dcrat | add6234329d65ae878b6112d7d63d6641b842d28c0fa2fa5fbbb09a1b835bc0c

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

231f156f9f4b328156bcb91a17f2a636.exe
Size

3.0MB
MD5

231f156f9f4b328156bcb91a17f2a636
SHA1

4a152cf18df6e69aae5dc7188dc29cae5d58c062
SHA256

703c6e6e766b8454ab69233c17b178c5e8cf75367a99195b00f969f0896ed15f
SHA512

bbd3e640ad27a495b3c967c6d69951f061b70da3205416a547da735c003ada40e7ea64de0cf3652756f7cb07d957dfb00ee1e71d70ddddabd5a9e19546301136
SSDEEP

49152:q/3iuoi0xrLIy5sx+3K0n+B87/2bHJC3H0oJK7rohky64a65KKRD:4SuMxAxKp+SDqHJq+zy86A

Score

10^/10

dcrat defense_evasion discovery execution infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\", \"C:\\Windows\\twain_32\\dllhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\", \"C:\\Windows\\twain_32\\dllhost.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\", \"C:\\Windows\\twain_32\\dllhost.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Users\\Admin\\Downloads\\audiodg.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\", \"C:\\Windows\\twain_32\\dllhost.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Users\\Admin\\Downloads\\audiodg.exe\", \"C:\\Program Files\\Common Files\\Services\\OSPPSVC.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\", \"C:\\Windows\\twain_32\\dllhost.exe\", \"C:\\Users\\Default User\\WMIADAP.exe\", \"C:\\Users\\Admin\\Downloads\\audiodg.exe\", \"C:\\Program Files\\Common Files\\Services\\OSPPSVC.exe\", \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\smss.exe\""	231f156f9f4b328156bcb91a17f2a636.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2724	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	2892	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	2892	schtasks.exe	31

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral19/memory/2172-1-0x0000000001340000-0x000000000164E000-memory.dmp	dcrat
behavioral19/files/0x00050000000194ff-40.dat	dcrat
behavioral19/files/0x000a000000016cfc-69.dat	dcrat
behavioral19/files/0x000700000001946b-103.dat	dcrat
behavioral19/memory/2488-163-0x0000000001070000-0x000000000137E000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
828	powershell.exe
1940	powershell.exe
1900	powershell.exe
2480	powershell.exe
788	powershell.exe
1612	powershell.exe
2084	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2488	smss.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\ServiceProfiles\\NetworkService\\wininit.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\twain_32\\dllhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\twain_32\\dllhost.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Default User\\WMIADAP.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Admin\\Downloads\\audiodg.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Users\\Admin\\Downloads\\audiodg.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\Common Files\\Services\\OSPPSVC.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Users\\Default User\\WMIADAP.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\Common Files\\Services\\OSPPSVC.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\smss.exe\""	231f156f9f4b328156bcb91a17f2a636.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\smss.exe\""	231f156f9f4b328156bcb91a17f2a636.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	231f156f9f4b328156bcb91a17f2a636.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Services\1610b97d3ab4a7	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Common Files\Services\RCXE950.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Common Files\Services\RCXE9BE.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Program Files\Common Files\Services\OSPPSVC.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Program Files\Common Files\Services\OSPPSVC.exe	231f156f9f4b328156bcb91a17f2a636.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\dllhost.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Windows\twain_32\5940a34987c991	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\RCXDFB7.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Windows\twain_32\RCXE238.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Windows\twain_32\dllhost.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Windows\ServiceProfiles\NetworkService\wininit.exe	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\wininit.exe	231f156f9f4b328156bcb91a17f2a636.exe
File created	C:\Windows\ServiceProfiles\NetworkService\56085415360792	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\RCXDFC7.tmp	231f156f9f4b328156bcb91a17f2a636.exe
File opened for modification	C:\Windows\twain_32\RCXE2A7.tmp	231f156f9f4b328156bcb91a17f2a636.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FEF05D1-06E4-11F0-A7E8-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8af94f3fbf2ce42aae37dc00a37f0e1000000000200000000001066000000010000200000007f0e4f82b2ae134eb138e8f85a3f797bc0aa0d0c63c92e00f1b1f5e7b26f9990000000000e80000000020000200000007960df25a2ce0ec2dd0da13e120753cc0ab7b3d79cedad2778a8319ef34f7f72900000007afb4fbbcd2be3a738c0096ae2580f1c46f6d75ec13db7608329b2f1adc0b316eb3239ab02e1efebc7ca293f780563cf800dcc0db3dc6015d6d7259759eee2d6cd02e18c1779887958a07f51550efe614df1fb81cccfa7757ef9bead681ac0e204831b18a60f181715a4545b197aecb4e8691e7855b761aab0d6e5a5513059131b3d2a6facc2400a56d9a14aa715865f400000005d825023d6f0ac0ff2dc7f751c19fe55da4be82aeac679cc4be1c9ffead3ce862d227cfde4560bff081b06a647feb1bc2304dcb031d9c37b760e42433dd1ef78	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "448785790"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8af94f3fbf2ce42aae37dc00a37f0e100000000020000000000106600000001000020000000e212a133d0a558d869e4b9029ed32b00e0a5d020c941cd7f5d6d994bf9271df3000000000e8000000002000020000000536a0e10d2aaea62d6ab32c8674a50abb391516125083915bcd0bd7ef71f565b20000000a6c411275d79c9a1ef66751a77adfeec148a070fe266d3697905eb152740c12540000000a248c4cfd8b1fc5a2386c8c317c05fd48abc03d7bcf4363c1223c6c35b1e5a599817ac1f7cec25ae7ad649006d886d7313ae21af2ea90d6c1010a82946bfa696	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303e6e69f19adb01	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2760	schtasks.exe
2208	schtasks.exe
2916	schtasks.exe
1648	schtasks.exe
1836	schtasks.exe
2724	schtasks.exe
2008	schtasks.exe
1692	schtasks.exe
1860	schtasks.exe
1728	schtasks.exe
2572	schtasks.exe
1384	schtasks.exe
760	schtasks.exe
1924	schtasks.exe
2164	schtasks.exe
2656	schtasks.exe
2640	schtasks.exe
1920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
788	powershell.exe
2084	powershell.exe
1612	powershell.exe
2172	231f156f9f4b328156bcb91a17f2a636.exe
2480	powershell.exe
1900	powershell.exe
828	powershell.exe
1940	powershell.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe
2488	smss.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	231f156f9f4b328156bcb91a17f2a636.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	2480	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	2488	smss.exe
Token: SeBackupPrivilege	2160	vssvc.exe
Token: SeRestorePrivilege	2160	vssvc.exe
Token: SeAuditPrivilege	2160	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2488	smss.exe
2288	iexplore.exe
2288	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2480	2172	231f156f9f4b328156bcb91a17f2a636.exe	50
PID 2172 wrote to memory of 2480	2172	231f156f9f4b328156bcb91a17f2a636.exe	50
PID 2172 wrote to memory of 2480	2172	231f156f9f4b328156bcb91a17f2a636.exe	50
PID 2172 wrote to memory of 788	2172	231f156f9f4b328156bcb91a17f2a636.exe	51
PID 2172 wrote to memory of 788	2172	231f156f9f4b328156bcb91a17f2a636.exe	51
PID 2172 wrote to memory of 788	2172	231f156f9f4b328156bcb91a17f2a636.exe	51
PID 2172 wrote to memory of 1612	2172	231f156f9f4b328156bcb91a17f2a636.exe	52
PID 2172 wrote to memory of 1612	2172	231f156f9f4b328156bcb91a17f2a636.exe	52
PID 2172 wrote to memory of 1612	2172	231f156f9f4b328156bcb91a17f2a636.exe	52
PID 2172 wrote to memory of 2084	2172	231f156f9f4b328156bcb91a17f2a636.exe	53
PID 2172 wrote to memory of 2084	2172	231f156f9f4b328156bcb91a17f2a636.exe	53
PID 2172 wrote to memory of 2084	2172	231f156f9f4b328156bcb91a17f2a636.exe	53
PID 2172 wrote to memory of 1900	2172	231f156f9f4b328156bcb91a17f2a636.exe	55
PID 2172 wrote to memory of 1900	2172	231f156f9f4b328156bcb91a17f2a636.exe	55
PID 2172 wrote to memory of 1900	2172	231f156f9f4b328156bcb91a17f2a636.exe	55
PID 2172 wrote to memory of 1940	2172	231f156f9f4b328156bcb91a17f2a636.exe	56
PID 2172 wrote to memory of 1940	2172	231f156f9f4b328156bcb91a17f2a636.exe	56
PID 2172 wrote to memory of 1940	2172	231f156f9f4b328156bcb91a17f2a636.exe	56
PID 2172 wrote to memory of 828	2172	231f156f9f4b328156bcb91a17f2a636.exe	58
PID 2172 wrote to memory of 828	2172	231f156f9f4b328156bcb91a17f2a636.exe	58
PID 2172 wrote to memory of 828	2172	231f156f9f4b328156bcb91a17f2a636.exe	58
PID 2172 wrote to memory of 2264	2172	231f156f9f4b328156bcb91a17f2a636.exe	64
PID 2172 wrote to memory of 2264	2172	231f156f9f4b328156bcb91a17f2a636.exe	64
PID 2172 wrote to memory of 2264	2172	231f156f9f4b328156bcb91a17f2a636.exe	64
PID 2264 wrote to memory of 2744	2264	cmd.exe	66
PID 2264 wrote to memory of 2744	2264	cmd.exe	66
PID 2264 wrote to memory of 2744	2264	cmd.exe	66
PID 2264 wrote to memory of 2488	2264	cmd.exe	67
PID 2264 wrote to memory of 2488	2264	cmd.exe	67
PID 2264 wrote to memory of 2488	2264	cmd.exe	67
PID 2488 wrote to memory of 584	2488	smss.exe	68
PID 2488 wrote to memory of 584	2488	smss.exe	68
PID 2488 wrote to memory of 584	2488	smss.exe	68
PID 2488 wrote to memory of 1728	2488	smss.exe	69
PID 2488 wrote to memory of 1728	2488	smss.exe	69
PID 2488 wrote to memory of 1728	2488	smss.exe	69
PID 2488 wrote to memory of 2288	2488	smss.exe	74
PID 2488 wrote to memory of 2288	2488	smss.exe	74
PID 2488 wrote to memory of 2288	2488	smss.exe	74
PID 2288 wrote to memory of 2320	2288	iexplore.exe	75
PID 2288 wrote to memory of 2320	2288	iexplore.exe	75
PID 2288 wrote to memory of 2320	2288	iexplore.exe	75
PID 2288 wrote to memory of 2320	2288	iexplore.exe	75

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	231f156f9f4b328156bcb91a17f2a636.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\231f156f9f4b328156bcb91a17f2a636.exe
"C:\Users\Admin\AppData\Local\Temp\231f156f9f4b328156bcb91a17f2a636.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\231f156f9f4b328156bcb91a17f2a636.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\NetworkService\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\WMIADAP.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\Services\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fwAG7KGXHJ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2744
- - C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe
    "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2488
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8a0d1024-97d9-4b72-8b00-6a333b5b8e51.vbs"
      4⤵
      PID:584
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\baff45db-b334-45ab-95c4-f163053e9db9.vbs"
      4⤵
      PID:1728
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:12261/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\ServiceProfiles\NetworkService\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\NetworkService\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\ServiceProfiles\NetworkService\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\twain_32\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\twain_32\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Users\Default User\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Downloads\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\Admin\Downloads\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Downloads\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\Services\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Common Files\Services\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Common Files\Services\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Services\OSPPSVC.exe

Filesize
3.0MB

MD5
231f156f9f4b328156bcb91a17f2a636

SHA1
4a152cf18df6e69aae5dc7188dc29cae5d58c062

SHA256
703c6e6e766b8454ab69233c17b178c5e8cf75367a99195b00f969f0896ed15f

SHA512
bbd3e640ad27a495b3c967c6d69951f061b70da3205416a547da735c003ada40e7ea64de0cf3652756f7cb07d957dfb00ee1e71d70ddddabd5a9e19546301136

Download Submit
C:\Program Files\Common Files\Services\OSPPSVC.exe

Filesize
3.0MB

MD5
c38d7a50f2ec7420ce214c14aa3085a9

SHA1
f3aba002960a9151f8ffe352c12d1fa5d1d1fb2c

SHA256
7052b709b8ac8580bdccfddbffc4c7ead1347ca3119036ad912e3b9dbb9e3b76

SHA512
3cb84ec5ae8d82665c476e9a8353de3a72e9ed8a650be67b2bea4456de82bc18cf5f4f5c3db17da9ad0293854d7d7deb79bb25823f8d7c5fc1ef401b3665e5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23eaf1d778cc9a78f4fdd0dda0b6ffad

SHA1
b481ccfadeac8f494f3a82035216ebccdb249164

SHA256
643eae3e7a7f08df7ba6efc0b0b1d74602feb0aa65fc1ece36b19d367d35c0b3

SHA512
0169524fa2a170be50684020dee9d872296a67a4f71756fb5a610783881e0e751e58fede7a911d0ef69943e0012f328e3d06621e01d8ef9ec98084587b914b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ed92560381bec36e3cf69a0d24118ae

SHA1
a62c4742ca1212706f5d1baa159234027272242a

SHA256
88106a41995a127df3752a6e17e05428a9d7e68200c8e91f305f1d6b8f0c2363

SHA512
226e60e6d9728638d025bc9887d9c22ff9f18a147e688c920010e08e9484beaa514ef694c9929faacc6b71951362b303c81ee2b8dbb00e89fedf699c6d4ed0dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9b1769b5e7fb9d8f46021b7a6061177

SHA1
2e4ab736bb699bb89afb735dbb57ba9036f38611

SHA256
a69a67be0b5277e0d754917b4ce0f5e9e84b757b162da7d433ed789104ce4588

SHA512
4b7b224afda662e1ac82a1e0de389115c1afe439484097c82e62b640cd7700a5aa20e8e2e10cefbe7cc76a48b588987d3c5c63d395100e012a06faf4431fd97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6932bfe2f2a609bc9652cf37527dd7b7

SHA1
713624daa581682920e18bdc28138dd93482b05a

SHA256
c2c767f8fdc6c2c6925218f986b2958a8421aa791133eea039c54dc9464879ff

SHA512
809755375b9fcf486db750c481f3664d6331382ee8c74d1c14fc096e0a7461e90d60b871b9bd466ab92b0a7c4a46d23000be12c40485c4dbbd7e89255552a18d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
690b85590436a41c42dc870aec2c3fc9

SHA1
c86526a042475317a8c224a5eba0111196aaf41f

SHA256
3c775934be89f7bfa7124ee5ac237a03e98bf2ccd262c9f3e30e0fcb8d9c8582

SHA512
b50c34a2f210d14eadfe6d0776d0b5e05a0d4eb2cd7d065b21afe5344427f5cea3b0b950b71eb470943e0af5cae92aaae5581b3803aa878cacb009da9f1e146a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32f9bd479e99bd1a24e195888ea5b04a

SHA1
cb2fa4c4f607846bdaf31ee9e2954c8083adeeff

SHA256
c3fde2c0755eca4e885bc1ff0e03d1d3162e10c32ce42b12bea52ee9ce5e091c

SHA512
cf511b5b1c46bd07abb37a90957e780fcb9112bd83cbb9984010f728c3d0579e65f5507596166e30e7a41b234ae7189f54fea6aaada6f7fa5b4ce2dbda7b3c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e16b11c85c478b0cbb6fb8ba6a3f39b

SHA1
da997c5b3c517d454cce1528bb2512c16d9ecd47

SHA256
1876b0b15f429fce1c15b92b9dd51e1964dc615a098428e5deb25cbe6e1a4a6a

SHA512
da7875d74da130cf7b54b5779cd654c9c915a7131e0c81789e5d11e63d5fc697fb64e67b828f67e0de07fa15c52531bd4e651f4486a3e2e40ccd749d1602e945

Download Submit
C:\Users\Admin\AppData\Local\Temp\8a0d1024-97d9-4b72-8b00-6a333b5b8e51.vbs

Filesize
747B

MD5
97e06fa0d7f0d451a86be574b91884cd

SHA1
1e58e5264e206d95eea30c297252480dd114f961

SHA256
0b8c7f112b268f653f4a23159388f51fba0861c473e8c62919ebb25a6f961fa9

SHA512
ea5881ebafb76f331e7a9bcc5f17bc21d26043ff65e25686c77265a4bcaffdd4f66daab1638fa3d50ce7814eb468b15744bdaf04c457c4b5096425f42b5bca58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5709.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58EE.tmp

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5913.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\baff45db-b334-45ab-95c4-f163053e9db9.vbs

Filesize
523B

MD5
6c7270c4e624e72fdbc44f2a96ce6f6c

SHA1
eb9e77a5298cc671651b69cace6d5c74577588c9

SHA256
f365ee2020c712f6867b575e0d94dd5eac90f2223e397d1f7cef581e3e6fdd62

SHA512
22b562d91d97bf21603f2d0ccd78cc8fceaaf3eecc5deee605c86d1a7c0486de4985a11deed609833c0fdf21a386ab6da5e69df5d0b4e367e9915a9759a54122

Download Submit
C:\Users\Admin\AppData\Local\Temp\fwAG7KGXHJ.bat

Filesize
236B

MD5
feff2c0e9601ba976ef02bd520591cc0

SHA1
99a745ce621d87dc3b9255bd19cd05530040712d

SHA256
597480d8a638ada35229ee42d885e65bedf4f16cbee9379845e114ec78725036

SHA512
7d09ad0e973d778873947465b83ce996655c314e2d2bbaf050ab79fc0e3e5479e0f4f5d4ae4b72ec2f51bd8596531b0aec1112600b2f0d8826a949cf37613fb5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
644c2efa65447a83c2b04306eb405bf0

SHA1
013a75b82ca112e0b80251d810d0eb01bcc08c37

SHA256
c50b33a926354bab6de1d3cba70f6c088e8e41771677d108abc5df58662f2b47

SHA512
44f417e03a069200c64392446d8f24e98019cb21e0c3bb0e36510237c8f8a63d3a80c7b3d99f5145cc23436418079e66a023bd7436d2e595568a37c88168aed1

Download Submit
C:\Windows\twain_32\dllhost.exe

Filesize
3.0MB

MD5
663b205f58dd1b963e8ce3332643fda7

SHA1
a53dfd08f2fa4722ff9f0b36b8bafa63d605985c

SHA256
b036596b8e7f6acb1532ca7c38d198ac840ae9351f3a8d106c21d844e27792e3

SHA512
4a911b78a8dd0b56fad984e5ee3c2ddc690f6015341f8a966b8fbaea8fb59742327154aa65ee76188da8ddd7e08f44441f590cd4d99ef63e3683335124b5495e

Download Submit
memory/788-137-0x000000001B440000-0x000000001B722000-memory.dmp

Filesize
2.9MB

Download
memory/788-138-0x00000000028A0000-0x00000000028A8000-memory.dmp

Filesize
32KB

Download
memory/2172-13-0x0000000000D10000-0x0000000000D1C000-memory.dmp

Filesize
48KB

Download
memory/2172-159-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/2172-21-0x000000001AA50000-0x000000001AA5C000-memory.dmp

Filesize
48KB

Download
memory/2172-22-0x000000001AA60000-0x000000001AA6C000-memory.dmp

Filesize
48KB

Download
memory/2172-23-0x000000001AA70000-0x000000001AA78000-memory.dmp

Filesize
32KB

Download
memory/2172-25-0x000000001AA90000-0x000000001AA9E000-memory.dmp

Filesize
56KB

Download
memory/2172-30-0x000000001AAE0000-0x000000001AAEA000-memory.dmp

Filesize
40KB

Download
memory/2172-31-0x000000001AAF0000-0x000000001AAFC000-memory.dmp

Filesize
48KB

Download
memory/2172-29-0x000000001AAD0000-0x000000001AAD8000-memory.dmp

Filesize
32KB

Download
memory/2172-28-0x000000001AAC0000-0x000000001AACC000-memory.dmp

Filesize
48KB

Download
memory/2172-27-0x000000001AAB0000-0x000000001AAB8000-memory.dmp

Filesize
32KB

Download
memory/2172-26-0x000000001AAA0000-0x000000001AAA8000-memory.dmp

Filesize
32KB

Download
memory/2172-24-0x000000001AA80000-0x000000001AA8A000-memory.dmp

Filesize
40KB

Download
memory/2172-19-0x0000000001320000-0x000000000132C000-memory.dmp

Filesize
48KB

Download
memory/2172-18-0x0000000001310000-0x000000000131C000-memory.dmp

Filesize
48KB

Download
memory/2172-16-0x00000000012D0000-0x00000000012D8000-memory.dmp

Filesize
32KB

Download
memory/2172-17-0x00000000012E0000-0x00000000012F2000-memory.dmp

Filesize
72KB

Download
memory/2172-20-0x0000000001330000-0x0000000001338000-memory.dmp

Filesize
32KB

Download
memory/2172-14-0x0000000000D20000-0x0000000000D28000-memory.dmp

Filesize
32KB

Download
memory/2172-15-0x0000000000D30000-0x0000000000D3C000-memory.dmp

Filesize
48KB

Download
memory/2172-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/2172-1-0x0000000001340000-0x000000000164E000-memory.dmp

Filesize
3.1MB

Download
memory/2172-12-0x0000000000CC0000-0x0000000000D16000-memory.dmp

Filesize
344KB

Download
memory/2172-11-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

Filesize
40KB

Download
memory/2172-9-0x0000000000C10000-0x0000000000C18000-memory.dmp

Filesize
32KB

Download
memory/2172-10-0x0000000000CB0000-0x0000000000CC0000-memory.dmp

Filesize
64KB

Download
memory/2172-8-0x00000000006F0000-0x00000000006F8000-memory.dmp

Filesize
32KB

Download
memory/2172-7-0x0000000000650000-0x0000000000666000-memory.dmp

Filesize
88KB

Download
memory/2172-6-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/2172-5-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download
memory/2172-4-0x00000000004A0000-0x00000000004BC000-memory.dmp

Filesize
112KB

Download
memory/2172-3-0x00000000002B0000-0x00000000002B8000-memory.dmp

Filesize
32KB

Download
memory/2172-2-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-163-0x0000000001070000-0x000000000137E000-memory.dmp

Filesize
3.1MB

Download