dcrat | b8c5e2c8477706f3f54e152443718dcec270889002289aa1730eabc5ba3f312f

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
Size

1.6MB
MD5

f088c5388663eeeed395b7263d1f4993
SHA1

698d5eaabf3b5ce145f89f810311a0b42dade120
SHA256

279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819
SHA512

c9d946db7a10abed675d764436f3af3482b5259589fa976758b28bcd7c5b380bde9e338783611cbc5925cfdabbe0c9ba930bdb85aec7e6190d935b678b5dbba6
SSDEEP

24576:6sm8JijftfWIqZpyh/X6bSmV2GKz1oncoiF9GFwUvpHk3tSfEybcswrJ4gOEGEk:6D8Jijt+xpS/ekYmLGdhEAf7bCcjE

Score

10^/10

dcrat execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 5 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	1932	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1932	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	1932	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	1932	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	1932	schtasks.exe	28

DCRat payload 10 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral21/memory/2916-1-0x0000000000DA0000-0x0000000000F42000-memory.dmp	dcrat
behavioral21/files/0x000700000001211a-27.dat	dcrat
behavioral21/files/0x000600000001922c-46.dat	dcrat
behavioral21/memory/2296-72-0x0000000000A00000-0x0000000000BA2000-memory.dmp	dcrat
behavioral21/memory/1872-84-0x0000000000280000-0x0000000000422000-memory.dmp	dcrat
behavioral21/memory/1896-96-0x0000000001190000-0x0000000001332000-memory.dmp	dcrat
behavioral21/memory/1900-130-0x0000000000040000-0x00000000001E2000-memory.dmp	dcrat
behavioral21/memory/856-142-0x00000000003F0000-0x0000000000592000-memory.dmp	dcrat
behavioral21/memory/2712-154-0x00000000010C0000-0x0000000001262000-memory.dmp	dcrat
behavioral21/memory/2720-166-0x00000000013C0000-0x0000000001562000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2724	powershell.exe
2640	powershell.exe
2512	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
2296	explorer.exe
1872	explorer.exe
1896	explorer.exe
2636	explorer.exe
1288	explorer.exe
1900	explorer.exe
856	explorer.exe
2712	explorer.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\explorer.exe	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File created	C:\Program Files\7-Zip\7a0fd90576e088	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File opened for modification	C:\Program Files\7-Zip\RCXB272.tmp	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File opened for modification	C:\Program Files\7-Zip\RCXB2E0.tmp	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File opened for modification	C:\Program Files\7-Zip\explorer.exe	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\PolicyDefinitions\en-US\Idle.exe	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\Idle.exe	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File created	C:\Windows\PolicyDefinitions\en-US\6ccacd8608530f	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\RCXB05D.tmp	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\RCXB05E.tmp	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2128	schtasks.exe
3056	schtasks.exe
1804	schtasks.exe
2400	schtasks.exe
2084	schtasks.exe
1992	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
2512	powershell.exe
2640	powershell.exe
2724	powershell.exe
2296	explorer.exe
1872	explorer.exe
1896	explorer.exe
2636	explorer.exe
1288	explorer.exe
1900	explorer.exe
856	explorer.exe
2712	explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2296	explorer.exe
Token: SeDebugPrivilege	1872	explorer.exe
Token: SeDebugPrivilege	1896	explorer.exe
Token: SeDebugPrivilege	2636	explorer.exe
Token: SeDebugPrivilege	1288	explorer.exe
Token: SeDebugPrivilege	1900	explorer.exe
Token: SeDebugPrivilege	856	explorer.exe
Token: SeDebugPrivilege	2712	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2724	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	35
PID 2916 wrote to memory of 2724	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	35
PID 2916 wrote to memory of 2724	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	35
PID 2916 wrote to memory of 2640	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	36
PID 2916 wrote to memory of 2640	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	36
PID 2916 wrote to memory of 2640	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	36
PID 2916 wrote to memory of 2512	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	37
PID 2916 wrote to memory of 2512	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	37
PID 2916 wrote to memory of 2512	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	37
PID 2916 wrote to memory of 2296	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	41
PID 2916 wrote to memory of 2296	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	41
PID 2916 wrote to memory of 2296	2916	279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe	41
PID 2296 wrote to memory of 1316	2296	explorer.exe	42
PID 2296 wrote to memory of 1316	2296	explorer.exe	42
PID 2296 wrote to memory of 1316	2296	explorer.exe	42
PID 2296 wrote to memory of 1252	2296	explorer.exe	43
PID 2296 wrote to memory of 1252	2296	explorer.exe	43
PID 2296 wrote to memory of 1252	2296	explorer.exe	43
PID 1316 wrote to memory of 1872	1316	WScript.exe	46
PID 1316 wrote to memory of 1872	1316	WScript.exe	46
PID 1316 wrote to memory of 1872	1316	WScript.exe	46
PID 1872 wrote to memory of 2576	1872	explorer.exe	47
PID 1872 wrote to memory of 2576	1872	explorer.exe	47
PID 1872 wrote to memory of 2576	1872	explorer.exe	47
PID 1872 wrote to memory of 948	1872	explorer.exe	48
PID 1872 wrote to memory of 948	1872	explorer.exe	48
PID 1872 wrote to memory of 948	1872	explorer.exe	48
PID 2576 wrote to memory of 1896	2576	WScript.exe	49
PID 2576 wrote to memory of 1896	2576	WScript.exe	49
PID 2576 wrote to memory of 1896	2576	WScript.exe	49
PID 1896 wrote to memory of 1248	1896	explorer.exe	50
PID 1896 wrote to memory of 1248	1896	explorer.exe	50
PID 1896 wrote to memory of 1248	1896	explorer.exe	50
PID 1896 wrote to memory of 2628	1896	explorer.exe	51
PID 1896 wrote to memory of 2628	1896	explorer.exe	51
PID 1896 wrote to memory of 2628	1896	explorer.exe	51
PID 1248 wrote to memory of 2636	1248	WScript.exe	52
PID 1248 wrote to memory of 2636	1248	WScript.exe	52
PID 1248 wrote to memory of 2636	1248	WScript.exe	52
PID 2636 wrote to memory of 1568	2636	explorer.exe	53
PID 2636 wrote to memory of 1568	2636	explorer.exe	53
PID 2636 wrote to memory of 1568	2636	explorer.exe	53
PID 2636 wrote to memory of 2592	2636	explorer.exe	54
PID 2636 wrote to memory of 2592	2636	explorer.exe	54
PID 2636 wrote to memory of 2592	2636	explorer.exe	54
PID 1568 wrote to memory of 1288	1568	WScript.exe	55
PID 1568 wrote to memory of 1288	1568	WScript.exe	55
PID 1568 wrote to memory of 1288	1568	WScript.exe	55
PID 1288 wrote to memory of 1492	1288	explorer.exe	56
PID 1288 wrote to memory of 1492	1288	explorer.exe	56
PID 1288 wrote to memory of 1492	1288	explorer.exe	56
PID 1288 wrote to memory of 2780	1288	explorer.exe	57
PID 1288 wrote to memory of 2780	1288	explorer.exe	57
PID 1288 wrote to memory of 2780	1288	explorer.exe	57
PID 1492 wrote to memory of 1900	1492	WScript.exe	58
PID 1492 wrote to memory of 1900	1492	WScript.exe	58
PID 1492 wrote to memory of 1900	1492	WScript.exe	58
PID 1900 wrote to memory of 1544	1900	explorer.exe	59
PID 1900 wrote to memory of 1544	1900	explorer.exe	59
PID 1900 wrote to memory of 1544	1900	explorer.exe	59
PID 1900 wrote to memory of 936	1900	explorer.exe	60
PID 1900 wrote to memory of 936	1900	explorer.exe	60
PID 1900 wrote to memory of 936	1900	explorer.exe	60
PID 1544 wrote to memory of 856	1544	WScript.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe
"C:\Users\Admin\AppData\Local\Temp\279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PolicyDefinitions\en-US\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Program Files\7-Zip\explorer.exe
  "C:\Program Files\7-Zip\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\599b3432-76c9-47d9-8063-748cfe5b48ce.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Program Files\7-Zip\explorer.exe
      "C:\Program Files\7-Zip\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4df1cd54-0528-4dd5-a01a-aaad951561e7.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2576
      - C:\Program Files\7-Zip\explorer.exe
        
        "C:\Program Files\7-Zip\explorer.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1ce4b579-6e6c-491c-a5b1-f6482062a76b.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Program Files\7-Zip\explorer.exe
        
        "C:\Program Files\7-Zip\explorer.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18b32915-a749-46ba-ac30-8ed199de5b5c.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Program Files\7-Zip\explorer.exe
        
        "C:\Program Files\7-Zip\explorer.exe"
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7aaefba0-80f6-47ab-b64b-c31c7e9bf581.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Program Files\7-Zip\explorer.exe
        
        "C:\Program Files\7-Zip\explorer.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72b397a9-aef9-4a0f-b51b-da100115f22e.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Program Files\7-Zip\explorer.exe
        
        "C:\Program Files\7-Zip\explorer.exe"
        14⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:856
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bda51ec-0c7b-44ed-84ee-029cb9e4cf74.vbs"
        15⤵
        
        PID:2004
        
        C:\Program Files\7-Zip\explorer.exe
        
        "C:\Program Files\7-Zip\explorer.exe"
        16⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\472d0ff1-37fb-4a7d-8d39-d53e842006bb.vbs"
        17⤵
        
        PID:1884
        
        C:\Program Files\7-Zip\explorer.exe
        
        "C:\Program Files\7-Zip\explorer.exe"
        18⤵
        
        PID:2720
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec8d7ff0-b9e3-4236-9898-fb6ac4517014.vbs"
        17⤵
        
        PID:2888
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76127f83-8d66-41f2-99cf-20806e95555f.vbs"
        15⤵
        
        PID:1692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f26983cc-5b99-4151-af4f-73ba621735a1.vbs"
        13⤵
        
        PID:936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab2baac7-1397-405b-b26f-183ef3f0c9e3.vbs"
        11⤵
        
        PID:2780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00440eba-f14f-41b8-9de0-7a36ddc0a888.vbs"
        9⤵
        
        PID:2592
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59c2d90d-dd45-4c6e-9004-537190ce4eda.vbs"
        7⤵
        
        PID:2628
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8a10f86-aaf0-4710-abd9-4fb968e9005c.vbs"
        5⤵
        
        PID:948
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5b48137-9ef2-4e80-b7c4-085a26f00605.vbs"
    3⤵
    PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\PolicyDefinitions\en-US\Idle.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\PolicyDefinitions\en-US\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\7-Zip\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\7-Zip\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\explorer.exe

Filesize
1.6MB

MD5
5d552c4557dddbe9d0520a94f3c07c16

SHA1
9c043bf35c7c185130d561941dfe2fffed1371d3

SHA256
f2471dc98bc93670da6e397014ddc105455eccb0e2bf196ba442f29187ce74b8

SHA512
d5b9b6c97df268e5d4583af60043c24e0b5679dfaffb3eac1e0f55a8f2b47536cbe77bfe27f3be9af9cdb9871bf5539fe9c77554aaf432c1732cb53a3d6524a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\18b32915-a749-46ba-ac30-8ed199de5b5c.vbs

Filesize
711B

MD5
0bb952a63212be9e7886768e58af5a82

SHA1
3494b29fb8984380a951cafd1a34254016aa1caa

SHA256
5b3fbd9481d20cbccc3c969a9fb60a1df9931d80c23cfec20fb032344a828620

SHA512
7c50e3480ee93674bd346a9852808eb3bd07b0adf141e9fb9a569be17d4159e3f84bc532b59ccd6f4b1ec17e2a74c2c375cd20e07197619ef9e5f9d2b9d743c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1ce4b579-6e6c-491c-a5b1-f6482062a76b.vbs

Filesize
711B

MD5
2507c96cde204fba4f2fff54b4bc86ee

SHA1
30143b180b228c6059ffb8ebaa2e133275655c95

SHA256
f73c88ebf66e75f5e31c517cd76e00f276faa091e531a98858e0d53cd2d510aa

SHA512
0a9b4928f89ca739ef740740968371cee736f8d1282ffdd70945f6c2884f7ba499e3d01d5e62dbf9fa9f835f7fec5450fe32ed7f3d24163722b636ebab48e410

Download Submit
C:\Users\Admin\AppData\Local\Temp\472d0ff1-37fb-4a7d-8d39-d53e842006bb.vbs

Filesize
711B

MD5
d7691e2c791067a3b6fece63025aecac

SHA1
2ca4e3ab1fc6233a3eda3a58b59c8cbef2fbf872

SHA256
309687e3c9fa0344a645bb0e4dd08dc32dbd9b39f5cbe2e6f523a043960e0f1d

SHA512
7af6201cab5801b8760409f5fe41f21effa449343d70754c39588948f8abc6c956875afa1df63d026f0347f4341122a7169d0a2925425fecc1c9432031f7f69a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4df1cd54-0528-4dd5-a01a-aaad951561e7.vbs

Filesize
711B

MD5
e7bc5ab70fae1c08a71e192f6bd75717

SHA1
6c4eb04e0a87c202e0eaa97995dd1b04a36ce313

SHA256
24c5344fc66db92072ad0be7686c815ac5723b51e2e9abfcbae6e85bd2611d65

SHA512
31e724f82ae65b334cade2c2816d5ad16fffbfd154d70a1a73981ebcdfc03c9bd1bade346e64b5d5e9bdc7228be3be290210f5fa245ad01cf242475bd0cd0751

Download Submit
C:\Users\Admin\AppData\Local\Temp\599b3432-76c9-47d9-8063-748cfe5b48ce.vbs

Filesize
711B

MD5
cde565e1b922a837cfd70d670c9585e9

SHA1
1f3845b99e0c1ba83925cbadb1cc5aee39f19361

SHA256
ea2ef145ce56ce9eaa5594979ece42c2c6815cff4a98f7ee544bbd5759e04b6f

SHA512
8ed9cb2a847488e617ebd0a32a2d30feac8f8c66ee5b12310271f27cf331145109e62930822e187d0c1dbdbe88d082e327e3d2cef25049f70bc395d313b67943

Download Submit
C:\Users\Admin\AppData\Local\Temp\6bda51ec-0c7b-44ed-84ee-029cb9e4cf74.vbs

Filesize
710B

MD5
ee2d024f52d834fe845ac0acad2b6eca

SHA1
c742ebe49ff2c41c6887fe541c87dd4bd70458d0

SHA256
8dbf29a33732164a30bfd81f6c0d2c9ef78fb2f08023260b96f77534af4b3fb0

SHA512
11f6e3c7f8a94f88e08208639af15c7e8e208cce88d69cfc46da9d468e906c86aeafac6e9a2a723d9590c7ef0f4466660abc3f63d7fb01f8653f21d4eaeb0e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\72b397a9-aef9-4a0f-b51b-da100115f22e.vbs

Filesize
711B

MD5
d765a689f5d4a087bedc6f81c73cae1b

SHA1
3bb6b80e968eda121c5cd4477b0cee7e315f42a6

SHA256
d3ee503162fb29040620af508b687a29862388f64b5d8d3eb59d82674cd6f25a

SHA512
541dbd725f40c650715ac8b1d1cb857f0fad07eb361940f698366ae67b153a57680e107d21319766c3206935de5e32c24378620f8534253e090e1f18a47846fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7aaefba0-80f6-47ab-b64b-c31c7e9bf581.vbs

Filesize
711B

MD5
c16ca2abdb4f150d99d29bbaa28bb9ea

SHA1
2c5df4cc53d9923a79cfbd35bbde1ca7d407b781

SHA256
ddfa8745dd002457cedd9caea3eab7c36a4a400424cda5123bf60ae4b28008a9

SHA512
7e2b0f21cf5a298565084762ce4da6bc3f5842c3a70bdc9ef39e7145d149e1e239e7242550448db4242f1cb24f2bb21165062fb02b4e860cc27b86157afedd8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\d5b48137-9ef2-4e80-b7c4-085a26f00605.vbs

Filesize
487B

MD5
5986db08fa2efd8662a9d308c811e682

SHA1
ab081c4dbf629770588758ddf1f90bab0286bf60

SHA256
bf949fad764d8f5885d87f11ccb121feab310720be2d76a452c3d9d6c06c4e01

SHA512
9e6a7aa1851d32eba3fc41d9c0f4034bc1ee8f9b51b245e54635ccacd7eeb8d13c7303541fc83165d25939e1bd1264cf830ce76693a62c8e5dcd62b5481d3707

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\22QSC5JYDZY3K6IQMMEZ.temp

Filesize
7KB

MD5
2a4b43c91907e55afea34e49d633d621

SHA1
b4b2cbb7c23095288dead76913c077fe4c013766

SHA256
5db289fb31202adfa7a4c4ff8ca1504ea85721886f2ae2bc832b5c7c95ea13ad

SHA512
8f33b4879df1189db84daf2da244f5f732641bd4578294552269dfbb32a20f2f93fc97f8df2ca1ef9344933b51c91ebce28cae2f91adfada675c3b5e4385e203

Download Submit
C:\Windows\PolicyDefinitions\en-US\Idle.exe

Filesize
1.6MB

MD5
f088c5388663eeeed395b7263d1f4993

SHA1
698d5eaabf3b5ce145f89f810311a0b42dade120

SHA256
279ceeb4dbef5230750c02de9ade3cf0297d0abf23ac8b8a8cf1c0156b510819

SHA512
c9d946db7a10abed675d764436f3af3482b5259589fa976758b28bcd7c5b380bde9e338783611cbc5925cfdabbe0c9ba930bdb85aec7e6190d935b678b5dbba6

Download Submit
memory/856-142-0x00000000003F0000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/1872-84-0x0000000000280000-0x0000000000422000-memory.dmp

Filesize
1.6MB

Download
memory/1896-96-0x0000000001190000-0x0000000001332000-memory.dmp

Filesize
1.6MB

Download
memory/1900-130-0x0000000000040000-0x00000000001E2000-memory.dmp

Filesize
1.6MB

Download
memory/2296-72-0x0000000000A00000-0x0000000000BA2000-memory.dmp

Filesize
1.6MB

Download
memory/2512-66-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2640-65-0x000000001B860000-0x000000001BB42000-memory.dmp

Filesize
2.9MB

Download
memory/2712-154-0x00000000010C0000-0x0000000001262000-memory.dmp

Filesize
1.6MB

Download
memory/2720-166-0x00000000013C0000-0x0000000001562000-memory.dmp

Filesize
1.6MB

Download
memory/2916-14-0x0000000000D00000-0x0000000000D08000-memory.dmp

Filesize
32KB

Download
memory/2916-2-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/2916-73-0x000007FEF5580000-0x000007FEF5F6C000-memory.dmp

Filesize
9.9MB

Download
memory/2916-11-0x0000000000CD0000-0x0000000000CDA000-memory.dmp

Filesize
40KB

Download
memory/2916-12-0x0000000000CE0000-0x0000000000CEE000-memory.dmp

Filesize
56KB

Download
memory/2916-13-0x0000000000CF0000-0x0000000000CF8000-memory.dmp

Filesize
32KB

Download
memory/2916-0-0x000007FEF5583000-0x000007FEF5584000-memory.dmp

Filesize
4KB

Download
memory/2916-5-0x00000000009C0000-0x00000000009D6000-memory.dmp

Filesize
88KB

Download
memory/2916-3-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/2916-4-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2916-15-0x0000000000D10000-0x0000000000D1A000-memory.dmp

Filesize
40KB

Download
memory/2916-16-0x000000001A930000-0x000000001A93C000-memory.dmp

Filesize
48KB

Download
memory/2916-10-0x0000000000B30000-0x0000000000B3C000-memory.dmp

Filesize
48KB

Download
memory/2916-9-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Filesize
48KB

Download
memory/2916-8-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

Filesize
32KB

Download
memory/2916-7-0x0000000000AF0000-0x0000000000B00000-memory.dmp

Filesize
64KB

Download
memory/2916-1-0x0000000000DA0000-0x0000000000F42000-memory.dmp

Filesize
1.6MB

Download
memory/2916-6-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download