dcrat | 3c5d4007aabc7835b586d15313645af2e823dfad1d487cad46453dc3474e2693

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
86c8fa2e136e29f51a3670f440b9f0a0.exe
Size 2.5MB
Sample250322-zaqppszvbx
SHA256 da49bed9676a8352a71fdd38dc855a01ca72f5dd393a91e9d7ad71ef9a4f11eb
MD5 86c8fa2e136e29f51a3670f440b9f0a0
SHA1 103d45983c01fc861cb7390afe5db10ff2892fc0
SHA512 7c5f74c7a041c38216dc4a7f1d60d1a622227b8cd5aea5c1c4d200a5ccfabd7cbd2a17b22ca2ff028fc45dd0373df8cf9a5998cbefe7873fa7f9eda7ad117ddb
SSDEEP 49152:BjLLQdzMIwA7G5ALF/CT2vyYSjEf+QSs5saA2R97oF/cZ8ekY4E7Jy:B2l7G5Auotf+Lg4ElM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6092	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4816	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	4612	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4612	schtasks.exe	86

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2276	powershell.exe
5876	powershell.exe
4376	powershell.exe
5500	powershell.exe
900	powershell.exe
6076	powershell.exe
5644	powershell.exe
1632	powershell.exe
3436	powershell.exe
3920	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	86c8fa2e136e29f51a3670f440b9f0a0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	spoolsv.exe

Executes dropped EXE 16 IoCs

pid	Process
5776	spoolsv.exe
2720	spoolsv.exe
2884	spoolsv.exe
5388	spoolsv.exe
3996	spoolsv.exe
2912	spoolsv.exe
5836	spoolsv.exe
1936	spoolsv.exe
1128	spoolsv.exe
3132	spoolsv.exe
3984	spoolsv.exe
1048	spoolsv.exe
3968	spoolsv.exe
4548	spoolsv.exe
1936	spoolsv.exe
4380	spoolsv.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\DtcInstall\\explorer.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\Windows.Networking.Connectivity\\spoolsv.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\ProgramData\\Microsoft\\Vault\\smss.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\ProgramData\\SoftwareDistribution\\spoolsv.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files\\Microsoft Office\\PackageManifests\\upfc.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Templates\\csrss.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\mftranscode\\dllhost.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\34c553de294c1d56d0a800105b\\Registry.exe\""	86c8fa2e136e29f51a3670f440b9f0a0.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\Windows.Networking.Connectivity\f3b6ecef712a24	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\mftranscode\dllhost.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\Windows.Networking.Connectivity\RCXEBB3.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\mftranscode\RCXEFCD.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\mftranscode\RCXEFCE.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\mftranscode\dllhost.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\System32\mftranscode\5940a34987c991	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\Windows.Networking.Connectivity\RCXEB35.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\PackageManifests\upfc.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\ea1d8f6d871115	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RCXF530.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\RCXF531.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\upfc.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall\RCXE921.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\DtcInstall\explorer.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\DtcInstall\explorer.exe	86c8fa2e136e29f51a3670f440b9f0a0.exe
File created	C:\Windows\DtcInstall\7a0fd90576e088	86c8fa2e136e29f51a3670f440b9f0a0.exe
File opened for modification	C:\Windows\DtcInstall\RCXE910.tmp	86c8fa2e136e29f51a3670f440b9f0a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	86c8fa2e136e29f51a3670f440b9f0a0.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	spoolsv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4656	schtasks.exe
4816	schtasks.exe
4832	schtasks.exe
4780	schtasks.exe
4564	schtasks.exe
6092	schtasks.exe
4712	schtasks.exe
4720	schtasks.exe
4600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
5500	powershell.exe
5500	powershell.exe
900	powershell.exe
900	powershell.exe
6076	powershell.exe
6076	powershell.exe
5876	powershell.exe
5876	powershell.exe
2276	powershell.exe
2276	powershell.exe
3920	powershell.exe
3920	powershell.exe
4376	powershell.exe
4376	powershell.exe
3436	powershell.exe
3436	powershell.exe
4376	powershell.exe
5644	powershell.exe
5644	powershell.exe
1632	powershell.exe
1632	powershell.exe
3436	powershell.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
5500	powershell.exe
900	powershell.exe
6076	powershell.exe
5876	powershell.exe
6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
3920	powershell.exe
2276	powershell.exe
5644	powershell.exe
1632	powershell.exe
5776	spoolsv.exe
5776	spoolsv.exe
5776	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe
Token: SeDebugPrivilege	5500	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	6076	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	3920	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	5644	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	5776	spoolsv.exe
Token: SeDebugPrivilege	2720	spoolsv.exe
Token: SeDebugPrivilege	2884	spoolsv.exe
Token: SeDebugPrivilege	5388	spoolsv.exe
Token: SeDebugPrivilege	3996	spoolsv.exe
Token: SeDebugPrivilege	2912	spoolsv.exe
Token: SeDebugPrivilege	5836	spoolsv.exe
Token: SeDebugPrivilege	1936	spoolsv.exe
Token: SeDebugPrivilege	1128	spoolsv.exe
Token: SeDebugPrivilege	3132	spoolsv.exe
Token: SeDebugPrivilege	3984	spoolsv.exe
Token: SeDebugPrivilege	1048	spoolsv.exe
Token: SeDebugPrivilege	3968	spoolsv.exe
Token: SeDebugPrivilege	4548	spoolsv.exe
Token: SeDebugPrivilege	1936	spoolsv.exe
Token: SeDebugPrivilege	4380	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 3920	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	103
PID 6064 wrote to memory of 3920	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	103
PID 6064 wrote to memory of 3436	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	104
PID 6064 wrote to memory of 3436	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	104
PID 6064 wrote to memory of 6076	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	105
PID 6064 wrote to memory of 6076	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	105
PID 6064 wrote to memory of 1632	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	106
PID 6064 wrote to memory of 1632	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	106
PID 6064 wrote to memory of 900	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	108
PID 6064 wrote to memory of 900	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	108
PID 6064 wrote to memory of 5500	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	109
PID 6064 wrote to memory of 5500	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	109
PID 6064 wrote to memory of 4376	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	110
PID 6064 wrote to memory of 4376	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	110
PID 6064 wrote to memory of 5876	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	111
PID 6064 wrote to memory of 5876	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	111
PID 6064 wrote to memory of 2276	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	113
PID 6064 wrote to memory of 2276	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	113
PID 6064 wrote to memory of 5644	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	114
PID 6064 wrote to memory of 5644	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	114
PID 6064 wrote to memory of 5776	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	123
PID 6064 wrote to memory of 5776	6064	86c8fa2e136e29f51a3670f440b9f0a0.exe	123
PID 5776 wrote to memory of 5720	5776	spoolsv.exe	124
PID 5776 wrote to memory of 5720	5776	spoolsv.exe	124
PID 5776 wrote to memory of 3104	5776	spoolsv.exe	125
PID 5776 wrote to memory of 3104	5776	spoolsv.exe	125
PID 5720 wrote to memory of 2720	5720	WScript.exe	131
PID 5720 wrote to memory of 2720	5720	WScript.exe	131
PID 2720 wrote to memory of 5696	2720	spoolsv.exe	132
PID 2720 wrote to memory of 5696	2720	spoolsv.exe	132
PID 2720 wrote to memory of 3256	2720	spoolsv.exe	133
PID 2720 wrote to memory of 3256	2720	spoolsv.exe	133
PID 5696 wrote to memory of 2884	5696	WScript.exe	135
PID 5696 wrote to memory of 2884	5696	WScript.exe	135
PID 2884 wrote to memory of 2412	2884	spoolsv.exe	136
PID 2884 wrote to memory of 2412	2884	spoolsv.exe	136
PID 2884 wrote to memory of 1440	2884	spoolsv.exe	137
PID 2884 wrote to memory of 1440	2884	spoolsv.exe	137
PID 2412 wrote to memory of 5388	2412	WScript.exe	146
PID 2412 wrote to memory of 5388	2412	WScript.exe	146
PID 5388 wrote to memory of 5692	5388	spoolsv.exe	147
PID 5388 wrote to memory of 5692	5388	spoolsv.exe	147
PID 5388 wrote to memory of 4804	5388	spoolsv.exe	148
PID 5388 wrote to memory of 4804	5388	spoolsv.exe	148
PID 5692 wrote to memory of 3996	5692	WScript.exe	153
PID 5692 wrote to memory of 3996	5692	WScript.exe	153
PID 3996 wrote to memory of 5440	3996	spoolsv.exe	154
PID 3996 wrote to memory of 5440	3996	spoolsv.exe	154
PID 3996 wrote to memory of 1652	3996	spoolsv.exe	155
PID 3996 wrote to memory of 1652	3996	spoolsv.exe	155
PID 5440 wrote to memory of 2912	5440	WScript.exe	157
PID 5440 wrote to memory of 2912	5440	WScript.exe	157
PID 2912 wrote to memory of 1976	2912	spoolsv.exe	158
PID 2912 wrote to memory of 1976	2912	spoolsv.exe	158
PID 2912 wrote to memory of 2972	2912	spoolsv.exe	159
PID 2912 wrote to memory of 2972	2912	spoolsv.exe	159
PID 1976 wrote to memory of 5836	1976	WScript.exe	161
PID 1976 wrote to memory of 5836	1976	WScript.exe	161
PID 5836 wrote to memory of 4168	5836	spoolsv.exe	162
PID 5836 wrote to memory of 4168	5836	spoolsv.exe	162
PID 5836 wrote to memory of 3008	5836	spoolsv.exe	163
PID 5836 wrote to memory of 3008	5836	spoolsv.exe	163
PID 4168 wrote to memory of 1936	4168	WScript.exe	165
PID 4168 wrote to memory of 1936	4168	WScript.exe	165

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\86c8fa2e136e29f51a3670f440b9f0a0.exe
"C:\Users\Admin\AppData\Local\Temp\86c8fa2e136e29f51a3670f440b9f0a0.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\86c8fa2e136e29f51a3670f440b9f0a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\34c553de294c1d56d0a800105b\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DtcInstall\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Vault\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\mftranscode\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\SoftwareDistribution\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\PackageManifests\upfc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
  "C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0048b7a3-16db-47df-bd5b-87e182607c19.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
      C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99cf60aa-c2c6-441a-beef-cb2f84bb6a2f.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5696
      - C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\434fdcb0-a593-4e54-85cb-f36df39a458c.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5388
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\597aedfc-7fd0-4b77-ba00-4d1400026b33.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5692
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\955e9e4f-9d5d-4450-a928-3ba5ce76275c.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:5440
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd41c695-310b-479a-8927-db5d79e2c768.vbs"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5836
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcaf80a1-acb4-4daa-96de-2036533619d7.vbs"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4168
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42f86e1f-fc13-4f80-9c2b-eae53d0f3a20.vbs"
        17⤵
        
        PID:4196
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\056600b3-ae6c-48bd-ba08-0ab229305309.vbs"
        19⤵
        
        PID:2668
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc4800b9-5633-48af-8592-32b9bd58fdcd.vbs"
        21⤵
        
        PID:2152
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af975291-7574-4dae-b821-469eda2cf51e.vbs"
        23⤵
        
        PID:6044
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1048
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\545f047d-07c7-4e7c-8d9a-23f5d4c21437.vbs"
        25⤵
        
        PID:1428
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2224fe0-92f8-410f-8dd3-f793b9d6b81b.vbs"
        27⤵
        
        PID:2392
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4548
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acf39230-753f-40fd-9fee-447236b26f14.vbs"
        29⤵
        
        PID:3972
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d4b3736-4978-4ec6-b9b6-367b65baecb4.vbs"
        31⤵
        
        PID:4784
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        
        C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e88ca48f-cb27-485d-be8c-ecda6d494f59.vbs"
        33⤵
        
        PID:4652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2aa1256e-8645-4b2a-a5c5-81ab462b20f0.vbs"
        33⤵
        
        PID:2916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb8f9f7a-cae5-4ec6-8fcb-297e2a0c8550.vbs"
        31⤵
        
        PID:3620
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\94e9d9f6-07cb-4fd7-add5-b149a8e3bbcb.vbs"
        29⤵
        
        PID:2088
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\795deab2-a177-4793-b402-b4cc32adc9d3.vbs"
        27⤵
        
        PID:1952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca0c0205-efad-49a8-aa81-b1bcfb7c768e.vbs"
        25⤵
        
        PID:2136
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c8809d08-685d-4cd4-86cf-0d16e169e03d.vbs"
        23⤵
        
        PID:3716
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08e11ba1-1867-44df-9e69-d3e25b11e957.vbs"
        21⤵
        
        PID:3396
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1cb0dbf-4285-4f75-9bdc-b947c4fc9b43.vbs"
        19⤵
        
        PID:5788
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72c78188-9fa0-4276-bbd7-c50ed1e02d5a.vbs"
        17⤵
        
        PID:3584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\439a7e43-3e0f-4021-bc9f-0a0ca24e9fe1.vbs"
        15⤵
        
        PID:3008
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af5c97ed-abf7-4cd9-bf58-cd422c458032.vbs"
        13⤵
        
        PID:2972
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0783fe17-2d92-4f4b-a614-393d9f05b7c7.vbs"
        11⤵
        
        PID:1652
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da16e3d5-d11f-481b-b908-67c753458820.vbs"
        9⤵
        
        PID:4804
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cff4b707-26d2-4c07-9ff4-3b9902f8ab04.vbs"
        7⤵
        
        PID:1440
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98a8d423-9360-479f-9a8b-66ac53cf7dc2.vbs"
        5⤵
        
        PID:3256
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42c930eb-a1de-4a29-8e4d-b24374af28c8.vbs"
    3⤵
    PID:3104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\DtcInstall\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Networking.Connectivity\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\ProgramData\Microsoft\Vault\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\mftranscode\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\ProgramData\SoftwareDistribution\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\PackageManifests\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

spoolsv.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv.exe.log
Size 1KB
SHA256 fd35f3609663bec79a5254866d1c47342fbde3f94808acff8c3eaa19b24f67e5
MD5 9699cf9bb24ebbc9b1035710e92b7bd2
SHA1 73f0f26db57ea306970a76f42c647bbce02a3f23
SHA512 3a433f40f25b5a5c09f8de45ebd0b5485b3b54eb0c1c08a1dbae776629710b8d8f5fee21329d146867e49b5d35108bba6eff3995fb7c6246dbe6fe475eadf0bb
MD5 SHA1 SHA512

Submit Download