dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
59s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Size

2.5MB
MD5

3dbf7d9fdfd5a0151f1003095ba9655c
SHA1

4f5de06a720298a5e32660fd0f56733ad611060f
SHA256

86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26
SHA512

3405c202bad0e95f18341f8c664f94626bec55db6ef9c15ff9a5b6cb2632e73375fec802d64e5ca3b924829ec1729c06f01fcb9a5013ac22d5b5b437812eb2ef
SSDEEP

49152:qGVFTkAxSKOfsx79ZnGGHMgVj2x+0XrSqWsn+fz+pV6ZKvTYnp:qGVyWNGGN2sqWs+fz+pVZTYp

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat 9 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		4584	schtasks.exe
		4244	schtasks.exe
		5268	schtasks.exe
		4304	schtasks.exe
		4816	schtasks.exe
		1724	schtasks.exe
		3792	schtasks.exe
File created	C:\Windows\System32\cfgmgr32\9e8d7a4ca61bd9		86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\cfgmgr32\RuntimeBroker.exe		86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Dcrat family
dcrat

Process spawned unexpected child process 7 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5268	1100	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	1100	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	1100	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1100	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	1100	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	1100	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	1100	schtasks.exe	86

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3208	powershell.exe
4028	powershell.exe
1240	powershell.exe
396	powershell.exe
848	powershell.exe
1524	powershell.exe
4048	powershell.exe
1008	powershell.exe
2852	powershell.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 7 IoCs

pid	Process
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
984	explorer.exe
4924	explorer.exe
556	explorer.exe
3676	explorer.exe
5484	explorer.exe
852	explorer.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\WMVCORE\\taskhostw.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\ProgramData\\Desktop\\sysmon.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RINTL.sv-se\\OfficeClickToRun.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\\AppxBlockMap\\StartMenuExperienceHost.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\ProgramData\\Microsoft OneDrive\\setup\\explorer.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\cfgmgr32\\RuntimeBroker.exe\""	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WMVCORE\RCX6631.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\WMVCORE\taskhostw.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\cfgmgr32\9e8d7a4ca61bd9	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\cfgmgr32\RCX63FD.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\WMVCORE\RCX6620.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\cfgmgr32\RuntimeBroker.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\cfgmgr32\RuntimeBroker.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\WMVCORE\taskhostw.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\System32\WMVCORE\ea9f0e6c9e2dcd	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\System32\cfgmgr32\RCX63FC.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se\OfficeClickToRun.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se\OfficeClickToRun.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se\e6c9b481da804f	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se\RCX6AA9.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se\RCX6AAA.tmp	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\StartMenuExperienceHost.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\StartMenuExperienceHost.exe	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\55b276f4edf653	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\Local Settings	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5268	schtasks.exe
4304	schtasks.exe
4816	schtasks.exe
1724	schtasks.exe
3792	schtasks.exe
4584	schtasks.exe
4244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1524	powershell.exe
1524	powershell.exe
1524	powershell.exe
1240	powershell.exe
1240	powershell.exe
3208	powershell.exe
3208	powershell.exe
396	powershell.exe
396	powershell.exe
4028	powershell.exe
4028	powershell.exe
1240	powershell.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
3208	powershell.exe
2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
396	powershell.exe
4028	powershell.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
848	powershell.exe
848	powershell.exe
4048	powershell.exe
4048	powershell.exe
2852	powershell.exe
2852	powershell.exe
1008	powershell.exe
1008	powershell.exe
848	powershell.exe
4048	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeDebugPrivilege	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	984	explorer.exe
Token: SeDebugPrivilege	4924	explorer.exe
Token: SeDebugPrivilege	556	explorer.exe
Token: SeDebugPrivilege	3676	explorer.exe
Token: SeDebugPrivilege	5484	explorer.exe
Token: SeDebugPrivilege	852	explorer.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 396	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	98
PID 2932 wrote to memory of 396	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	98
PID 2932 wrote to memory of 1240	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	99
PID 2932 wrote to memory of 1240	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	99
PID 2932 wrote to memory of 4028	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	100
PID 2932 wrote to memory of 4028	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	100
PID 2932 wrote to memory of 3208	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	101
PID 2932 wrote to memory of 3208	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	101
PID 2932 wrote to memory of 1524	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	103
PID 2932 wrote to memory of 1524	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	103
PID 2932 wrote to memory of 1876	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	108
PID 2932 wrote to memory of 1876	2932	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	108
PID 1876 wrote to memory of 848	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	113
PID 1876 wrote to memory of 848	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	113
PID 1876 wrote to memory of 2852	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	114
PID 1876 wrote to memory of 2852	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	114
PID 1876 wrote to memory of 1008	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	115
PID 1876 wrote to memory of 1008	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	115
PID 1876 wrote to memory of 4048	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	116
PID 1876 wrote to memory of 4048	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	116
PID 1876 wrote to memory of 4680	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	121
PID 1876 wrote to memory of 4680	1876	86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe	121
PID 4680 wrote to memory of 3408	4680	cmd.exe	123
PID 4680 wrote to memory of 3408	4680	cmd.exe	123
PID 4680 wrote to memory of 984	4680	cmd.exe	126
PID 4680 wrote to memory of 984	4680	cmd.exe	126
PID 984 wrote to memory of 5000	984	explorer.exe	127
PID 984 wrote to memory of 5000	984	explorer.exe	127
PID 984 wrote to memory of 2656	984	explorer.exe	128
PID 984 wrote to memory of 2656	984	explorer.exe	128
PID 5000 wrote to memory of 4924	5000	WScript.exe	129
PID 5000 wrote to memory of 4924	5000	WScript.exe	129
PID 4924 wrote to memory of 3220	4924	explorer.exe	130
PID 4924 wrote to memory of 3220	4924	explorer.exe	130
PID 4924 wrote to memory of 3528	4924	explorer.exe	131
PID 4924 wrote to memory of 3528	4924	explorer.exe	131
PID 3220 wrote to memory of 556	3220	WScript.exe	133
PID 3220 wrote to memory of 556	3220	WScript.exe	133
PID 556 wrote to memory of 5952	556	explorer.exe	134
PID 556 wrote to memory of 5952	556	explorer.exe	134
PID 556 wrote to memory of 1900	556	explorer.exe	135
PID 556 wrote to memory of 1900	556	explorer.exe	135
PID 5952 wrote to memory of 3676	5952	WScript.exe	138
PID 5952 wrote to memory of 3676	5952	WScript.exe	138
PID 3676 wrote to memory of 4244	3676	explorer.exe	139
PID 3676 wrote to memory of 4244	3676	explorer.exe	139
PID 3676 wrote to memory of 5040	3676	explorer.exe	140
PID 3676 wrote to memory of 5040	3676	explorer.exe	140
PID 4244 wrote to memory of 5484	4244	WScript.exe	141
PID 4244 wrote to memory of 5484	4244	WScript.exe	141
PID 5484 wrote to memory of 1904	5484	explorer.exe	142
PID 5484 wrote to memory of 1904	5484	explorer.exe	142
PID 5484 wrote to memory of 208	5484	explorer.exe	143
PID 5484 wrote to memory of 208	5484	explorer.exe	143
PID 1904 wrote to memory of 852	1904	WScript.exe	144
PID 1904 wrote to memory of 852	1904	WScript.exe	144
PID 852 wrote to memory of 4828	852	explorer.exe	145
PID 852 wrote to memory of 4828	852	explorer.exe	145
PID 852 wrote to memory of 1008	852	explorer.exe	146
PID 852 wrote to memory of 1008	852	explorer.exe	146

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
"C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe"
1⤵
- DcRat
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\cfgmgr32\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\WMVCORE\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Desktop\sysmon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se\OfficeClickToRun.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe
  "C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\StartMenuExperienceHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft OneDrive\setup\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HDzl9c9dpm.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:3408
  - - C:\ProgramData\Microsoft OneDrive\setup\explorer.exe
      "C:\ProgramData\Microsoft OneDrive\setup\explorer.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c64dcfae-1a10-459e-833b-603176b215ac.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5000
      - C:\ProgramData\Microsoft OneDrive\setup\explorer.exe
        
        "C:\ProgramData\Microsoft OneDrive\setup\explorer.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44571005-74ef-4880-8ee6-d110cd3d3141.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\ProgramData\Microsoft OneDrive\setup\explorer.exe
        
        "C:\ProgramData\Microsoft OneDrive\setup\explorer.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e39ddbba-7938-4705-9ae8-9ba0467176db.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5952
        
        C:\ProgramData\Microsoft OneDrive\setup\explorer.exe
        
        "C:\ProgramData\Microsoft OneDrive\setup\explorer.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83496033-f042-41e7-85d8-2d1658c8783d.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\ProgramData\Microsoft OneDrive\setup\explorer.exe
        
        "C:\ProgramData\Microsoft OneDrive\setup\explorer.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f926fbaa-1319-4317-bb92-ab080ba8299e.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\ProgramData\Microsoft OneDrive\setup\explorer.exe
        
        "C:\ProgramData\Microsoft OneDrive\setup\explorer.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c97c781d-c844-450c-8aea-e10e5fccec66.vbs"
        15⤵
        
        PID:4828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1263b19-6825-43a3-9aee-80bf71a19911.vbs"
        15⤵
        
        PID:1008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d389fd3e-171d-4f16-a36b-04448f0b7681.vbs"
        13⤵
        
        PID:208
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4377c793-66b9-4df3-949a-2382f9a4d502.vbs"
        11⤵
        
        PID:5040
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00be4c1b-18d5-49eb-b359-3db8b68f4ff8.vbs"
        9⤵
        
        PID:1900
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72529045-3d49-4f16-b072-cc8d08a9165d.vbs"
        7⤵
        
        PID:3528
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf932ad0-f910-4b5f-ad49-010ee2a43f3a.vbs"
        5⤵
        
        PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\cfgmgr32\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\WMVCORE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\ProgramData\Desktop\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppxBlockMap\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26.exe.log

Filesize
1KB

MD5
bbb951a34b516b66451218a3ec3b0ae1

SHA1
7393835a2476ae655916e0a9687eeaba3ee876e9

SHA256
eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

SHA512
63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
1KB

MD5
9699cf9bb24ebbc9b1035710e92b7bd2

SHA1
73f0f26db57ea306970a76f42c647bbce02a3f23

SHA256
fd35f3609663bec79a5254866d1c47342fbde3f94808acff8c3eaa19b24f67e5

SHA512
3a433f40f25b5a5c09f8de45ebd0b5485b3b54eb0c1c08a1dbae776629710b8d8f5fee21329d146867e49b5d35108bba6eff3995fb7c6246dbe6fe475eadf0bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
a43e653ffb5ab07940f4bdd9cc8fade4

SHA1
af43d04e3427f111b22dc891c5c7ee8a10ac4123

SHA256
c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe

SHA512
62a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
555e68af1b8e33f84346bf2335e6191a

SHA1
fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e

SHA256
91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae

SHA512
6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d670b8afc1f95fa27664d1d5e1aedbd9

SHA1
812b6782aaaae476d0fc15084109ab1b353db9b1

SHA256
f51a65f1321a8bf64493baf04ab9d3c3eaa2643f007947cca51c8be012765cf4

SHA512
8d05512ae3a77e4c4caf8cc4e19e22e0a4a646bffd3cec3518e45bdb7aeb9feac44837b12e03a60046f5558e91729aa646b2c8ac8192d9e6e98feecdbe6eaa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
737aca23f199ce589dd1e68bc4969b98

SHA1
8c9cdd6bdf94c5fa42c5b0c29abf0136e4e6fa00

SHA256
6aa59e171898b3dd42a36662ef81d349ce5063a705f1261e881269c59e7c742b

SHA512
ccc0e6fa798aeb92e6e1a14d6ef3dc23e8e829d5ffd10f11129d0e590820711e29997a761dca77b8e790b06e3c7c0d2059137f40f92543eb8048529b1b4d7817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
164a45e66dbe5b4c1fad9ced25394a84

SHA1
5f90cf92b891734679ddb12be560b2ec4c6282d7

SHA256
e8f1393a9e1a21ef9c18231e6d1301624694e6036ec8ddf1234219eb96222a28

SHA512
d05e8eebd235ed67a9a4c8f13004cf576df60ae068b81cd11a9d3de69cde110bf3983005a55adac948c5e8f5843b44c865b56dad4d8a37de3d2e442c4ef2eb55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0aa63dbb46d451e47a7a682c64af776d

SHA1
3b0026f2dae8e9c491ccaa40133755779de35aaa

SHA256
9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b

SHA512
4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9bc110200117a3752313ca2acaf8a9e1

SHA1
fda6b7da2e7b0175b391475ca78d1b4cf2147cd3

SHA256
c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb

SHA512
1f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\44571005-74ef-4880-8ee6-d110cd3d3141.vbs

Filesize
728B

MD5
3c26526954d7ac7f653995354e66ceb1

SHA1
ebab07e22f6d09b6f2c1ca7c98f76b471af46215

SHA256
8f2865b6a9e67e1d4e1624284e9e77f2725055a563d0a235d700d3d6f5e42b94

SHA512
7649993fb4cc1c06bba01f80490108a5575e53231b2392236df9bd6237d896fcdb91b9660ae2b0a77706bcdcda56289aaf609736221da479ce57aad1feb5b08f

Download Submit
C:\Users\Admin\AppData\Local\Temp\83496033-f042-41e7-85d8-2d1658c8783d.vbs

Filesize
728B

MD5
741750a6ae5b5cb2142ad0641bf79b8d

SHA1
9e40cec6adf99948c8245001f75a6c8e40f64597

SHA256
cf684a68b31f14da47f26efd951ef3ffca29322dbc82b0acb4c8ad32a8658add

SHA512
8e9afe9dc04899583c0055c18f0bea1b67dffb9fc06dd9a03336361a8e4ec5dd02025920f0f8fd090a63962389a22d81bb5586d0047e164a1b351278b4bf53f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\HDzl9c9dpm.bat

Filesize
216B

MD5
5ea9112004dd877db0614e1614a6eccf

SHA1
954732c125edcf5d5113cc62d69d3ef10f455dd0

SHA256
fcbc5879c882212432a0e1e7f6e28489ca5900dc705b934927a86f270809d681

SHA512
c70e15670f6b507b08b4a157a431d809ae580afb3fae404e3ba73f9cbf5b958319904d00b694039ef66ed77cc037a915efe995e85c20ae261821be03009f1de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX61F7.tmp

Filesize
2.5MB

MD5
3dbf7d9fdfd5a0151f1003095ba9655c

SHA1
4f5de06a720298a5e32660fd0f56733ad611060f

SHA256
86ca2f06f1e43f97c616f5789068661219c9f549b8a3ad2ad0a481eac0bdea26

SHA512
3405c202bad0e95f18341f8c664f94626bec55db6ef9c15ff9a5b6cb2632e73375fec802d64e5ca3b924829ec1729c06f01fcb9a5013ac22d5b5b437812eb2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbk5egxk.uxh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c64dcfae-1a10-459e-833b-603176b215ac.vbs

Filesize
727B

MD5
8e0dc25f26b6ab5c9316b2863024b5f9

SHA1
4997e4198f730d99e225cd928afa9ebb983f1eba

SHA256
eb492979233c2d0bacd94316a868a29096fa983eda9f2ea6691f576109fcd0b1

SHA512
6f709196c7f4403b06f4caa99c30f5e8ccf8d3c5e0d8934ce5551d62044d37bd5aa5c6680b1408f904c60639e5f4bd471657bb590fc8c3529fb606d457f657f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\c97c781d-c844-450c-8aea-e10e5fccec66.vbs

Filesize
727B

MD5
12ea2c9274275886e93c31333df11472

SHA1
4d42d34af6e76ae3cf85db4503eda5301c91dc96

SHA256
5391719439f7c903ce708e5826f6be1281301352d51912ab1d99f8d5ffeb7b34

SHA512
14f245b359f9bb763f853caf63f75af9acaae980973e3a7b954a119ef042f6d25bb005c141a890889e98ad8b0776ce0941caf64913031e3bbadbc8cb1f6e5812

Download Submit
C:\Users\Admin\AppData\Local\Temp\cf932ad0-f910-4b5f-ad49-010ee2a43f3a.vbs

Filesize
504B

MD5
9fe9755254bd78839d37062a9d786b52

SHA1
b14507586164c4985c339ba91dd222cccb6b8c2c

SHA256
cf1e72b9610c19eb9c49991be5631f9dec9b1bcfa20d3745a7bd6bd201bff8f6

SHA512
1939c1bae74d8c1f49427f3e6dc0f10e8fe4f0308e8e0d148781dc115925c50686e4cebbecf916ccf87b015125cc995eecb8f43b4d950847f7248094735325d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\e39ddbba-7938-4705-9ae8-9ba0467176db.vbs

Filesize
727B

MD5
54529286d62f21630c735ab05abb7470

SHA1
c4ea09eec70b4be1360d7d6c902f36be3baec559

SHA256
dd4527aa28662fd332dfe5d599fcd7643bc6a5a4522727299266ce9dc3809dfa

SHA512
71b20f7fd49c1e05cd6cdf1b06f93e2207c46a50f8091b9c5703b1ef54817078e02c0cc1cb8b90d8501e05115e5e13766b55c22ea69d35de4ea0e548cd2516c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\f926fbaa-1319-4317-bb92-ab080ba8299e.vbs

Filesize
728B

MD5
921561bab4670426efddddbd3612fb98

SHA1
e3de5773ac15963a0b0f7c05c9a66183f065919f

SHA256
40157e537e14f51d64827fd3c7881d5158d8f1fb8424e8ccbe1e05d7241699b8

SHA512
d529c97a997d7efef7b2014bc721544915566760677ed39843371f825ad5a3e2697fdb3ad21f563b0bef47470e16a43b145e03a63a1b11bc4f621dfcf906eedc

Download Submit
C:\Users\Public\Desktop\sysmon.exe

Filesize
2.5MB

MD5
18846d0b57fd4ee88e70cf94b0ce6837

SHA1
681492c73525b5cfce02b88adbc5de26e071a033

SHA256
acb46526e3b94c7abedd436a20abdc6edd3568746d3ff4bf1fae3ab91ac3707b

SHA512
6920ccd0586e23ad9c1a9646896f6b5a4fc880889690717bf137e012e654896e92dd4024d71b915c2e7f2066f1f1f28babb89dee6454745fc5ba655c87d5ab1f

Download Submit
memory/984-206-0x000000001AE90000-0x000000001AEA2000-memory.dmp

Filesize
72KB

Download
memory/1524-89-0x000002E6F8520000-0x000002E6F8542000-memory.dmp

Filesize
136KB

Download
memory/1876-141-0x000000001B350000-0x000000001B3A6000-memory.dmp

Filesize
344KB

Download
memory/2932-18-0x000000001B990000-0x000000001B99A000-memory.dmp

Filesize
40KB

Download
memory/2932-17-0x000000001B880000-0x000000001B888000-memory.dmp

Filesize
32KB

Download
memory/2932-15-0x000000001B870000-0x000000001B87A000-memory.dmp

Filesize
40KB

Download
memory/2932-16-0x000000001B860000-0x000000001B86C000-memory.dmp

Filesize
48KB

Download
memory/2932-136-0x00007FF90DE10000-0x00007FF90E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/2932-12-0x000000001B730000-0x000000001B73A000-memory.dmp

Filesize
40KB

Download
memory/2932-14-0x000000001B750000-0x000000001B75C000-memory.dmp

Filesize
48KB

Download
memory/2932-0-0x00007FF90DE13000-0x00007FF90DE15000-memory.dmp

Filesize
8KB

Download
memory/2932-13-0x000000001B740000-0x000000001B74A000-memory.dmp

Filesize
40KB

Download
memory/2932-11-0x000000001C0B0000-0x000000001C5D8000-memory.dmp

Filesize
5.2MB

Download
memory/2932-9-0x000000001B6F0000-0x000000001B6F8000-memory.dmp

Filesize
32KB

Download
memory/2932-10-0x000000001B700000-0x000000001B712000-memory.dmp

Filesize
72KB

Download
memory/2932-7-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/2932-8-0x0000000002530000-0x0000000002586000-memory.dmp

Filesize
344KB

Download
memory/2932-5-0x0000000002580000-0x00000000025D0000-memory.dmp

Filesize
320KB

Download
memory/2932-6-0x0000000002500000-0x0000000002510000-memory.dmp

Filesize
64KB

Download
memory/2932-4-0x00000000024E0000-0x00000000024FC000-memory.dmp

Filesize
112KB

Download
memory/2932-3-0x0000000000AF0000-0x0000000000AFC000-memory.dmp

Filesize
48KB

Download
memory/2932-2-0x00007FF90DE10000-0x00007FF90E8D1000-memory.dmp

Filesize
10.8MB

Download
memory/2932-1-0x00000000000C0000-0x0000000000346000-memory.dmp

Filesize
2.5MB

Download