Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:10
General
-
Target
410897f36809104096c8b600eb3a0444.exe
-
Size
1.1MB
-
MD5
410897f36809104096c8b600eb3a0444
-
SHA1
18e8b8e65471f7f19b3612ba93a20bd6a702e7dc
-
SHA256
1cf0ed57e906c3779244c8b9c1f5482db0f92e67c2055dce9fa90dc8fbef65ed
-
SHA512
479e8b2a06d8861f8bb1ca9d5271149408853dcccb5c93a1e7a0d72e2a01af47131cd91d50e1edbd5bc2c0edcdfdf07f56c8f6c04fd3c12edc67389cd75664d0
-
SSDEEP
12288:qmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:qh4TbLUEhZL/GspeYhkc9Soh2SfwJ
Malware Config
Signatures
-
DcRat 13 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 12 IoCs
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 48 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 15 IoCs
-
Adds Run key to start application 2 TTPs 24 IoCs
-
Checks whether UAC is enabled 1 TTPs 32 IoCs
-
Drops file in System32 directory 20 IoCs
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 16 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 30 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 48 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\410897f36809104096c8b600eb3a0444.exe"C:\Users\Admin\AppData\Local\Temp\410897f36809104096c8b600eb3a0444.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\410897f36809104096c8b600eb3a0444.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Idle.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wdc\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\AudioSrvPolicyManager\backgroundTaskHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\410897f36809104096c8b600eb3a0444.exe"C:\Users\Admin\AppData\Local\Temp\410897f36809104096c8b600eb3a0444.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\410897f36809104096c8b600eb3a0444.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip\powershell.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows.UI.Search\RuntimeBroker.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\wowreg32\conhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\WinMSIPC\lsass.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\DeviceReactivation\fontdrvhost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\81VaE6Q4eQ.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exe"C:\ProgramData\Microsoft\WinMSIPC\lsass.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aaf26042-3961-47d1-b701-8c3c51731fcd.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d051598e-a0e9-4827-85e6-39fe0aaa9b89.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d4dac5c5-2d14-42d4-ba97-55859d138c7c.vbs"9⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58d2b71f-288f-490c-b9e0-f287f8d9eddc.vbs"11⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5bfab3c8-5259-4173-8e62-7514782681d3.vbs"13⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd62e811-f0b0-46d3-a89e-0858bfb2a963.vbs"15⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5b199c8-a2ab-4af2-8706-2eba0c3725cb.vbs"17⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29823425-a1dc-4c1d-b166-c3e61cb778ef.vbs"19⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c71aa7d7-4e19-4bc6-b35d-9c27537be80f.vbs"21⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0353ce62-a226-4ffe-bbea-9d1789a7cff2.vbs"23⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41b74bdf-1e4d-48da-80dc-4f5a5b26bb9f.vbs"25⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d250668b-3f7c-486c-ba8c-fb93312cda76.vbs"27⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea1b92b8-03ee-4bdc-a5b2-cbf75a05279c.vbs"29⤵
-
C:\ProgramData\Microsoft\WinMSIPC\lsass.exeC:\ProgramData\Microsoft\WinMSIPC\lsass.exe30⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e45ceb23-70ff-4d8a-85e6-526fcca8da06.vbs"31⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef8e38da-ef76-4196-8e79-9a14ac053052.vbs"31⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5f933126-8b5a-4a5a-b104-9e3be4055865.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c7a4d49-593d-4801-8af1-a6b29d008003.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c659fec4-0f82-4e62-adc8-e4c57478b991.vbs"25⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7d83f2c-b2f4-4d1f-a864-5e4ae5c4d155.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d2e6377-c6ed-4ad1-9519-dd96fc172c0c.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8da156b-7261-46e5-9c65-c15252bd1031.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94dea313-5b7c-40ae-a126-5d7d682fff92.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0bb67d2-1889-44ad-a33a-4c5d6f79ef9e.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de34fe53-27c2-4bef-a7ba-8d5d30392322.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d33e50f7-21e6-47e7-bc71-97a9723e70fa.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a22e577-dd7a-4705-893b-a9c85b2355b9.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87cfe211-f2ec-4c66-892e-915a528e7040.vbs"7⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0e3d261-183e-4fc6-9f4b-5e2f17865ed1.vbs"5⤵
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Idle.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\wdc\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\System32\AudioSrvPolicyManager\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip\powershell.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\Windows.UI.Search\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\wowreg32\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\WinMSIPC\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\DeviceReactivation\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5410897f36809104096c8b600eb3a0444
SHA118e8b8e65471f7f19b3612ba93a20bd6a702e7dc
SHA2561cf0ed57e906c3779244c8b9c1f5482db0f92e67c2055dce9fa90dc8fbef65ed
SHA512479e8b2a06d8861f8bb1ca9d5271149408853dcccb5c93a1e7a0d72e2a01af47131cd91d50e1edbd5bc2c0edcdfdf07f56c8f6c04fd3c12edc67389cd75664d0
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5e69ced0a44ced088c3954d6ae03796e7
SHA1ef4cac17b8643fb57424bb56907381a555a8cb92
SHA25649ee2b78c2766e68fad51109337710f032e25649bcebebf14562edfbf2e98108
SHA51215ebe961c61ee8efadd8370d856c936e5b605c3b847b8ddabb3cafb63c724d374a0a9567054852444de95794c7c8b3f9f12d05258104573c7546ff88023d7cd4
-
Filesize
944B
MD5b0bd0ba1b6d523383ae26f8138bac15f
SHA18d2828b9380b09fe6b0a78703a821b9fb8a491e5
SHA256a9878e55702f457717f86200e3258bfc960d37d5a8c2cab950c1dd842fbbaed1
SHA512614df5e7b46469db879cf1be2cdc1df3071f0c3f0c1f78c73b81d23d651c54d246e8ca6e1923a34ac2dddc02c63b807c8d328f2d275f98e0997a12a7960bbf45
-
Filesize
944B
MD5ff8dea104630cb0cb3da85eea627c4c0
SHA1b332b51a9f473a604710d64b66c01c9df8caf88b
SHA25697d63b322c131f512e5b1f2052d364bd82e41de6899d4d334532a35f6e290d7f
SHA512698ee25bcecac3a2c71452150be7e69fb08bed1a041f2f44e38427a9bb6911a4eea8d7320bb4530c2893c11994913142051d472ddefe900055f415cb9673552e
-
Filesize
944B
MD526403455115fbc3da2573a37cc28744a
SHA16a9bf407036a8b9d36313462c0257f53b4ee9170
SHA256222a7adb94c5e82df6466a4afce283e905c69f7feb18b3e34583b5cbbd88b352
SHA512be96d478e5d804b8daf805ad28d5eba644fb63a59a799273e029c8047a036f8aac74098efcadee0e4f405dcd1c0a689a1e8eb23f51a93634ed44f5a7c821beb6
-
Filesize
719B
MD5726ec93615f0017fa7640a2ff71b0180
SHA18c7d21ede357d68fa6a183cc898620e5b0625632
SHA256105ae5b6af1502429e4a39cf6b44d25de322ffc0123655358168bcb1e0f7fbfc
SHA512ce4edd86c3403226c2e3554a4cac360205f4108d5863ecefe167a4eda3504cda8ba78d334065851092b249f8bfc4d7ab309fedc7f6c6ae658472a1fd72fe2b21
-
Filesize
719B
MD5791a12bd0077de80832895a6da09e73f
SHA15afe7103d363fb3c580aacc6deb8fb3cc2a11522
SHA256c41522eca34ae087ac00ce487f9892bba4e19304e04fdad7ad568393e6a7d55f
SHA51283ea1acba61680c3aefa7bb1632767faad6706e18ac7c61c04192504487543cce5c1594ec68e4dceb16f0e9959a3c5d4e8d66ee5f10ff2db18b3b00174ef05ba
-
Filesize
716B
MD5be47888984d8b32456abe941f4fc2e4e
SHA11fdabb953452d90a19baf5a98e351c29c99cd24d
SHA25679eb1863d119909da0734cf2f7630e5f868cf22f6dcaf64ea5c780bbd7c25126
SHA512a231ec0ef45fa228b107cd3c286b6982108c14d5d3025b78627280aa785a987590d97ea9b8ea61bf88324e90181540ceb406ea82055742833f8eac36e156d371
-
Filesize
719B
MD5cf3509dcb8150adca240ff4d8391db80
SHA187ec2f9f80533b62d50e49efddd69050bc18e860
SHA2569c8f05ce53d518b9daef0159f3b3041764b813f91c0e39517c88bd4ab2684990
SHA512e136dddb974f31d1103beb22973994e6b2d65e744fe92a0ce1cbde180ac31afebb8ad4afdc1b2e2ed19390148aa0d8e21027be9d3f5b6aadcdf4eb40170516cd
-
Filesize
719B
MD5b5b3dde604732d9c39c60b8ecd406fce
SHA1d913ba49cb6d22377bcdad70a40694b37d51ddfe
SHA256551e4ac9f5fd0ddaee470e2f93c01bbd36c4de0a84afe6a305bd59c4d12c32b8
SHA512a43cac99dee25099db6461b39f18b602752277c27b1545dba9e0b2fd1144ddedd1790b0ee2143694e7231da8edbe6a88b12708366cf0f8690c9f9a68db8fc019
-
Filesize
207B
MD59c7fbc07881bb0111ec21c0e45ec3ddb
SHA147d1c6dbca5c5460cc9924f4aeb6857a27c3b3e7
SHA25677b49ded09c6abc3aed47ac50e38178d62110bcccb662a3ccb26c129b18e1fce
SHA512d7ab0469e02bf52696bf814e86d2a2a2f112656c567e82feb57a24e6f142819c53b59d013394f3054b777adbf5fe56c2afe7f7d8c879985504a277cfddaa5ce2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
719B
MD54ff03d72de552270f63b064e79e71bfd
SHA1b74539d05a8df3d1250d992f26d8291d8ae7c9f6
SHA256aaff1ed04d584185e472eab2b3a1a27590c8835d86d182a7e36184d593e5b902
SHA5122967a7520affc61424351194ab5b7b2d6c1796b0e19bb9c0fae806522b9b3baf5c3dce0a79963c9474a435c31ea60300879c82245c86842addeddb464f3975ff
-
Filesize
718B
MD5bcbd78458422b5c290492707a7fabc91
SHA1235ae127f702301ecbd565e34531ce74bf787dc8
SHA256313615d9f9c0ec0975ad0cdb53c4166f67591303afe3f7bd87863934a236dd1a
SHA51257ce8aca2cdc018cd5252e724b924c94b05d1186b2b5fd9fa721bda90fdc74c918a57a7c2d55c9cabe104f140b2391f664774ddc450112461662f4b9e35b026d
-
Filesize
719B
MD50fed312f700b3c2fbcd7135f3bbc298e
SHA171d86ac8bce315566accf3eec0f24073b871c025
SHA2560249e1f333256fe22a01cab72af06a359209952cf3182f46165b36bf403687b8
SHA512327b54af69bd5e2a6fd39b64259f5c20ad3607fa352cfa721e6d1f291e2d270bcd81bb88b2132e9ef7b1fa3f8c5bf29d0c27da7db04d852e1a834ec10698675b
-
Filesize
495B
MD5ccb98b59dd9a0ed390d964ca07b67ec8
SHA137fc0d6b86542058894cdaa0eeb05f79e3202787
SHA2568f598bb2f437cae844f9c42380bb8c0da431617d58ceaac8113e919fabba8ae6
SHA512ba2bb53c458303da063dc5055f6453456621574c0fed778e7da33e3debde7dff7d16ac87bb78186c5148659f6cb7e88d430d21d3c0aefaf9d5cf2e8d87bcf09b
-
Filesize
719B
MD5cbae056fdf34967db4470e2f2855decf
SHA1132ea3080a7d19f392d5a61c34519ae8c6e8a3c2
SHA25681b139a68c803942f47c01dbfb55e7d5328291f6a12da00e367ceb35c2364cbf
SHA51211347399b845dc385c2452464b548d5af394bc5b77ce25fa2b3e4c9d65a931a2f01809283bbf575d47d7795969bf1d94727cb66bed7fdd50385437a4cb983540
-
Filesize
719B
MD52e4dafca4e82b6edf300f6e8b20b0e08
SHA1b1574db75ecbe5055f84f6eb81bd6b9933ffd6f3
SHA256b5d97005666ceaf125439369319fb754bdd4126cd863c28ad0470ac062b473e1
SHA51202eb725689eeaf0766956a075a423a27848c8824aa43fdb073aca433db2e7dd72cbb77ab72c10047e570bf744fb523d7090bc4ac660e9550ee8975d18bbfc22d
-
Filesize
718B
MD565771bfa33f7dc57b25e3b1c5e41fb64
SHA12ef22d4212397c742a8f90dbd0b07000a2b544eb
SHA256d71613fd4d7b5b407aebbdaa4ce5fd18f2f1055687a91d8a09a43dad567b5368
SHA512cd1973d484382fd85a350c02db5b986737d55f3eecdc43e5e35b59be6be695eee1bd271c2d0c8ea7b32e9edb590bec123baab98f86b0fd42ac5ab60d0ede5663
-
Filesize
500B
MD532a207bc45a735fd1f81449bdf12f151
SHA1528b6dd3fc15175217eb6dcf5dd781c805622fd7
SHA2564971e88223bf1200feb70648e9185c20eb2f2a74f8b7ecc7a8ca70f7e2df1723
SHA512760a3b9bea801310b3f7e39b5d2c5c7596a792bb4fffa9ad9d24d3fface368fec8eceb64d440c228e2db636865449b38f13ed4d0fa250952b383705c39fd4720
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
1.1MB