Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
11/03/2025, 07:59
General
-
Target
6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561.exe
-
Size
1.1MB
-
MD5
1a6a898a0abfa818a97e0c741f62a651
-
SHA1
e64e7fa94a829b00de8d7a9442745f1fccfd4d26
-
SHA256
6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561
-
SHA512
d659ce4b692548eb33283398b8065296a7fb251865734c0b6269b1618999c8da7cef528a0644e9ca83a89b5c194ca44de3b8ff34e77abc0c221756f0ce2ef9ca
-
SSDEEP
12288:qmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:qh4TbLUEhZL/GspeYhkc9Soh2SfwJ
Malware Config
Signatures
-
DcRat 14 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 13 IoCs
-
Process spawned unexpected child process 13 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 57 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 19 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 18 IoCs
-
Adds Run key to start application 2 TTPs 26 IoCs
-
Checks whether UAC is enabled 1 TTPs 38 IoCs
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 19 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 57 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561.exe"C:\Users\Admin\AppData\Local\Temp\6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\regid.1991-06.com.microsoft\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Application Data\csrss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\RmClient\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\DefaultSettings\SearchApp.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CpiVCPGEhG.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561.exe"C:\Users\Admin\AppData\Local\Temp\6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\it-IT\lsass.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\backgroundTaskHost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\upfc.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows.Internal.Graphics.Display.DisplayColorManagement\conhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\dpapiprovider\backgroundTaskHost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dllhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\SensorService\fontdrvhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o6dvlEjTCw.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:25⤵
-
-
C:\Recovery\WindowsRE\backgroundTaskHost.exe"C:\Recovery\WindowsRE\backgroundTaskHost.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cacdae21-8592-4efe-8ac2-20d313ed1580.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8ccf036-732e-42ff-9094-1e1db8c28ebd.vbs"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2e885b53-4c64-4d02-85b6-b413e43dbaf2.vbs"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea4a8590-6bf1-4211-9ed6-b0ffa82b7183.vbs"12⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6ab3726-443b-4ec3-ab89-f091137fe60a.vbs"14⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2aeceba6-9d11-4950-8f55-0bffc6b045fb.vbs"16⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e2512b4-e7ac-4b19-8904-dd3611b06c64.vbs"18⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6708e8a0-bd74-498b-877c-db73a140333d.vbs"20⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\162a04ea-fef5-4ba6-bb44-419602150097.vbs"22⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fbdf885-6f17-4263-9fb9-8d95b80fbc5e.vbs"24⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\704414ef-081e-4039-b83e-0086df6a40ea.vbs"26⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\175a8830-70f9-4363-9693-466ae1d23829.vbs"28⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe29⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aaa8499d-b652-43fe-9b74-31a9e5ff376f.vbs"30⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe31⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0cb9c6a-3c6c-4e8f-aa0a-7fa2fd83ce57.vbs"32⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe33⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\660c6932-c75a-43ac-9a1a-c4b3adf598c1.vbs"34⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe35⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5c7cf8f-5bab-422a-8785-39ddcf504fa5.vbs"36⤵
-
C:\Recovery\WindowsRE\backgroundTaskHost.exeC:\Recovery\WindowsRE\backgroundTaskHost.exe37⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00fa5f71-8a85-43cd-9e6b-2f4da1b97eca.vbs"38⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a60eb58-5621-4f2e-bd49-7866a712ec39.vbs"38⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4050c920-dbbd-4eb3-acbd-137060884078.vbs"36⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb7748ca-4aff-4d32-8db2-4f4788a47e63.vbs"34⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7a16cd8-f498-4777-939b-53caadb5fb37.vbs"32⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07c189b6-43f5-45c6-a5c9-6c51db55b3cd.vbs"30⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b02aab87-1554-481b-ad44-d879292f57ed.vbs"28⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5907e5a0-be6c-4145-a446-0a16e510703d.vbs"26⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35179376-7fc3-415d-8c1c-08605146d05a.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\759cca90-5831-4293-bd7f-90031c190caa.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b7b1ed3-de0e-4055-aa0d-2ebd57194c23.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28afe641-e608-48c5-a674-e83fbee654be.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d25fa71-775a-4ecb-9034-f095cc5c46eb.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97a9c749-a3fd-4df4-9b31-0a8885f1f8be.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\786abc34-8641-4f6b-9fd6-8f0911911628.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cec6c884-a0fa-47d8-a17a-493f53f585db.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3f9585c-e2a3-4683-a7ef-892886495d04.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca904f18-7906-4986-bdf0-09ef2933d985.vbs"6⤵
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\Application Data\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\RmClient\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\DefaultSettings\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Documents and Settings\upfc.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Internal.Graphics.Display.DisplayColorManagement\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\System32\dpapiprovider\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\SensorService\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
612B
MD511450b30660aa0b52cef6644b431f9f8
SHA10ab429489cc5a44005760243dfc5247a00906271
SHA256c078adf61868345b58524c5da11861dc56bd5f004e1a4911de2093b21263156c
SHA5129d2fffc9555681e14bade76c44dd3e70ced9bb051dab2d79a75d83cb3f25b34ece1f1e8b0b48bfbedbceb94c3576cefd49d8767b0b64706248f6c03258076941
-
Filesize
944B
MD507ab6cc81c5230a598c0ad1711b6bd97
SHA1de7e270e12d447dfc5896b7c96777eb32725778a
SHA256900aa2c83ec8773c3f9705f75b28fff0eaca57f7adb33dc82564d7ea8f8069a3
SHA512ffef0ad0824ea0fdab29eb3c44448100f79365a1729c7665eba9aef85a88e60901bc6a6c248de15a28d21be9ce5839d68861e4449ff557d8845927c740ba3a25
-
Filesize
944B
MD5eb033be02578f9635ec47bdc1de5c3fb
SHA1ec356bc87381354a06baa9c30e8c3ac3d30e0f6f
SHA256bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063
SHA5124d8778503646f7016df73ff9d204760f4fe4d2b24157920ac3e5651653373975b2f2d229530143059f11b16c42822ad7963e628ad6066022ee712c17d90595ed
-
Filesize
944B
MD5b801d886e417a9bf405b2f0092e04fe1
SHA1fa99fefa2f49af240141692f78c8c28f04205389
SHA25657b1c29eef54567fcfdaa28d2923485cb6f77bb76dc54235965fb34f02a42636
SHA512b2c8bf95b4c25d7fff388b5f3e04212c43af9588f7aed8a7cb251330ee18c89789eb1d294b8449ec2afeb9b5373d7a6dce8f4369b84cbfb6a7c7813341fa07ff
-
Filesize
944B
MD54884c5267263cd4ca424395bd689dc91
SHA13b75a916cc74a9639aea572341bf9d4e8791d79a
SHA2568fa0f41da8f1c8adc5ab7fbbf6d0c88a44246ddc0287d3e254f662fc28367dab
SHA512b6a597c2c3f9bb979eb43066e466086f05c60bcd6049faad66a2240f73ba4d6834ecb150cf4e3e099464e7528850cfdbf0b8ec344948b611996418536cf115c0
-
Filesize
720B
MD5658c20ed6c0c2e66c6e5a9c0f9001c85
SHA1e7cd11d026266dd505b9c99adc9c19a14d2dcdc2
SHA2568c765e84a40258ef38ef074b3ea90ed1e1221760b13535fa2d1cbf3d40f1e7ae
SHA51292e174bc117e3718e2cdbb94581c8a1df1934abe64e8654fd1b8a9281a0fcdeba9a4452f2ac078ec1f4728442f208972706448b1a8b08528a820d670ad44e768
-
Filesize
719B
MD5293fb49c152cfed3fe23608b107fba84
SHA1b7c1c5a15de9208837d603940b4112ce53aca47d
SHA25647bd3c0bb83f750270b0cccc43caa432c59489009b7bcdef8af6d2da3b21151c
SHA512115dfd1a27a163119335c7bf9af3a57bc3943ba32130c93c8caaa641f8ff4aa93de5f68d126d63330623dd18af0d28dd9dd5e4d8e585dc6a9a1d0ae89a4b9dba
-
Filesize
720B
MD5a06fed9703a6a4d8d35021b60429da01
SHA199fa154632918e63ac3fe299673fb02c81f0734f
SHA2562d184a5d0813fa5ee5d8960a2686eba1bbd9bc3368d47c77a9fb3dc28389742e
SHA512774d21fc9bb37b05430a3f82382829b656d02f519a7c81c8ef5bd1ba889093057a5ece1bc0eb7fed02ae2ce8b499b383de962efbe5af7009086cfeb598e1764d
-
Filesize
720B
MD592dce4b6b5320da7eb261d74438cb59c
SHA1840378f21a8e3af20c7b65cffc8815e9d12df785
SHA2569ec357d65b439edf3a0c8079946013c641a669e92d0f90292e3667c37f620b0f
SHA51217a9668d3437c48831425030a25fa8243f734ee448a7362268308e73b8dce3994b9233acda29a6beb04512a7effddff3b7ac91eb6cc77b8aaadf9edf47cca222
-
Filesize
720B
MD5ad58d036ab45a3be5f78dbf68e620cda
SHA13b2bd111f57e111608d82a9f3de4b56ccc4b963a
SHA2567ab96d2ba9eaa8a402bc3edac0cbfdafd4bcbc23a291300629696920eea601da
SHA512d4245b2402a7ad27f11daae00e3b81d0ea0d2d534f7051511c17a8baf8fd6d95d199f4c6bc30fdcdc8fad896f0de0e1db12a2a63df80d95e48ceba7b1c5610ac
-
Filesize
720B
MD5a12c13f8d6c72594f71ca30e9a888709
SHA1f6316126823f42288123f529df5df06eb3c57298
SHA2568dab4504cdec4ab439ced577ff8224606b5b7f951e9e816daa349d1af9af0dc7
SHA5125e6de7450f544d5bccf43f83e43e5604d651bd8248d748c436ebb3d4e7b2a7e3ec69654278d7bda36b5ea8ebd46c3ed4bd4cac1d6af5b1f6151dcb880784c199
-
Filesize
266B
MD58fa1e979ca7c62328b80fe6281cb5dc6
SHA11fdf276207b36a267c78c12517093029d006b425
SHA2561eb9d6801a9112fce4064fcc229f08e58bd40f5426cc6393b5ff0ec05c4020db
SHA51224690c7b4bd06142cee787d6d4edbc3775eeb6ecbd406f82eef27e984229d3575774cca5df1cb46be1e25b819690efde9bd68e090462f3df9f38793c17046965
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
719B
MD5398c5a3a05e0a9e9ffd51c3381d7387e
SHA1decfb571c75cd302c2984512c49cbcfc06412377
SHA256bc0c5948f3cf061f4648ad10385bd85dbe718a23c1e7fb95da4a1c796548a9ea
SHA51278b98f2891c21dcca285fee0b9cb3e89dac206060fc0704948e16b73510186518a13b1ffd93bcc8f150d9588fd707ff04b0a6ef90d7c6c3ed762ed63a382615f
-
Filesize
720B
MD5df4874c3ad2dfb3ae1deb4a770c44e15
SHA1ef53adcf1be5d602fba826e9003c4f9b559472ee
SHA2569ca49ebe30650768d134c474c86ebc7fd05859b37d0be50162f508af3e4820f9
SHA512240f74ba14de162333901ab146e6497d32e4171ebbf6081ca81e1ebd2e58522e4f121286bb3946f149a797594fe2a3c1634d334296e5ceb1b081a2bedbb3f870
-
Filesize
496B
MD524f38bfc5dbb0554ba45823666e1eda9
SHA1604f88dd37fe3cdc4a68daa8a125a951313ce3ea
SHA2563beaec505abee2b6165684b12c3e2670ed8ffbf75f9e275540f99d0bec666ba2
SHA512287a4656f59320207223c9911a4af32813f0760b0c5cf21a6713cf807e9157e28d7b261ed0df5d3ca707194462dbb666e7950dfda1172cb24fd677beaa3e02f9
-
Filesize
720B
MD5601072114d36e8b2d3243f96d35aa7f3
SHA1da4d2ce52c1c1d2d22222bcaddd3c8f22336a99a
SHA25619fbb20cdaf361ad9856ca3d5722e8342841bc1f726a154f8903d520352ad664
SHA512329b9e416bcab8a3394045d5889953410782cb151f6735a624497e854ac6d4d1d061c7dd4972f97b6ea084b8959428204bedb64de05e5b802d08775ae6555b2e
-
Filesize
720B
MD58694938b0d60f94e3b181f0cdc26c94c
SHA137d2f1de8297e0f00c9ab365a349ee012763829c
SHA256000b775db7c341c05870369ed090f63141d641a5b3cc05f52b9112084a54df48
SHA512de4617ec2baa3389775af6964914b89c8ec8c89b4039c202236aa4815c244e7115af7ae9f2d8bd4c2d4298b3c22248450878d092ec93871c8ecc8ed3d887a5ba
-
Filesize
688B
MD5647cd2d36561177c99cc39cf9efc2d8e
SHA15f821a9f6a79cb808b0fe98b80e31caf53e8b1df
SHA256224ef8896af3fe1a827ad0e57e22fdb4385c059a9b7a3e3b87a15e278f7cc5d3
SHA51270371d659dd208fbd506ea81ce4a3cd6e4c5a74e619eb73b07f9a97172d4271567c5241a374e1d5f246bf98638b8eec9806051803dccbd05efe5df4522cd26ba
-
Filesize
208B
MD595c6cf4f72c789e582bf8cb84268efd6
SHA1816cdad7d2ac67608857fd46c66e44f692e8b356
SHA2569d4e02114531d4ef87ed163b999fae392b43e5ef95aa286257ea9c6823d869e7
SHA51271ff967d380497a149c222fc2faef05319974cb486076ed6d65f3bbe8558b9fd5e9777ad78fed746bfd707a33c6f7f6d75d4419a51fa5a7871f31a63ff9a7035
-
Filesize
1.1MB
MD51a6a898a0abfa818a97e0c741f62a651
SHA1e64e7fa94a829b00de8d7a9442745f1fccfd4d26
SHA2566465e923bf241700a250f531b63fc650c66e97c5affa1f70a0aa6a75bf63b561
SHA512d659ce4b692548eb33283398b8065296a7fb251865734c0b6269b1618999c8da7cef528a0644e9ca83a89b5c194ca44de3b8ff34e77abc0c221756f0ce2ef9ca
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
1.1MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
1.0MB