Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:12

General

  • Target

    6ec1c209b158ca6a09569dab997a10da.exe

  • Size

    5.9MB

  • MD5

    6ec1c209b158ca6a09569dab997a10da

  • SHA1

    1edc7c6f32e6b4ebc5faf5a522ed5992fc73bedf

  • SHA256

    44c8df0ee91d3ab2825961ab81fed1370c75c034ef717b2baa192c2430eb65a3

  • SHA512

    821d17198941051e5bd354fe5ea3fded5e196cd41b900714f9d68bb25baecca306160c695790649d7f3a48bdacb2ec7d9eebd6a184e756501dcdc726d98fd857

  • SSDEEP

    98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4v:RyeU11Rvqmu8TWKnF6N/1wq

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 42 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 12 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ec1c209b158ca6a09569dab997a10da.exe
    "C:\Users\Admin\AppData\Local\Temp\6ec1c209b158ca6a09569dab997a10da.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2476
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5056
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2552
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/2f3e0199fccb3f72e8a39924edc6a781/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1932
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/34c553de294c1d56d0a800105b/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1376
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:508
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:888
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5364
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:5836
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3816
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:5516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5324
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6nXiVaNJ1D.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:700
      • C:\Windows\system32\w32tm.exe
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        3⤵
          PID:5688
        • C:\Users\All Users\Desktop\TextInputHost.exe
          "C:\Users\All Users\Desktop\TextInputHost.exe"
          3⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3264
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60e15f07-6b62-4fab-b473-a94bf2fbf671.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5680
            • C:\Users\All Users\Desktop\TextInputHost.exe
              "C:\Users\All Users\Desktop\TextInputHost.exe"
              5⤵
              • UAC bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:5724
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12635a9b-688f-4024-ba38-fa1fa472e902.vbs"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4864
                • C:\Users\All Users\Desktop\TextInputHost.exe
                  "C:\Users\All Users\Desktop\TextInputHost.exe"
                  7⤵
                  • UAC bypass
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:232
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25f308d6-7eb1-4010-8287-06a1fa38cd7e.vbs"
                    8⤵
                      PID:1160
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\365c6072-b3d6-416f-8901-c8318400088d.vbs"
                      8⤵
                        PID:4584
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d6b7df8-d9f5-4c32-bd22-c53574d34f0f.vbs"
                    6⤵
                      PID:1292
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bae110b3-eb0f-4644-826d-69e78183ab5c.vbs"
                  4⤵
                    PID:1800
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "6ec1c209b158ca6a09569dab997a10da6" /sc MINUTE /mo 11 /tr "'C:\34c553de294c1d56d0a800105b\6ec1c209b158ca6a09569dab997a10da.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:448
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "6ec1c209b158ca6a09569dab997a10da" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\6ec1c209b158ca6a09569dab997a10da.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:896
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "6ec1c209b158ca6a09569dab997a10da6" /sc MINUTE /mo 6 /tr "'C:\34c553de294c1d56d0a800105b\6ec1c209b158ca6a09569dab997a10da.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2040
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5128
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2428
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1068
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1976
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5124
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:408
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3216
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2316
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4424
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3752
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3720
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4980
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5456
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5868
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4104
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\fr-FR\services.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3628
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\services.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2396
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\fr-FR\services.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1632
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\TextInputHost.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3120
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\TextInputHost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1876
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Desktop\TextInputHost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5528
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2128
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5236
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2780
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\edge_BITS_4428_1323226884\sihost.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1928
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4428_1323226884\sihost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:216
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\edge_BITS_4428_1323226884\sihost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1460
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:244
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3272
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3688
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:4388
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:1428
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3312
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\wininit.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2084
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\wininit.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3328
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\wininit.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3248
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Documents\My Pictures\smss.exe'" /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:2160
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Pictures\smss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:5244
            • C:\Windows\system32\schtasks.exe
              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Documents\My Pictures\smss.exe'" /rl HIGHEST /f
              1⤵
              • Process spawned unexpected child process
              • Scheduled Task/Job: Scheduled Task
              PID:3336

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\34c553de294c1d56d0a800105b\6ec1c209b158ca6a09569dab997a10da.exe

              Filesize

              5.9MB

              MD5

              05b158c5f5613e1f3468a43a9e5c9a5c

              SHA1

              438306456acf01fa1094e6d57d5289b226d5ae69

              SHA256

              256f41ea4e57ae212cb270692c3c7162b0d3696052c0c67fa780e2ddefff230b

              SHA512

              aedcd0dbf74a8ca6988a4f7e130bf8caa3afc738dc34ad9991862a89723067e0a31315ecc9ef5e97f51263c4048653ccb8182a8b2fed70f8bddff95fbaca8094

            • C:\34c553de294c1d56d0a800105b\dllhost.exe

              Filesize

              5.9MB

              MD5

              d95f96274ccaa414f95ebe3d8fe39214

              SHA1

              0a473a830f57a367254aeae1225729f48eff1b7d

              SHA256

              0802264670d9dd1a188ff2a8006c92ab065856ee28c0ded3addb65f73da64de2

              SHA512

              5b72ac209052a6d7c101811ad23c3adb79007564695a962f05cbcee7d644a9ad6dc291638a931f9561481997280565a5f2b465d8766d3eba2edb75a91904b97b

            • C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe

              Filesize

              5.9MB

              MD5

              6ec1c209b158ca6a09569dab997a10da

              SHA1

              1edc7c6f32e6b4ebc5faf5a522ed5992fc73bedf

              SHA256

              44c8df0ee91d3ab2825961ab81fed1370c75c034ef717b2baa192c2430eb65a3

              SHA512

              821d17198941051e5bd354fe5ea3fded5e196cd41b900714f9d68bb25baecca306160c695790649d7f3a48bdacb2ec7d9eebd6a184e756501dcdc726d98fd857

            • C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe

              Filesize

              5.9MB

              MD5

              b9f348a7f966c82eb739cf755f955ef7

              SHA1

              524f25fe128e77e8b31025015e998c7e6753e658

              SHA256

              ef2a3de9c1adbcc857a97468d9b900e60a893e38be49bd620fa3de81d3f00302

              SHA512

              578a376f7f0a88456068bcae1419dd596864563fb1b2b68c370da5f0b81db7022aca82e41093b3030216e6ac808e19cc98514d07de0776d5807accbd750379e9

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TextInputHost.exe.log

              Filesize

              1KB

              MD5

              229da4b4256a6a948830de7ee5f9b298

              SHA1

              8118b8ddc115689ca9dc2fe8c244350333c5ba8b

              SHA256

              3d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11

              SHA512

              3a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              2KB

              MD5

              d85ba6ff808d9e5444a4b369f5bc2730

              SHA1

              31aa9d96590fff6981b315e0b391b575e4c0804a

              SHA256

              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

              SHA512

              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              b8c2d72f155bf26dd2ac91a9c57f0aef

              SHA1

              19a5ebf872b8c332bbd596dac8b7a36c80a19b54

              SHA256

              069d7d614ebb7c3dff8dd6d7215be9da1524637352c09171e36441967a0ca9d5

              SHA512

              8b246bedacc4063e39ac28678be372a52d1b07e2ed0db5ee1e4cf8e9d481836fa6d3e3138d1caa8e6ef692cea1ad42592e24bbef426746ad0227fdeff149caf7

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              c79cf713064165d9921621736789b679

              SHA1

              4d8b3c69ddab8dd528496de06ce7e6e6c2758389

              SHA256

              6de25d006efb9912c4460725c3ff494adc8585749971235d743dae6cb568068e

              SHA512

              22dbec206c054253a245c7eac9cbfa4d62b49a11b02adea88b6dc8e1ee4243d46e8f61efa5374d43260ff686dbd3c769b7e14bbc6d5fb2f8999f258a904a04a5

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              08bb0c2688fc08624e11a31024e29947

              SHA1

              dab0789759282767104987fa06d6acd5ed8bc616

              SHA256

              d96effa05d39e4fb1e83f96a753616c0a26559acaa8415d7087a41ca091f42c4

              SHA512

              30afdd978294eded7257fe8bb3538fd491572ad265498a8764d1a09d7255ad3b352ec3384770f50f97e180b0107eb24318d164c3751256c330a3478e4366999a

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              44ae12563d9f97ac1136baee629673df

              SHA1

              38790549497302c43bd3ff6c5225e8c7054829e2

              SHA256

              b09202e29f036511a075523ebcaecef0a43ceeb4f2c8029e5c7931a8e2e72beb

              SHA512

              07cf8ed791245485aae4ee05cd6b77eb0a36c8a839da6eae1554dc0487559c270241733ae8ed184c8d38a956452a2255169a3adeb40a0da1d9e2e487864a35e7

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              5f3d606f9a5f1201bfc1f01c54e842c4

              SHA1

              f1917e50b557b135953ecbe63e1fc1e675b541f1

              SHA256

              dcc09d3b5b17ef60cb35e4148230306cdcd68d18d18a39fd5fe220c34997a32a

              SHA512

              d85e1e1b4a552a8cdd21c4195a2ea082d3fcb40907d2a6a0ceb297f32defd1fba17d3b54dc954c26b3b731bc179bee5cfc011de3c667af47cdbe289b30fdfb38

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              944B

              MD5

              672e8b21617ca3b368c6c154913fcfff

              SHA1

              cb3dab8c008b5fba2af958ce2c416c01baa6a98b

              SHA256

              b6ce484f4dcfab37c7fac91278a1d66c8b122865f12511634b8c5eac3fc081ec

              SHA512

              98b45d5545237042c9d4e99e6aa2d514bb643c80cccd1f79ca8e6412a7949fc235f2f6a5fc12a7f772e1af2343ab2e2fb863d161f1d0da3326e636c52513c7ad

            • C:\Users\Admin\AppData\Local\Temp\12635a9b-688f-4024-ba38-fa1fa472e902.vbs

              Filesize

              720B

              MD5

              5ded796a54d9e16874f3243ebebae750

              SHA1

              8dbbdcda5da6bc0979e0646c84e602c175bd4e4c

              SHA256

              b8ec7d89b834553657b5468668ff64345e684829dd40af9639a401398e69fe9a

              SHA512

              5e16025fc228662c240d747c55cc7cc327356a7a0107d7d6a00e77e34b1a498e01237d8121f9ab49ba9c844d1905ca028bccee5b37e339bfb1ca36b5b21db24d

            • C:\Users\Admin\AppData\Local\Temp\25f308d6-7eb1-4010-8287-06a1fa38cd7e.vbs

              Filesize

              719B

              MD5

              aa369859da4e576d9c2c81c0406b769b

              SHA1

              99746f97507d9535f5ebbde6720afb9175039f72

              SHA256

              1f5fefbb4485908d46b9cb0c15c800966b0d3771ee45e249ad697d803ad47517

              SHA512

              0b294975161014c8bb6f4ac3453875dbc4c763860b78b0088707b573e76d21639c6300019f7c4578b7b9d733e4e0aed1af7e19bf952a8b3daa00cc093d66f7da

            • C:\Users\Admin\AppData\Local\Temp\60e15f07-6b62-4fab-b473-a94bf2fbf671.vbs

              Filesize

              720B

              MD5

              83c5b0f3bfceea90146e29dd67f75101

              SHA1

              68d095505f16189e56dbddbce4b66f6685306219

              SHA256

              9fc2e509ebc7f23dcdd19db14624ca0133018c0a764398d378e0bae60d9c6780

              SHA512

              55176f016b8c81c60290a0682c7fcac93fb0df9a0a9fbf6b1f10384a7267d1d062bd5a140194c73aa51f2c95dce6f4666f157e32945280ef2b056bb279cc25f6

            • C:\Users\Admin\AppData\Local\Temp\6nXiVaNJ1D.bat

              Filesize

              209B

              MD5

              6a30d790b85d8e574d2ea6f09ee95c85

              SHA1

              9e20e2879791e9130af97bf4d352bfac8b6330f2

              SHA256

              56f1001074fdc4ad94eea5df6eb16a9c7b818ae1a3191f32e081caab5b463004

              SHA512

              3a5a48ae74e52dfadde69ea4aad0a448bbb39225e8afb17a29de775df4be9d48fc13d735bf5f825e346e9b85637bb41d1b99694b0d345cf9b995ffb2a78a3595

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvw5qp20.elt.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\bae110b3-eb0f-4644-826d-69e78183ab5c.vbs

              Filesize

              496B

              MD5

              63c744a257142a94706a307de3f7f2de

              SHA1

              201610a07c9db2df61e65b01fa041a6633b51f8d

              SHA256

              e1b4d02da29499098bbdae22ab9b39088ec2b85d981b40b49e9cc0cfcf13b7fe

              SHA512

              056ba4edad9715a58a20f72bb6850d666a303b70e35c7843bc4285160c03f0b50781fc3c3644d4cc8b1a4d2efc2c83181f6f52bace3bd2fa3cb85f79c09f9478

            • memory/232-426-0x000000001C4A0000-0x000000001C4B2000-memory.dmp

              Filesize

              72KB

            • memory/508-376-0x0000026BCC800000-0x0000026BCC94E000-memory.dmp

              Filesize

              1.3MB

            • memory/764-245-0x00000229EAD20000-0x00000229EAD42000-memory.dmp

              Filesize

              136KB

            • memory/764-366-0x00000229EAE50000-0x00000229EAF9E000-memory.dmp

              Filesize

              1.3MB

            • memory/888-381-0x0000013C5D790000-0x0000013C5D8DE000-memory.dmp

              Filesize

              1.3MB

            • memory/1376-365-0x0000018B3D2E0000-0x0000018B3D42E000-memory.dmp

              Filesize

              1.3MB

            • memory/1932-386-0x000001F2FA960000-0x000001F2FAAAE000-memory.dmp

              Filesize

              1.3MB

            • memory/2476-35-0x000000001E1D0000-0x000000001E1D8000-memory.dmp

              Filesize

              32KB

            • memory/2476-31-0x000000001E200000-0x000000001E208000-memory.dmp

              Filesize

              32KB

            • memory/2476-26-0x000000001DF50000-0x000000001DF5C000-memory.dmp

              Filesize

              48KB

            • memory/2476-28-0x000000001DF70000-0x000000001DF78000-memory.dmp

              Filesize

              32KB

            • memory/2476-22-0x000000001DF10000-0x000000001DF18000-memory.dmp

              Filesize

              32KB

            • memory/2476-21-0x000000001DF00000-0x000000001DF0C000-memory.dmp

              Filesize

              48KB

            • memory/2476-19-0x000000001DEE0000-0x000000001DEEC000-memory.dmp

              Filesize

              48KB

            • memory/2476-18-0x000000001DE90000-0x000000001DEE6000-memory.dmp

              Filesize

              344KB

            • memory/2476-16-0x000000001DD20000-0x000000001DD30000-memory.dmp

              Filesize

              64KB

            • memory/2476-15-0x000000001DD10000-0x000000001DD18000-memory.dmp

              Filesize

              32KB

            • memory/2476-13-0x000000001DCF0000-0x000000001DD02000-memory.dmp

              Filesize

              72KB

            • memory/2476-12-0x000000001DCE0000-0x000000001DCE8000-memory.dmp

              Filesize

              32KB

            • memory/2476-11-0x00000000039D0000-0x00000000039E6000-memory.dmp

              Filesize

              88KB

            • memory/2476-10-0x00000000039C0000-0x00000000039D0000-memory.dmp

              Filesize

              64KB

            • memory/2476-9-0x00000000021B0000-0x00000000021B8000-memory.dmp

              Filesize

              32KB

            • memory/2476-8-0x000000001DD30000-0x000000001DD80000-memory.dmp

              Filesize

              320KB

            • memory/2476-7-0x0000000002190000-0x00000000021AC000-memory.dmp

              Filesize

              112KB

            • memory/2476-5-0x0000000002160000-0x000000000216E000-memory.dmp

              Filesize

              56KB

            • memory/2476-4-0x0000000002150000-0x000000000215E000-memory.dmp

              Filesize

              56KB

            • memory/2476-29-0x000000001DF80000-0x000000001DF8C000-memory.dmp

              Filesize

              48KB

            • memory/2476-203-0x00007FFCC9DE3000-0x00007FFCC9DE5000-memory.dmp

              Filesize

              8KB

            • memory/2476-228-0x00007FFCC9DE0000-0x00007FFCCA8A1000-memory.dmp

              Filesize

              10.8MB

            • memory/2476-235-0x00007FFCC9DE0000-0x00007FFCCA8A1000-memory.dmp

              Filesize

              10.8MB

            • memory/2476-17-0x000000001DE80000-0x000000001DE8A000-memory.dmp

              Filesize

              40KB

            • memory/2476-32-0x000000001E1A0000-0x000000001E1AC000-memory.dmp

              Filesize

              48KB

            • memory/2476-33-0x000000001E1B0000-0x000000001E1BA000-memory.dmp

              Filesize

              40KB

            • memory/2476-34-0x000000001E1C0000-0x000000001E1CE000-memory.dmp

              Filesize

              56KB

            • memory/2476-1-0x0000000000F70000-0x0000000001868000-memory.dmp

              Filesize

              9.0MB

            • memory/2476-27-0x000000001DF60000-0x000000001DF6C000-memory.dmp

              Filesize

              48KB

            • memory/2476-0-0x00007FFCC9DE3000-0x00007FFCC9DE5000-memory.dmp

              Filesize

              8KB

            • memory/2476-20-0x000000001DEF0000-0x000000001DEF8000-memory.dmp

              Filesize

              32KB

            • memory/2476-36-0x000000001E1E0000-0x000000001E1EE000-memory.dmp

              Filesize

              56KB

            • memory/2476-2-0x0000000002110000-0x0000000002111000-memory.dmp

              Filesize

              4KB

            • memory/2476-37-0x000000001E1F0000-0x000000001E1F8000-memory.dmp

              Filesize

              32KB

            • memory/2476-38-0x000000001E210000-0x000000001E21C000-memory.dmp

              Filesize

              48KB

            • memory/2476-39-0x000000001E220000-0x000000001E228000-memory.dmp

              Filesize

              32KB

            • memory/2476-41-0x000000001E230000-0x000000001E23C000-memory.dmp

              Filesize

              48KB

            • memory/2476-40-0x000000001E330000-0x000000001E33A000-memory.dmp

              Filesize

              40KB

            • memory/2476-30-0x000000001DF90000-0x000000001DF9C000-memory.dmp

              Filesize

              48KB

            • memory/2476-3-0x00007FFCC9DE0000-0x00007FFCCA8A1000-memory.dmp

              Filesize

              10.8MB

            • memory/2476-6-0x0000000002170000-0x0000000002178000-memory.dmp

              Filesize

              32KB

            • memory/2476-25-0x000000001E480000-0x000000001E9A8000-memory.dmp

              Filesize

              5.2MB

            • memory/2476-14-0x000000001DD00000-0x000000001DD0C000-memory.dmp

              Filesize

              48KB

            • memory/2476-24-0x000000001DF20000-0x000000001DF32000-memory.dmp

              Filesize

              72KB

            • memory/2552-391-0x000002101C810000-0x000002101C95E000-memory.dmp

              Filesize

              1.3MB

            • memory/3264-399-0x000000001BF10000-0x000000001BF22000-memory.dmp

              Filesize

              72KB

            • memory/3816-373-0x000001D79DA00000-0x000001D79DB4E000-memory.dmp

              Filesize

              1.3MB

            • memory/5056-394-0x000001366A390000-0x000001366A4DE000-memory.dmp

              Filesize

              1.3MB

            • memory/5324-364-0x000001E652390000-0x000001E6524DE000-memory.dmp

              Filesize

              1.3MB

            • memory/5364-374-0x000001EF4F5A0000-0x000001EF4F6EE000-memory.dmp

              Filesize

              1.3MB

            • memory/5516-375-0x0000025EF25B0000-0x0000025EF26FE000-memory.dmp

              Filesize

              1.3MB

            • memory/5724-413-0x00000000031A0000-0x00000000031B2000-memory.dmp

              Filesize

              72KB

            • memory/5776-388-0x00000160F3700000-0x00000160F384E000-memory.dmp

              Filesize

              1.3MB

            • memory/5836-387-0x0000021EB5760000-0x0000021EB58AE000-memory.dmp

              Filesize

              1.3MB