Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:17
General
-
Target
d9a7a84e51c67d1a641349c9195c4f74.exe
-
Size
1.1MB
-
MD5
d9a7a84e51c67d1a641349c9195c4f74
-
SHA1
ab7430806db422ec6dc6bf7c378d70f36125c33f
-
SHA256
98be7f502a04b1116647aec47e8e1061d2c26404d6e7855423371fe01d8f5ef9
-
SHA512
fd9a242d657e746ddd07474fefe772afb1b4060db34bb030d1ce8abd7c4ff1af235b209606ea8f43aaf87ae30e1cbfd5b23986344b23a6a50bf13b35deb97ee7
-
SSDEEP
12288:Kmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:Kh4TbLUEhZL/GspeYhkc9Soh2SfwJ
Malware Config
Signatures
-
DcRat 16 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 15 IoCs
-
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 54 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 17 IoCs
-
Adds Run key to start application 2 TTPs 30 IoCs
-
Checks whether UAC is enabled 1 TTPs 36 IoCs
-
Drops file in System32 directory 22 IoCs
-
Drops file in Program Files directory 18 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 18 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 54 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe"C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\edge_BITS_4604_1909617439\smss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Microsoft.Uev.Common\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\OfficeClickToRun.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\uk-UA\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\winlogon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\SettingsHandlers_BrowserDeclutter\winlogon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\perfd007\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe"C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d9a7a84e51c67d1a641349c9195c4f74.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format\powershell.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell\powershell.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre-1.8\lib\amd64\csrss.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90c178ce-219b-4c7d-831d-67a951fa0b51.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d341226c-ea9a-40c5-a0e6-6813caca5f63.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c813f861-3528-49f0-8fbe-2ba24ba95b59.vbs"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1688e8ed-f90a-451a-9bcb-977d14cc6b97.vbs"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a43a47f4-c4c1-48af-9a23-1928e5198aec.vbs"12⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03b7f0b4-f2a8-4b79-abc4-92abb964cc76.vbs"14⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32275cf7-8686-49a9-aa91-f47cde827761.vbs"16⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59192001-e23f-4721-8f58-3d46d0b01581.vbs"18⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1f7b37e-d05e-4522-82da-90678eb014af.vbs"20⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ee48ffa-31ce-488e-b6e6-4551f9179529.vbs"22⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89a03d46-7f04-4e77-a5ad-3170ffa79f42.vbs"24⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81a7e1a3-d308-459c-b37c-8ff54dcd851d.vbs"26⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78c18653-390f-4d97-a955-4ea122f35e4b.vbs"28⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"29⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6aea0d47-30ff-44ff-be71-9d39e6caa393.vbs"30⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"31⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d28e62ef-d558-4da6-ba01-72b7de1bfeac.vbs"32⤵
-
C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe"33⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d541837-629c-47ed-a3c8-982bd4b55b88.vbs"34⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aa9450c3-7840-4873-85b5-fd019bccf6a8.vbs"34⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7e195b9-385d-43f3-a36f-89490d80be31.vbs"32⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e3a552e-82ca-453c-81e7-d4bbe41ecdae.vbs"30⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f48b4e1-a6e8-4c75-8531-ae75944893e5.vbs"28⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\379cd3f3-02a6-4dc9-a25e-129ed8e8a113.vbs"26⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8d249db5-88ea-49de-a61e-d5a4374355a3.vbs"24⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3fd1b5b7-3e5e-4b8e-8c96-126839e53cdf.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bdabb29-3e65-4335-9a14-33e7eca50b4b.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0218bdcb-17ae-42d6-be69-ef084ed787f8.vbs"18⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d032fb8-470b-433f-b3d0-8bc018931e5c.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbbe866a-885b-4634-8897-aad82033951f.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c10d6391-90fd-4507-9f01-7ed81e04176b.vbs"12⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d22c7e10-7963-4e02-b417-76e7575198d7.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e34c1586-e973-4c16-a87f-48588dbc7617.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3ba111d-adaf-4fa0-bdf9-140908daa481.vbs"6⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f456f34c-c652-44f1-8777-7405366d43b2.vbs"4⤵
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4604_1909617439\smss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\Microsoft.Uev.Common\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\uk-UA\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Documents and Settings\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\SettingsHandlers_BrowserDeclutter\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\perfd007\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\System32\WindowsPowerShell\v1.0\PowerShellTrace.format\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\System32\WindowsPowerShell\v1.0\powershell\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\lib\amd64\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5e883672df257d854bfbf0a1f8ad51579
SHA1e49ebb325bec9fe2e723effec58f11023a66b460
SHA25653f9606244d24ee354af5f66a8fd964db3858b17d9ed0a50159f3b9f982f2321
SHA5124ca156e974cbe1acb5df759d7f533c0c685e7bac7fbca2b90f112dda18a99f65c5678bf37f83b021a255f21a7ea79f07b138dcba07945828980c89ceaa90fb18
-
Filesize
1.1MB
MD5d9a7a84e51c67d1a641349c9195c4f74
SHA1ab7430806db422ec6dc6bf7c378d70f36125c33f
SHA25698be7f502a04b1116647aec47e8e1061d2c26404d6e7855423371fe01d8f5ef9
SHA512fd9a242d657e746ddd07474fefe772afb1b4060db34bb030d1ce8abd7c4ff1af235b209606ea8f43aaf87ae30e1cbfd5b23986344b23a6a50bf13b35deb97ee7
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5866b998de2a440675992d5e0b435d66d
SHA1ce1f8f5a204ae7b3429c743cacb20ed24de54394
SHA2564e8db49692ec5a2e4a40bee16fb03d703794c31730112b2fbd6c82fb6fd1ad44
SHA51254d3ee420baca65db4280a78451eba383210c09c941d096f1ffa9176cd60d68b3d650a855a42cd12699003839f4af1847e73802f2b89be44ab3a0037a1d57f16
-
Filesize
944B
MD5cae19674c4dd6a419a8ce8bc65e65167
SHA18b3f7e010483412b803e756c850fecd29cf9fb8a
SHA256f4a34d2ff32e49df841e87405dab2661bcae83c20ee781a13fbe73924fd672cd
SHA5129865dd43b4494081bb625844fcedb56dfc335b5f2cadd5c4094f0848df07ab5fa40faeb3adbbb91e1355ed436dfbf44ff4ae9ad39cdbd5fbfdef4d1813f3ee74
-
Filesize
944B
MD53357c199be211a745818714039e25935
SHA17d50d07ff2e234f3d10a88363796cbd615b1e9a3
SHA256668bb751b77a8c5c53c7efcb71e3ee9b2902388e0503e6d6ad3647587a0a0a38
SHA512052751067bede3dba675313a1c0d88c0e76d62bbc903dbd9ba4cf2b8d03530716c021926bbe34242af9516a77e27df080d1cedde04d8cb51c88c1484ea8a1077
-
Filesize
944B
MD5400965c5c8206c7b519873fb3aa3aebf
SHA10764aa4c62cc242ede7ec00e36539c20e17e5565
SHA256e8a339e9d5f5699e83419d2fb336577a101a4cd31df7ddd8c71a88dec1593b04
SHA51232b7c0f5745c3cbb291642e96ce907d0d71f986f0fb1f55f2c5f56dd76d9243d8ca936a7e81c0ef3962d5daf25d51bd93c5de77cdf9c3ed74101e3056e510369
-
Filesize
944B
MD580dfd43d9904cb4bdd37f6934f47ccf8
SHA172c0981be679ef6a22cbabbdc3e02a7e80a3eafc
SHA256a6e60a417d8c6649d78716bcfae64c452ca60367f2280f0b41d5febac503edad
SHA512793f081a3c5f89a88e4472be0ee26f04f47cbba6a8c5af2710fb8d09a224fc7ded64ff68924325cce0b518f330458cdd0bfafbab9f805ddcc68393aa3f179247
-
Filesize
944B
MD5f41f42c322498af0591f396c59dd4304
SHA1e1e5aa68d73d48bc5e743a34f6c0fa8960ff7514
SHA256d8bd9a4a363ff2ac2dc887759ec6ba4215a4ce0925a8fb9c531573458ee4a31c
SHA5122328a1b402b4fb0de9c451fb630eab58549129d3bcfb70b9834cfbd16065ebaadec006b309ea17ac182d34c53e01705cbc9e0196eb0cbd62600c866e79a1844f
-
Filesize
944B
MD5c08aea9c78561a5f00398a723fdf2925
SHA12c880cbb5d02169a86bb9517ce2a0184cb177c6e
SHA25663d2688b92da4d1bb69980b7998b9be1595dd9e53951434a9414d019c4f825a7
SHA512d30db2f55bbda7102ffe90520d233355633313dcc77cdb69a26fdbb56e59dd41793def23d69dc5dc3f94c5bd41d3c26b3628886fd2edbed2df0b332e9a21f95c
-
Filesize
944B
MD5d0a40a2d16d62c60994d5bb5624a589b
SHA130f0a77f10518a09d83e6185d6c4cde23e4de8af
SHA256c213a4024e89a0240d0b1fa3b18ea3db3db7bbe7ca1bdeed86dce9c2c4991ef8
SHA512cecef5087f194a83948880e36445324406218f6877386d6db7850b8f97ac107e042ea9445bb7e73c6e6a2c7da9782b7dae8caba0a1c997677d096b3271a4cac0
-
Filesize
729B
MD5a471a0e08f097688b691126170eb109b
SHA13b27e4e186c567395202f0e292fa6e50c4c87b0a
SHA25693a1b07f8f13461aec4c634162b3b5e986ae9263d7081c79e8d1843729c41384
SHA5122099f1c09f30edf4c26b873b584b1f64b878d16921e6a2ed199ffffc54a77300dd993a3f833de251d1e7ae9c64934bffeb32354739b27d7c73d10c731388f7bc
-
Filesize
729B
MD530cce40e475a199c7009b187d64fd1f7
SHA10999d26b083e47535cf0b7da3820cd03ef83f87e
SHA256743dc0ddeacfd4fa21db6ba9e85818c9cacc6e5710d7badc05b5a970c72ddfa7
SHA512e9edb258f922340a7f3d6bb2362cb52df5586082dc9abc03d470257ea3cb4d809817e61014a0db642408945e23df2e856566ab72f55a16d0e6ffc2c93bfe2d9f
-
Filesize
729B
MD5ae859a3aeefce53f4a6706a5f759a913
SHA180a971fba867f04a7848601601612c5e05ec688d
SHA25608a2abaf129927cfcabf4de333c17b69ef2a2f76631b2a009c0c30efd3e1b776
SHA512d68bb3db0f6d3c613d4fe18d0491a783b73f3d9417facc6d07ecc1d8b3b083758e5d75ba9288ded01ffe32ac00bef3b2d30e5d557c6d21579c90b269b09fd94e
-
Filesize
729B
MD55938f214c08b036dbd807f390a4a4979
SHA18869f3d4cf18f34046fa7fe8bab7bddbf7851761
SHA25640b2f416c1dd8611ed1d51be68cb6b46f05cd9f0250d98919314a5a2788c3f94
SHA5129e98420031243f02077fcb95edacadf0c38a9ab448f3a3da7f3bd8724b7f043a82a05a8910b773b96ea6dab716139bf86ee0337b6231dd4b45429497321b15ac
-
Filesize
729B
MD5a0c29520689975f842a78c8fc99b6b3e
SHA145de67405637b47a65d84ba06721c52f906156ca
SHA256dc624a3171034470850e968dd50c57c08497916cde8b0d255a3f7162b39691cb
SHA5122ee04c031a3e8483cbc939334e8c50b55f12011279cf0060069559a5c7af06523c9464936c819fbe07a4f70ea32ba3015994eebc0ff709542029a9d6e70ee0fb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
727B
MD590019f26bd3572f5d249461d855763c7
SHA111f15245144bb135a7e5bb1b48d073c70c3c80d8
SHA256a59faebefe86f8a0afff656c20f2080ccdf80ca9a574cff149dcdcb1de6cca5a
SHA5129db17cb9df8c4f30e9fd95f88523e1614693db58a8944dd484b7b8ab51bd3f8201835f937a7fadc016c09ec19563ed897da75339b133f1f5d0b286e6fb55b4f9
-
Filesize
729B
MD5fdcec5a7d55f2d37d7c66b0d20346940
SHA1ce4eba7598979bdf299a046f121909aa832fc83a
SHA25653d8f413a48d879a888725c4548b9e5a8e884fb4894d8bcbb77b2086e29020da
SHA51284e8ac28ab45d521a9cdaf770b919d4f48113bcc2e1a3d2ab1c686e2117baaff671602172f25d98d226d7d4ec37435bdd2582355bcdf4b6527957cd3ef869a19
-
Filesize
729B
MD5dd69045cb63ebc7acd3fb10b65e28a2d
SHA1244a7d17f90729076520dc99689aababdadfed4f
SHA2567cf73f9b6a2b31b4be0b6c04ac35517393ccf618399b224fbec5635bb3efe4d3
SHA5122bc7a14ecadd1e86db17a686e7aab94d9a2b1b467a237391ec990f9121261994cb270a84b96269ee90beb4005cb395f944afea7cd4923b65783812ed8aae0c10
-
Filesize
729B
MD5bab354a552ef742e9b255224a9d96d4d
SHA1ed54288d9e910b3546f91ca586e03d0523dc0321
SHA2561b1f9d7486637777f28e67ae7d0c377dae804c5810a189e3a34d486572cf092c
SHA512f374a5c0472f7a53d4a638f871fe647b70393e2882f776616d3037e6d3c5bd5fae8e3af5cff8af23278bb7014bd869e8d99991f4ce22e3451782b5d0a86e3ff8
-
Filesize
488B
MD5c45884aaf0b69b3cd20bd29f8909e95b
SHA17004c0ee2b48ed6010a0a2783117786587fab8f5
SHA256ab58c47b490eed73eac2908f2148d580f459d604040059f73ba25b21e4ab4bee
SHA512b501eaeb640f20c270ba4cbc0ce31013cec580371e1d18c24a926631c81287126e504e5be197933ae83adcc8f324235a83f46527a1740de9f79f15076d175352
-
Filesize
505B
MD569871bea12881acc7987c6ec2a8ed256
SHA1f2f5cfffd8ec9ce6db2ca3170150c5e84594b529
SHA256916fc443e0e2e9923cbfd72f2b60cca981674625e8ca603e6a672b685362d850
SHA51251cff2c4bee1cce37357d25e219577fb9795a22275605584852a50584bf522ae96bfeefe66148d3a129b736c71d37bbee34bbc53c40a53cf096319ad732fb4d4
-
Filesize
1.1MB
MD51d8f15fbd5a5ce684b098d968a0ea343
SHA19e44c3c8638df2c69900d64cd4bb66a4e72b0719
SHA2563a2e7331e0da0f47640f4e2daf5445f459b67183bd8980f243cf15e746811ed2
SHA5123d018ec87dfe18b74c0457656ece0c60a3756ff2aed0e8dc2ffff9100cc3d42c37b443103163d9a6e75adb3708efbe4ff2f37eae49fe65fbe98a1a4de3cb1a6b
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB