fa-472f-880c-a42feb0e96bf.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3280
                    • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                      C:\Windows\System32\mfc110kor\SppExtComObj.exe
                      10⤵
                      • UAC bypass
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4416
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\378200ae-29cd-43c2-8f07-6158b2fab079.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4460
                        • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                          C:\Windows\System32\mfc110kor\SppExtComObj.exe
                          12⤵
                          • UAC bypass
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          • System policy modification
                          PID:4228
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\899e3868-c43e-4fb9-8b85-6268b8a4ad14.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1848
                            • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                              C:\Windows\System32\mfc110kor\SppExtComObj.exe
                              14⤵
                              • UAC bypass
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:5076
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0920e4a3-563a-4905-8439-c4375998ba67.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1456
                                • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                  C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                  16⤵
                                  • UAC bypass
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  • System policy modification
                                  PID:2692
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1b33e68-039d-4af1-9917-5f69a80b4d2b.vbs"
                                    17⤵
                                      PID:4440
                                      • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                        C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                        18⤵
                                        • UAC bypass
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • System policy modification
                                        PID:4680
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9717ccd1-06fc-47cc-8279-7db2a158039e.vbs"
                                          19⤵
                                            PID:5104
                                            • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                              C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                              20⤵
                                              • UAC bypass
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Checks whether UAC is enabled
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              • System policy modification
                                              PID:2304
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\270dd4aa-5d21-46f1-b709-62410b1d0499.vbs"
                                                21⤵
                                                  PID:552
                                                  • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                    C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                    22⤵
                                                    • UAC bypass
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • System policy modification
                                                    PID:4832
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7fcab5a5-f5dc-46f1-bb7a-3698ded7f0da.vbs"
                                                      23⤵
                                                        PID:2884
                                                        • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                          C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                          24⤵
                                                          • UAC bypass
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Checks whether UAC is enabled
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • System policy modification
                                                          PID:3180
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af3131b2-e459-4636-9303-88d9f30ad175.vbs"
                                                            25⤵
                                                              PID:4004
                                                              • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                26⤵
                                                                • UAC bypass
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Checks whether UAC is enabled
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • System policy modification
                                                                PID:1020
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c7022bd0-11e2-4e78-898c-e7ecaf8fcc68.vbs"
                                                                  27⤵
                                                                    PID:4476
                                                                    • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                      C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                      28⤵
                                                                      • UAC bypass
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks whether UAC is enabled
                                                                      • Modifies registry class
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • System policy modification
                                                                      PID:1276
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1714a8b1-3573-419b-ab19-2c16c6610d55.vbs"
                                                                        29⤵
                                                                          PID:2016
                                                                          • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                            C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                            30⤵
                                                                            • UAC bypass
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Checks whether UAC is enabled
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • System policy modification
                                                                            PID:4780
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2b8be88-cd5c-47f1-9861-508450197fc4.vbs"
                                                                              31⤵
                                                                                PID:5048
                                                                                • C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                                  C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                                                  32⤵
                                                                                  • UAC bypass
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • System policy modification
                                                                                  PID:3348
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c3577c7-eada-42da-9032-6bcb4ac02d3f.vbs"
                                                                                    33⤵
                                                                                      PID:2944
                                                                                    • C:\Windows\System32\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3eae1f92-d96d-433e-a955-8266d07835ba.vbs"
                                                                                      33⤵
                                                                                        PID:4472
                                                                                  • C:\Windows\System32\WScript.exe
                                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4bd42db0-9828-4ea9-bcd5-d2742cd2968f.vbs"
                                                                                    31⤵
                                                                                      PID:2556
                                                                                • C:\Windows\System32\WScript.exe
                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76148fb4-8e23-4e07-80cc-2409d703973d.vbs"
                                                                                  29⤵
                                                                                    PID:4576
                                                                              • C:\Windows\System32\WScript.exe
                                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2a95e19-398b-4bb5-a3b8-8fd689dd4ba4.vbs"
                                                                                27⤵
                                                                                  PID:3412
                                                                            • C:\Windows\System32\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0de467e-6b5b-4a70-b9fe-24281075822b.vbs"
                                                                              25⤵
                                                                                PID:3540
                                                                          • C:\Windows\System32\WScript.exe
                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27303192-9aec-4ee7-9c2e-1ee80a29b0a4.vbs"
                                                                            23⤵
                                                                              PID:1912
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5d5f1bd-06f8-40f7-b548-ba86b5167d3d.vbs"
                                                                          21⤵
                                                                            PID:860
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf50ee4c-d6fd-4103-8741-8cd2d72f9958.vbs"
                                                                        19⤵
                                                                          PID:4768
                                                                    • C:\Windows\System32\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2186906a-566d-4412-8bdf-154fab9181fb.vbs"
                                                                      17⤵
                                                                        PID:1804
                                                                  • C:\Windows\System32\WScript.exe
                                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93459b80-2b5f-4c03-948e-dee359e81f9e.vbs"
                                                                    15⤵
                                                                      PID:3184
                                                                • C:\Windows\System32\WScript.exe
                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\632ee623-a3a1-4b19-a98e-477bd3fa1736.vbs"
                                                                  13⤵
                                                                    PID:3928
                                                              • C:\Windows\System32\WScript.exe
                                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\338fd728-e9fa-4942-b110-2f676632a030.vbs"
                                                                11⤵
                                                                  PID:3200
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\93caa16d-bcc9-4764-bc63-f6f33a85287e.vbs"
                                                              9⤵
                                                                PID:2000
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\761b22f5-5532-4b4c-8a6b-1108a769b315.vbs"
                                                            7⤵
                                                              PID:3252
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\733d299f-9cf0-4701-bc71-ddc14e062271.vbs"
                                                          5⤵
                                                            PID:2128
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54988067-ae88-4c65-b87c-1b798b80cf34.vbs"
                                                        3⤵
                                                          PID:4608
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Cursors\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • DcRat
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4512
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\csrss.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • DcRat
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:1136
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Registry.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • DcRat
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:544
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Desktop\dwm.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • DcRat
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:560
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\mfc110kor\SppExtComObj.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • DcRat
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2596
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\KBDHELA2\dwm.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • DcRat
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:4936
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\RemoteSystemToastIcon.contrast-white\RuntimeBroker.exe'" /rl HIGHEST /f
                                                      1⤵
                                                      • DcRat
                                                      • Process spawned unexpected child process
                                                      • Scheduled Task/Job: Scheduled Task
                                                      PID:2716

                                                    Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Execution

                                                          Command and Scripting Interpreter

                                                          1
                                                          T1059

                                                          PowerShell

                                                          1
                                                          T1059.001

                                                          Scheduled Task/Job

                                                          1
                                                          T1053

                                                          Scheduled Task

                                                          1
                                                          T1053.005

                                                          Persistence

                                                          Boot or Logon Autostart Execution

                                                          2
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          1
                                                          T1547.001

                                                          Winlogon Helper DLL

                                                          1
                                                          T1547.004

                                                          Scheduled Task/Job

                                                          1
                                                          T1053

                                                          Scheduled Task

                                                          1
                                                          T1053.005

                                                          Privilege Escalation

                                                          Abuse Elevation Control Mechanism

                                                          1
                                                          T1548

                                                          Bypass User Account Control

                                                          1
                                                          T1548.002

                                                          Boot or Logon Autostart Execution

                                                          2
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          1
                                                          T1547.001

                                                          Winlogon Helper DLL

                                                          1
                                                          T1547.004

                                                          Scheduled Task/Job

                                                          1
                                                          T1053

                                                          Scheduled Task

                                                          1
                                                          T1053.005

                                                          Defense Evasion

                                                          Abuse Elevation Control Mechanism

                                                          1
                                                          T1548

                                                          Bypass User Account Control

                                                          1
                                                          T1548.002

                                                          Impair Defenses

                                                          1
                                                          T1562

                                                          Disable or Modify Tools

                                                          1
                                                          T1562.001

                                                          Modify Registry

                                                          4
                                                          T1112

                                                          Credential Access

                                                          Discovery

                                                          Query Registry

                                                          2
                                                          T1012

                                                          System Information Discovery

                                                          3
                                                          T1082

                                                          Lateral Movement

                                                          Collection

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          SppExtComObj.exe.log
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SppExtComObj.exe.log
                                                          • Size 1KB
                                                          • SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          powershell.exe.log
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                          • Size 2KB
                                                          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          StartupProfileData-NonInteractive
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          • Size 944B
                                                          • SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          StartupProfileData-NonInteractive
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          • Size 944B
                                                          • SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          StartupProfileData-NonInteractive
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          • Size 944B
                                                          • SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          0920e4a3-563a-4905-8439-c4375998ba67.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\0920e4a3-563a-4905-8439-c4375998ba67.vbs
                                                          • Size 722B
                                                          • SHA256 cdb50786acca67ab094d8452b5d6aea818172ce5ee85f9a91181c4f6c0222663
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          16bb47fa-e7fa-472f-880c-a42feb0e96bf.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\16bb47fa-e7fa-472f-880c-a42feb0e96bf.vbs
                                                          • Size 722B
                                                          • SHA256 cfe4b1eb161434add1e604c30ccb1956dd2944f406d47c512e1b7d5ebf4c855e
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          1714a8b1-3573-419b-ab19-2c16c6610d55.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\1714a8b1-3573-419b-ab19-2c16c6610d55.vbs
                                                          • Size 722B
                                                          • SHA256 b7c401b430949e2c5491c413bb8d735b13d8f9e20129f9f7b2f72681006efbd3
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          270dd4aa-5d21-46f1-b709-62410b1d0499.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\270dd4aa-5d21-46f1-b709-62410b1d0499.vbs
                                                          • Size 722B
                                                          • SHA256 dfed382d977b9a93117bd78a6f9c83730079737dab4286dd5cd6dcb3bca63e0b
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          3390f92a-225d-49f2-a653-bdcf722266fd.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\3390f92a-225d-49f2-a653-bdcf722266fd.vbs
                                                          • Size 722B
                                                          • SHA256 c91c93f4e7f91f217444581ed04d7b174176b45f1b18d95175a10e074580db91
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          378200ae-29cd-43c2-8f07-6158b2fab079.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\378200ae-29cd-43c2-8f07-6158b2fab079.vbs
                                                          • Size 722B
                                                          • SHA256 e45cb39ddbdffa13832b9fab65957382807eb580006f302e4cb36fe6e151acab
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          3decb2dd-640a-4212-906b-c00c698bebb0.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\3decb2dd-640a-4212-906b-c00c698bebb0.vbs
                                                          • Size 722B
                                                          • SHA256 cbaa397ef658faf9fe659b6db00d06d0c209df8fa2241a6dec558fb5435725d0
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          54988067-ae88-4c65-b87c-1b798b80cf34.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\54988067-ae88-4c65-b87c-1b798b80cf34.vbs
                                                          • Size 498B
                                                          • SHA256 3cfd85471f1a0bc0a27806224750edf277761f5d3c1b4d275c0dadbd8ef41eee
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          7fcab5a5-f5dc-46f1-bb7a-3698ded7f0da.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\7fcab5a5-f5dc-46f1-bb7a-3698ded7f0da.vbs
                                                          • Size 722B
                                                          • SHA256 1227535bc09091599b241dbe49bd5b32e05ff75501cdbd7490d486bfd00cff67
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          899e3868-c43e-4fb9-8b85-6268b8a4ad14.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\899e3868-c43e-4fb9-8b85-6268b8a4ad14.vbs
                                                          • Size 722B
                                                          • SHA256 3fc5f06b1bf67e5153d9d406c2d9ce670bdefef19813262df3590932ba20794f
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          9717ccd1-06fc-47cc-8279-7db2a158039e.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\9717ccd1-06fc-47cc-8279-7db2a158039e.vbs
                                                          • Size 722B
                                                          • SHA256 c2d891706717f899d5e770cf3f7b2ad2352286cbc854d7dea4a8262931289ab5
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          __PSScriptPolicyTest_gvxfnbfr.vw1.ps1
                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gvxfnbfr.vw1.ps1
                                                          • Size 60B
                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          af3131b2-e459-4636-9303-88d9f30ad175.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\af3131b2-e459-4636-9303-88d9f30ad175.vbs
                                                          • Size 722B
                                                          • SHA256 d86a651211393b719bbb9ef01d7dc579422e677147b4d66fae20fddb8bf64d98
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          b1b33e68-039d-4af1-9917-5f69a80b4d2b.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\b1b33e68-039d-4af1-9917-5f69a80b4d2b.vbs
                                                          • Size 722B
                                                          • SHA256 4e23d0c565d4500f78f0977a6f05b1521592ac965f2b8817858d872e30ea790b
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          c1e4e7d7-faef-4968-bc84-bb37ecaa36cc.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\c1e4e7d7-faef-4968-bc84-bb37ecaa36cc.vbs
                                                          • Size 722B
                                                          • SHA256 8583ecf166f4f4eba99b5712ef955dc24fbaffe17e31569f0478cd5897fb1bec
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          c7022bd0-11e2-4e78-898c-e7ecaf8fcc68.vbs
                                                          • Path C:\Users\Admin\AppData\Local\Temp\c7022bd0-11e2-4e78-898c-e7ecaf8fcc68.vbs
                                                          • Size 722B
                                                          • SHA256 2dbe016e6db3aa497252b6b4d51afac2149fd1bf3cf62650a3dddcde69571c40
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          SppExtComObj.exe
                                                          • Path C:\Windows\System32\mfc110kor\SppExtComObj.exe
                                                          • Size 1.5MB
                                                          • SHA256 e83194ac6af90662225fd216fae289c52a2d8392bbc35a2b1e131bef7ae354f1
                                                          • MD5 SHA1 SHA512 SSDEEP
                                                          Submit Download

                                                          memory/3180-364-0x0000000001270000-0x0000000001282000-memory.dmp
                                                          Download

                                                          memory/3348-404-0x0000000002DD0000-0x0000000002DE2000-memory.dmp
                                                          Download

                                                          memory/3356-13-0x0000000003170000-0x000000000317A000-memory.dmp
                                                          Download

                                                          memory/3356-14-0x0000000003180000-0x000000000318C000-memory.dmp
                                                          Download

                                                          memory/3356-219-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp
                                                          Download

                                                          memory/3356-1-0x0000000000E30000-0x0000000000FAE000-memory.dmp
                                                          Download

                                                          memory/3356-25-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp
                                                          Download

                                                          memory/3356-24-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp
                                                          Download

                                                          memory/3356-21-0x000000001C430000-0x000000001C438000-memory.dmp
                                                          Download

                                                          memory/3356-20-0x00000000031D0000-0x00000000031DC000-memory.dmp
                                                          Download

                                                          memory/3356-18-0x00000000031C0000-0x00000000031C8000-memory.dmp
                                                          Download

                                                          memory/3356-17-0x00000000031B0000-0x00000000031BC000-memory.dmp
                                                          Download

                                                          memory/3356-2-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp
                                                          Download

                                                          memory/3356-16-0x00000000031A0000-0x00000000031A8000-memory.dmp
                                                          Download

                                                          memory/3356-15-0x0000000003190000-0x000000000319A000-memory.dmp
                                                          Download

                                                          memory/3356-4-0x0000000003080000-0x0000000003092000-memory.dmp
                                                          Download

                                                          memory/3356-3-0x0000000001A00000-0x0000000001A08000-memory.dmp
                                                          Download

                                                          memory/3356-5-0x00000000030F0000-0x00000000030FC000-memory.dmp
                                                          Download

                                                          memory/3356-0-0x00007FFDEED13000-0x00007FFDEED15000-memory.dmp
                                                          Download

                                                          memory/3356-12-0x0000000003160000-0x0000000003168000-memory.dmp
                                                          Download

                                                          memory/3356-11-0x0000000003150000-0x0000000003160000-memory.dmp
                                                          Download

                                                          memory/3356-6-0x00000000030E0000-0x00000000030EA000-memory.dmp
                                                          Download

                                                          memory/3356-10-0x0000000003140000-0x0000000003150000-memory.dmp
                                                          Download

                                                          memory/3356-9-0x0000000003130000-0x000000000313C000-memory.dmp
                                                          Download

                                                          memory/3356-8-0x0000000003120000-0x0000000003128000-memory.dmp
                                                          Download

                                                          memory/3356-7-0x0000000003100000-0x000000000310C000-memory.dmp
                                                          Download

                                                          memory/4172-263-0x0000000002CF0000-0x0000000002D02000-memory.dmp
                                                          Download

                                                          memory/4464-248-0x000000001C4C0000-0x000000001C5C2000-memory.dmp
                                                          Download

                                                          memory/4464-220-0x00000000025C0000-0x00000000025D2000-memory.dmp
                                                          Download

                                                          memory/4544-140-0x000002A05B250000-0x000002A05B272000-memory.dmp
                                                          Download

                                                          memory/4780-396-0x0000000002A60000-0x0000000002A72000-memory.dmp
                                                          Download

                                                          memory/4876-261-0x000000001B990000-0x000000001BA92000-memory.dmp
                                                          Download

                                                          memory/5076-308-0x0000000001AF0000-0x0000000001B02000-memory.dmp
                                                          Download