Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2025, 01:54
Behavioral task
behavioral1
Sample
4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe
Resource
win10v2004-20250207-en
General
-
Target
4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe
-
Size
1.1MB
-
MD5
96762861297137fcb398d06650143520
-
SHA1
0a3f0d2f09598f0b2ad81e1f0de0534246a66658
-
SHA256
4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62
-
SHA512
18e1421334bd89d28859e2c29b6d7ed139fd36f1ab881bf1fe6f6ff07670f14b2a2f9d34f99015376055a776872da70a47c33e8ab3e9b55f5305ce6f49adf87a
-
SSDEEP
24576:U2G/nvxW3Ww0t7CZRYAhTSMw5jwtI87ULgJDN6/:UbA307U1hwi97rDs
Malware Config
Signatures
-
DcRat 32 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 2004 schtasks.exe 2360 schtasks.exe 864 schtasks.exe 4392 schtasks.exe 5024 schtasks.exe 2436 schtasks.exe 2536 schtasks.exe File created C:\Windows\Downloaded Program Files\22eafd247d37c3 MsNet.exe 2080 schtasks.exe 3792 schtasks.exe 4996 schtasks.exe 4000 schtasks.exe 2476 schtasks.exe 3144 schtasks.exe 2800 schtasks.exe 1588 schtasks.exe 3296 schtasks.exe 2584 schtasks.exe 3076 schtasks.exe 2356 schtasks.exe 2864 schtasks.exe 2680 schtasks.exe 4928 schtasks.exe 2396 schtasks.exe 3740 schtasks.exe 4160 schtasks.exe 3300 schtasks.exe 4352 schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe 4868 schtasks.exe 652 schtasks.exe 3316 schtasks.exe -
Dcrat family
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3144 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3076 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3316 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4352 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4392 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3792 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4928 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2476 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3300 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2800 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 652 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2004 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5024 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3740 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2360 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2436 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4996 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4160 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3296 2040 schtasks.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4000 2040 schtasks.exe 96 -
resource yara_rule behavioral2/files/0x0007000000023e09-10.dat dcrat behavioral2/memory/4124-13-0x0000000000EB0000-0x0000000000F86000-memory.dmp dcrat -
Downloads MZ/PE file 1 IoCs
flow pid Process 61 1952 Process not Found -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation 4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe Key value queried \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation MsNet.exe Key value queried \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000\Control Panel\International\Geo\Nation MsNet.exe -
Executes dropped EXE 3 IoCs
pid Process 4124 MsNet.exe 3140 MsNet.exe 2180 csrss.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Downloaded Program Files\TextInputHost.exe MsNet.exe File created C:\Windows\Downloaded Program Files\22eafd247d37c3 MsNet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 316 MicrosoftEdgeUpdate.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000_Classes\Local Settings MsNet.exe Key created \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000_Classes\Local Settings MsNet.exe Key created \REGISTRY\USER\S-1-5-21-189444705-1272902858-1305688695-1000_Classes\Local Settings 4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3144 schtasks.exe 1588 schtasks.exe 2800 schtasks.exe 2584 schtasks.exe 3076 schtasks.exe 2864 schtasks.exe 864 schtasks.exe 4928 schtasks.exe 2476 schtasks.exe 652 schtasks.exe 2004 schtasks.exe 5024 schtasks.exe 4000 schtasks.exe 4160 schtasks.exe 2356 schtasks.exe 4352 schtasks.exe 2680 schtasks.exe 2536 schtasks.exe 4868 schtasks.exe 2360 schtasks.exe 4996 schtasks.exe 3316 schtasks.exe 4392 schtasks.exe 3792 schtasks.exe 3740 schtasks.exe 3296 schtasks.exe 2080 schtasks.exe 2396 schtasks.exe 2436 schtasks.exe 3300 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4124 MsNet.exe 3140 MsNet.exe 2180 csrss.exe 2180 csrss.exe 2180 csrss.exe 2180 csrss.exe 2180 csrss.exe 2180 csrss.exe 2180 csrss.exe 2180 csrss.exe 2180 csrss.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4124 MsNet.exe Token: SeDebugPrivilege 3140 MsNet.exe Token: SeDebugPrivilege 2180 csrss.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2408 2436 4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe 87 PID 2436 wrote to memory of 2408 2436 4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe 87 PID 2436 wrote to memory of 2408 2436 4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe 87 PID 2408 wrote to memory of 2640 2408 WScript.exe 93 PID 2408 wrote to memory of 2640 2408 WScript.exe 93 PID 2408 wrote to memory of 2640 2408 WScript.exe 93 PID 2640 wrote to memory of 4124 2640 cmd.exe 95 PID 2640 wrote to memory of 4124 2640 cmd.exe 95 PID 4124 wrote to memory of 2772 4124 MsNet.exe 116 PID 4124 wrote to memory of 2772 4124 MsNet.exe 116 PID 2772 wrote to memory of 4904 2772 cmd.exe 118 PID 2772 wrote to memory of 4904 2772 cmd.exe 118 PID 2772 wrote to memory of 3140 2772 cmd.exe 125 PID 2772 wrote to memory of 3140 2772 cmd.exe 125 PID 3140 wrote to memory of 3936 3140 MsNet.exe 138 PID 3140 wrote to memory of 3936 3140 MsNet.exe 138 PID 3936 wrote to memory of 4784 3936 cmd.exe 140 PID 3936 wrote to memory of 4784 3936 cmd.exe 140 PID 3936 wrote to memory of 2180 3936 cmd.exe 145 PID 3936 wrote to memory of 2180 3936 cmd.exe 145 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe"C:\Users\Admin\AppData\Local\Temp\4f54be07cc25b4d61afd354db8f85494a8de5d6e382056e658b14a4ae528da62N.exe"1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockBrowserreviewHostNet\xY4XW4YtsslkN8YkwUCHQrB1.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\blockBrowserreviewHostNet\87bfrCyVy.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\blockBrowserreviewHostNet\MsNet.exe"C:\blockBrowserreviewHostNet\MsNet.exe"4⤵
- DcRat
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kitFqHqIkB.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4904
-
-
C:\blockBrowserreviewHostNet\MsNet.exe"C:\blockBrowserreviewHostNet\MsNet.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pqLkBczNWm.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4784
-
-
C:\Users\Admin\csrss.exe"C:\Users\Admin\csrss.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\wininit.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\SendTo\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Windows\Downloaded Program Files\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\sysmon.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\Favorites\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\sysmon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MicrosoftEdgeUpdateM" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Packages\MicrosoftEdgeUpdate.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MicrosoftEdgeUpdate" /sc ONLOGON /tr "'C:\Users\All Users\Packages\MicrosoftEdgeUpdate.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MicrosoftEdgeUpdateM" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Packages\MicrosoftEdgeUpdate.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4000
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QjlFQTA3QTEtQjlGRS00NEY2LUE0RDItM0I4NkU2Qjk2Njg0fSIgdXNlcmlkPSJ7QzU1RjVCMUUtNjEwQi00MEU5LTlGOTYtQkFBMzBBQzRCNkM0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTFBNzYwRTUtQzJFNC00MEMzLTlCMjctRkM4RUZFQzE1NEFDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1Mjg1MTI1ODgyIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
203B
MD5f53c877d1cc6dd73b987cefd4be0a1f1
SHA1327a1ec0e4dbda1cf6ee867f865d6634314d10cd
SHA256d5c0d12892664f70fc6cbfd95b03aad76be5bbf9c2584761492900b854d43415
SHA5125a93d278a7e9ce3933d3681198be87e1abc26c8165179dd751e2610407e01e388f87f8bd1f55873a9ddba76e59578e633ee5b94decdf6eb66a9c2e4e1c03b4c9
-
Filesize
189B
MD5603e26b70a14a22bc993c4440ac78e49
SHA1ce2d48fff8af3146d640ae56cbdacbf018a4a60c
SHA256f1535ed1c6dc2b76414ed77ae4ea1bb91df3d5196439593ab89b892fcd95ad86
SHA512b87fd006476b73672eac7924624921b2c71a497ed22952113b7ac37cc8a8628046d9f4631087a98b3265c9078b141c790ebcaf9ae2a122749506baea4da05fb2
-
Filesize
40B
MD5a690f6e0c6d43487eedaae5b8721661e
SHA1f0e210dff9aa0dcc326c6577ad5199803b3f66f1
SHA25618722e015c6a07d67ca50a098185e1af251f5f674347a9c69eb9cb5adc1301ce
SHA5126cdd3069caf010cd1c3377799866bda5b8e72e41a708e4ed5f90ea6be699083c02e98c2f000545c04fe605e4b748881e108140bce784f23e99030b0750a8f034
-
Filesize
828KB
MD533c65cd1ae7664ac1d8fae6aeec4349a
SHA1d4346a7c78b34112f27f2aa00fa85b9355fde4c8
SHA256046c832bbe0d9da1405f4074c47ff461eee6b1132d8f24ae76cdea982f470348
SHA512bed32cc887d01236847d92b00437fc13fc6157bd9f668565cd5975f1158ee1d4baccc0daf9466cd02d5626ed18df8fd4bd0917d8d20db5237c4e476e9b7df3d6
-
Filesize
211B
MD52e5288c585bc259f4b5f835eed2a7db2
SHA1e77c36f0c62b9b375d0e1cd28569b62ca06061b3
SHA256ce92b84237a2da62b260ed2bcaa5c3ea57635e1a26e269c526b64eabe8ba6080
SHA512e2ee7af7b5bf9ea47f5cb6eb0a96e23262fb6948089baefe9b95bafca52e48ffff0198a06dfea0ad12b6b4e6fd024095b79ac56cd31c8784a2d745f963e06359