Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10326fcf4806...79.exe
windows7-x64
10326fcf4806...79.exe
windows10-2004-x64
103293f41661...16.exe
windows7-x64
103293f41661...16.exe
windows10-2004-x64
1032af824687...29.exe
windows7-x64
1032af824687...29.exe
windows10-2004-x64
10332a07ad96...b5.exe
windows7-x64
7332a07ad96...b5.exe
windows10-2004-x64
7337f25a258...51.exe
windows7-x64
10337f25a258...51.exe
windows10-2004-x64
1033a6af7047...7b.exe
windows7-x64
1033a6af7047...7b.exe
windows10-2004-x64
10342f2b5aa4...75.exe
windows7-x64
10342f2b5aa4...75.exe
windows10-2004-x64
10344b47e81e...0c.exe
windows7-x64
10344b47e81e...0c.exe
windows10-2004-x64
10345db905b1...8a.exe
windows7-x64
3345db905b1...8a.exe
windows10-2004-x64
134655ac11b...76.exe
windows7-x64
1034655ac11b...76.exe
windows10-2004-x64
1034a292bd76...b7.exe
windows7-x64
1034a292bd76...b7.exe
windows10-2004-x64
1034d765717a...e4.exe
windows7-x64
734d765717a...e4.exe
windows10-2004-x64
634f76de826...a9.exe
windows7-x64
1034f76de826...a9.exe
windows10-2004-x64
10350eba0e7b...2b.exe
windows7-x64
10350eba0e7b...2b.exe
windows10-2004-x64
10353233e5a4...ec.exe
windows7-x64
5353233e5a4...ec.exe
windows10-2004-x64
535459ca752...7b.exe
windows7-x64
1035459ca752...7b.exe
windows10-2004-x64
10Analysis
-
max time kernel
102s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
326fcf48062cbb0bacf4663fee8a51c740e810ee0477fcf6eb3e8c5420909e79.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
3293f41661f096b9d6839d0389f94416.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
32af824687697346da2d415bfb80fa29.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
332a07ad965316c83984ac70dfcf9e0fea793b235afe69e8054b2bc6501827b5.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
337f25a258012c5c5802696b2f2b1a51.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
33a6af7047ae75162c1c9ed55ba0fd301b22f1eb5a59d6a9fcb7d727ff8bb97b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
342f2b5aa4fb4c3d9bfa18f7ff3e96ac5a21db19b8635b92ca789dfcb4e55875.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
344b47e81ef94c8f7a3a1c229f4c167bcb516900647d82936084677320a4960c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
345db905b17d371d0355419841ad7d8a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win7-20250207-en
Behavioral task
behavioral20
Sample
34655ac11b4f6a8d6f1ea8e2fbbe0676.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win7-20250207-en
Behavioral task
behavioral22
Sample
34a292bd76e629b9fd512f94ba2f6bea582de6e9f7cdc0129c233fa4df357ab7.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral23
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
34d765717a065c8984c1663ed6d88c18ce58ea3a1780da7947d9686ff01f1ee4.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral25
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
34f76de8267d9a91d17434be5e65ffd3cc33a92188faa235c895b63e154356a9.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
350eba0e7b89b10b4b0f886f34ddc62dec985f55ef6ee0f9f5a7e93da5cdac2b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
353233e5a415519357daf1258d66e8ec.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
35459ca7521a8565cf4acaadd346537b.exe
Resource
win10v2004-20250314-en
General
-
Target
35459ca7521a8565cf4acaadd346537b.exe
-
Size
984KB
-
MD5
35459ca7521a8565cf4acaadd346537b
-
SHA1
c22ce5beb121ecbba910dec28dedc0781d379524
-
SHA256
9622708341e5ac35563f5f258ae7736ad0a9f3c5875cfbf6e4570778b2e2c8bb
-
SHA512
691dc64caeb7a892b54c970f5d750a47a525004b162994c7e71eefbd4821c5c65961b2bbf08c356799e005de7c258fede7058cc3cc7f939f5ce1cd4ba40becd1
-
SSDEEP
12288:LzZvuvewk/0pPPXA5q/TQ9+n95vV25gnwHexSDwbwvDxlpaS98IUNldnd65EgF1s:LzZvuGD2PvA5YxwmbZB6Uv
Malware Config
Signatures
-
DcRat 11 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 5728 schtasks.exe 2300 schtasks.exe 4060 schtasks.exe File created C:\Windows\System32\Microsoft.Uev.ModernAppAgent\e1ef82546f0b02 35459ca7521a8565cf4acaadd346537b.exe 3104 schtasks.exe 4948 schtasks.exe 3592 schtasks.exe 3092 schtasks.exe 3116 schtasks.exe 1380 schtasks.exe 2460 schtasks.exe -
Dcrat family
-
Process spawned unexpected child process 10 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3092 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5728 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4060 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3104 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4948 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3592 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1380 2912 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2460 2912 schtasks.exe 87 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation 35459ca7521a8565cf4acaadd346537b.exe Key value queried \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation 35459ca7521a8565cf4acaadd346537b.exe -
Executes dropped EXE 2 IoCs
pid Process 3764 35459ca7521a8565cf4acaadd346537b.exe 5188 lsass.exe -
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\WsmSvc\\dllhost.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\C_28597\\winlogon.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Windows\\System32\\wbem\\PowerPolicyProvider\\unsecapp.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\dot3gpui\\fontdrvhost.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\ExSMime\\taskhostw.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\Microsoft.Uev.ModernAppAgent\\SppExtComObj.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\C_10003\\RuntimeBroker.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\win\\explorer.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Public\\Videos\\wininit.exe\"" 35459ca7521a8565cf4acaadd346537b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\d2d1\\lsass.exe\"" 35459ca7521a8565cf4acaadd346537b.exe -
Drops file in System32 directory 29 IoCs
description ioc Process File created C:\Windows\System32\WsmSvc\5940a34987c991 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\C_28597\winlogon.exe 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\C_10003\RCX8EB7.tmp 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\wbem\PowerPolicyProvider\unsecapp.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\d2d1\6203df4a6bafc7 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\Microsoft.Uev.ModernAppAgent\SppExtComObj.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\C_28597\cc11b995f2a76d 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\wbem\PowerPolicyProvider\unsecapp.exe 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\C_28597\RCX8CB2.tmp 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\C_10003\RuntimeBroker.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\dot3gpui\5b884080fd4f94 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\Microsoft.Uev.ModernAppAgent\e1ef82546f0b02 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\C_10003\9e8d7a4ca61bd9 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\WsmSvc\dllhost.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\ExSMime\ea9f0e6c9e2dcd 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\Microsoft.Uev.ModernAppAgent\RCX88A9.tmp 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\Microsoft.Uev.ModernAppAgent\SppExtComObj.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\WsmSvc\dllhost.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\wbem\PowerPolicyProvider\29c1c3cc0f7685 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\d2d1\lsass.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\ExSMime\taskhostw.exe 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\WsmSvc\RCX8AAE.tmp 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\dot3gpui\fontdrvhost.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\d2d1\lsass.exe 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\ExSMime\taskhostw.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\C_28597\winlogon.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\C_10003\RuntimeBroker.exe 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\System32\wbem\PowerPolicyProvider\RCX932E.tmp 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\System32\dot3gpui\fontdrvhost.exe 35459ca7521a8565cf4acaadd346537b.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\win\explorer.exe 35459ca7521a8565cf4acaadd346537b.exe File created C:\Windows\win\7a0fd90576e088 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\win\RCX90BC.tmp 35459ca7521a8565cf4acaadd346537b.exe File opened for modification C:\Windows\win\explorer.exe 35459ca7521a8565cf4acaadd346537b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 35459ca7521a8565cf4acaadd346537b.exe Key created \REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000_Classes\Local Settings 35459ca7521a8565cf4acaadd346537b.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4948 schtasks.exe 2460 schtasks.exe 2300 schtasks.exe 3104 schtasks.exe 3592 schtasks.exe 1380 schtasks.exe 3116 schtasks.exe 3092 schtasks.exe 5728 schtasks.exe 4060 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1312 35459ca7521a8565cf4acaadd346537b.exe 1312 35459ca7521a8565cf4acaadd346537b.exe 1312 35459ca7521a8565cf4acaadd346537b.exe 3764 35459ca7521a8565cf4acaadd346537b.exe 3764 35459ca7521a8565cf4acaadd346537b.exe 3764 35459ca7521a8565cf4acaadd346537b.exe 3764 35459ca7521a8565cf4acaadd346537b.exe 3764 35459ca7521a8565cf4acaadd346537b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1312 35459ca7521a8565cf4acaadd346537b.exe Token: SeDebugPrivilege 3764 35459ca7521a8565cf4acaadd346537b.exe Token: SeDebugPrivilege 5188 lsass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1312 wrote to memory of 3764 1312 35459ca7521a8565cf4acaadd346537b.exe 98 PID 1312 wrote to memory of 3764 1312 35459ca7521a8565cf4acaadd346537b.exe 98 PID 3764 wrote to memory of 5700 3764 35459ca7521a8565cf4acaadd346537b.exe 104 PID 3764 wrote to memory of 5700 3764 35459ca7521a8565cf4acaadd346537b.exe 104 PID 5700 wrote to memory of 408 5700 cmd.exe 106 PID 5700 wrote to memory of 408 5700 cmd.exe 106 PID 5700 wrote to memory of 5188 5700 cmd.exe 109 PID 5700 wrote to memory of 5188 5700 cmd.exe 109 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe"C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe"1⤵
- DcRat
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe"C:\Users\Admin\AppData\Local\Temp\35459ca7521a8565cf4acaadd346537b.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\49Q9cyPin3.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵PID:408
-
-
C:\Windows\System32\d2d1\lsass.exe"C:\Windows\System32\d2d1\lsass.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5188
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\Microsoft.Uev.ModernAppAgent\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\WsmSvc\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\C_28597\winlogon.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\C_10003\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\win\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System32\wbem\PowerPolicyProvider\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\dot3gpui\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Public\Videos\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\d2d1\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\ExSMime\taskhostw.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bbb951a34b516b66451218a3ec3b0ae1
SHA17393835a2476ae655916e0a9687eeaba3ee876e9
SHA256eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
SHA51263bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
-
Filesize
198B
MD5ae9254cb3d83c4af5eae743b1af655ab
SHA1979bacb713ece05d2ac36f86cb77f50f552f8090
SHA256067ea9042fe76707959f0b0411006b73237082d2fb6f54281b17546aa8e390ad
SHA51242afe1251d085bf00a47d8f589a46c180c9d597a242fe66690e8879986a4634a5cc7674b2226cb7d57d5505ce6c765d6bfe399fb88a5426d47abe0145dfc2bd7
-
Filesize
984KB
MD535459ca7521a8565cf4acaadd346537b
SHA1c22ce5beb121ecbba910dec28dedc0781d379524
SHA2569622708341e5ac35563f5f258ae7736ad0a9f3c5875cfbf6e4570778b2e2c8bb
SHA512691dc64caeb7a892b54c970f5d750a47a525004b162994c7e71eefbd4821c5c65961b2bbf08c356799e005de7c258fede7058cc3cc7f939f5ce1cd4ba40becd1