dcrat | 57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348

Analysis

max time kernel
73s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Size 2.0MB
Sample260425-c2fx9acy5x
SHA256 57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348
MD5 c5243e9a3610ef6e81d58c4e7775b0a2
SHA1 c5ac79c3fbcfd2c03b8c29db600c2bbbfce6e723
SHA512 17c9cf33223a6216ad1c20bf6d6884f355ab554d954bfc15dee281ef2d2ad954fb4aa7aff8e206d9393e9bc3aa951e7d4bcf4503b41aaee4d7a6e8c3e37ed4d0
SSDEEP 49152:ukQTAqYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpk:uaq5CbhZcT2lvnDFpFW/twU7+k
TLSH
T126A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 27 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		6484	schtasks.exe
		3904	schtasks.exe
		4968	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
		4108	schtasks.exe
File created	C:\Windows\DigitalLocker\en-US\55b276f4edf653		x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
		568	schtasks.exe
		6400	schtasks.exe
		6728	schtasks.exe
		6864	schtasks.exe
		5604	schtasks.exe
		1448	schtasks.exe
		3472	schtasks.exe
		6276	schtasks.exe
		824	schtasks.exe
		5156	schtasks.exe
		3012	schtasks.exe
		4360	schtasks.exe
		5284	schtasks.exe
		4512	schtasks.exe
		468	schtasks.exe
		2304	schtasks.exe
		1148	schtasks.exe
		1940	schtasks.exe
		6388	schtasks.exe
		4520	schtasks.exe
		5520	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\en-US\\StartMenuExperienceHost.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\en-US\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\DigitalLocker\\en-US\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Process spawned unexpected child process 25 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5604	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6388	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5520	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6484	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6400	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5284	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6276	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6728	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3904	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5156	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4512	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6864	4728	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	4728	schtasks.exe	87

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5612	powershell.exe
2812	powershell.exe
5012	powershell.exe
4256	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Executes dropped EXE 3 IoCs

pid	Process
1128	lsass.exe
2420	sihost.exe
4524	StartMenuExperienceHost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Security\\BrowserCore\\en-US\\lsass.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\DigitalLocker\\en-US\\StartMenuExperienceHost.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\DigitalLocker\\en-US\\StartMenuExperienceHost.exe\""	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

SmartAssembly .NET packer 7 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/5124-5235-0x0000000006430000-0x0000000006440000-memory.dmp	SmartAssembly
behavioral1/memory/5124-5241-0x0000000006BC0000-0x0000000006BCA000-memory.dmp	SmartAssembly
behavioral1/memory/5124-5250-0x0000000008400000-0x000000000840C000-memory.dmp	SmartAssembly
behavioral1/memory/5124-5249-0x00000000083E0000-0x00000000083EC000-memory.dmp	SmartAssembly
behavioral1/memory/5124-5254-0x00000000087E0000-0x00000000087EA000-memory.dmp	SmartAssembly
behavioral1/memory/5124-5252-0x0000000008430000-0x000000000843C000-memory.dmp	SmartAssembly
behavioral1/memory/5124-5258-0x0000000008840000-0x000000000884A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File created	C:\Program Files\Windows Security\BrowserCore\en-US\6203df4a6bafc7	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCX87EC.tmp	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\en-US\RCX87ED.tmp	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File created	C:\Windows\DigitalLocker\en-US\55b276f4edf653	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File created	C:\Windows\WaaS\System.exe	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX84AE.tmp	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX84AF.tmp	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
File created	C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	StartMenuExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4360	schtasks.exe
1148	schtasks.exe
1448	schtasks.exe
5284	schtasks.exe
6728	schtasks.exe
4512	schtasks.exe
1940	schtasks.exe
6388	schtasks.exe
4520	schtasks.exe
5520	schtasks.exe
568	schtasks.exe
6276	schtasks.exe
824	schtasks.exe
6864	schtasks.exe
3012	schtasks.exe
4968	schtasks.exe
6484	schtasks.exe
3904	schtasks.exe
468	schtasks.exe
4108	schtasks.exe
5604	schtasks.exe
2304	schtasks.exe
3472	schtasks.exe
6400	schtasks.exe
5156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
5012	powershell.exe
5612	powershell.exe
5012	powershell.exe
5612	powershell.exe
2812	powershell.exe
2812	powershell.exe
4256	powershell.exe
4256	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Token: SeDebugPrivilege	1128	lsass.exe
Token: SeDebugPrivilege	2420	sihost.exe
Token: SeDebugPrivilege	4524	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	5612	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 2812	5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe	107
PID 5124 wrote to memory of 5612	5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe	109
PID 5124 wrote to memory of 4256	5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe	110
PID 5124 wrote to memory of 5012	5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe	111
PID 5124 wrote to memory of 4748	5124	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe	117

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
"C:\Users\Admin\AppData\Local\Temp\x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QfKFARzT3K.bat"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4748
- - C:\Windows\SysWOW64\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:7036
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:7128
- - C:\Users\Admin\AppData\Local\Temp\x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe
    "C:\Users\Admin\AppData\Local\Temp\x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe"
    3⤵
    PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe
"C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1128
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af573376-b2df-4711-b284-58be640905d7.vbs"
  2⤵
  PID:4464
- - C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe
    "C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe"
    3⤵
    PID:2932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0a5d1580-6477-4436-8208-00b12526f44c.vbs"
  2⤵
  PID:5792

C:\Recovery\WindowsRE\sihost.exe
"C:\Recovery\WindowsRE\sihost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe
"C:\Windows\DigitalLocker\en-US\StartMenuExperienceHost.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Recent\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SearchApp.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4416_1518623149\OfficeClickToRun.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4416_1518623149\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\edge_BITS_4416_1518623149\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\Sun\Registry.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Sun\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Sun\Registry.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsass.exe

Path C:\Program Files\Windows Security\BrowserCore\en-US\lsass.exe
Size 2.0MB
SHA256 57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348
MD5 c5243e9a3610ef6e81d58c4e7775b0a2
SHA1 c5ac79c3fbcfd2c03b8c29db600c2bbbfce6e723
SHA512 17c9cf33223a6216ad1c20bf6d6884f355ab554d954bfc15dee281ef2d2ad954fb4aa7aff8e206d9393e9bc3aa951e7d4bcf4503b41aaee4d7a6e8c3e37ed4d0
SSDEEP 49152:ukQTAqYS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpk:uaq5CbhZcT2lvnDFpFW/twU7+k
TLSH
T126A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7A9D76F56F603F1623A6C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsass.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lsass.exe.log
Size 1KB
SHA256 fcddb303c289eea896d437f2d18f4774b4c2a5393b59796a9dbdf2975624dccb
MD5 512cb5c6878fe5e10e134e79b7c84450
SHA1 432924b02f857b7523e63db7a811780dd397e0ab
SHA512 eeb3aa55458f926b8e43a20a4941ae162056b1e0c535f88e9af6bdad6d95a6bb8e6c2f1565940c5bcea8849fcf4eeedd2b4a6a64d4d76d4cb4e71fc38e528d32
TLSH
T1A021AF303222B5D84D022F53081869C513FF4749BAA4EF2CB5A9221EDD2A44BEB321E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x57280fa1cd1bf2d841aedf03a94182035b98607f8ef76300939bb6eef4d21348.exe.log
Size 1KB
SHA256 94b7640dce6d228f0d89f1d504c7143397ffa2af6adf910b501d9d51583f463e
MD5 e1b159e530af554c42b6b6f3aefbd4de
SHA1 281d3767129c8aa8fc8867515578dee1eb7f39ba
SHA512 f373930c1dfab5e3029af93880c2f3bfc16413aaa28a563d4b953f93066facfe1ee1213e5facb6b92df79b2b3d2a2866df7c15fa2d6fe0a359186688aa7e99f0
TLSH
T15C3190303662B4D54D022F530C186AC513FF474DB6B4EF5CBA99225EE92A4579B321F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 2fd06531eab6bebdab36bcf324d2e6e6a01c840f666c53e79edffb07f11862b8
MD5 068c9c07eda25a1b1fd68572afb310c6
SHA1 555f617196acf5be78aa022afb757d621625a841
SHA512 e63b037761a9cd6849cd8bb09e742cfeb7eee3f47c9bca84c658d8e9ad3f02eeece38b7de40bdbe12b6480109013b3442761246f60334093d11ebc3d331e7fd3
SSDEEP 384:Vsf+Bh9i+p5npIVEBiKJk+o9orpNK6seYUME/J03SoZhfYSgojEDkaQ0gdwtkKhD:KfK7sEoPjorpNNzrSS8W2ED3CS3
TLSH
T1AC82D76E611F26C3C49613B8E117051FE8F2DD8D531A13D9BB1A9F3B8AAC69E903C548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e30acfcd56ded91fcfc8a978c2ff9e9dc769a66c845e9f9287acdb2ec435ecb8
MD5 9210730d9d237c236581dc00b90bdbc1
SHA1 6602e0fbd8520ee10f2480a2a2a8bcbd6120d698
SHA512 ca3917bdf4cf3442f7f0e66b823ae48faa65ea76dfe5ab95559174f5b2e22074128bff5d2879e2bbcd193ee0c0f9eafddb93548c27125b6ccb2fe92cfc5a46f4
SSDEEP 384:r6+BO9i+9IE2GBBiZQJk+o9o2T4K6seYUME/F03SoZ9fYSvojEDkSd0gdMtkKhD:elsKoZBjo2T4NzruS452EDOCm3
TLSH
T13082E76E611F26C3C48513B8E11B051FE8F2DE8D431A17D9BB1E8F3B4AAC69E903C548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a5d1580-6477-4436-8208-00b12526f44c.vbs

Path C:\Users\Admin\AppData\Local\Temp\0a5d1580-6477-4436-8208-00b12526f44c.vbs
Size 513B
SHA256 398e1257c20eb0a9beca2747d2b8f7e67c54a860027ca5eff772dd73fcecabaf
MD5 1a3355396c94823af966b7abba78226a
SHA1 7158080472f48184a86a1ecb04b7dca922171aa4
SHA512 5062e7b2b4547e51442b28537e5292af905a156725a0b5348c551eae4af0f23b600f1a7ea07589c5e96732f5bf9be45564c68848d5706925b71a91cc6bcfd32b
TLSH
T15AF09E0DFF09C734D401034217FA598F86ACD45D3275D159AA09E89F32926394AEE2CC
MD5 SHA1 SHA512 TLSH

Submit Download

QfKFARzT3K.bat

Path C:\Users\Admin\AppData\Local\Temp\QfKFARzT3K.bat
Size 268B
SHA256 f44a8162cb227cc959f69d1ae278974e15d01ddbc6be63b6712ac0a39a830650
MD5 76cabb8db359d456cde590e067e1cda0
SHA1 ed80ba137bf72b08dee343657d53064bad920e2d
SHA512 ddc9e649a94da92134f63a4eac8abacce993b1150a5db8623f77675ccfd43b6784ba893b0fed61e241aface6e35f2946c10a33d661f2fc96e39fc6fda5a71005
TLSH
T1CBD095028801CB190DA15C330959154CC4B31C087BC4B6200AD88C9C294BC7AF5D79C7
MD5 SHA1 SHA512 TLSH

Submit Download

RCX820D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX820D.tmp
Size 2.0MB
SHA256 e3793c19de4de41221201cf1568d402ddac04e436ecc58115d5181a9a522d167
MD5 b5b6a1ccf6d8500f8180baedea8f01f2
SHA1 6a86cfb0ab3249b543289631a6eb14a4e90e937f
SHA512 112cbe838a833a10fa7f2f5dcc982075e85cedb66d801784948a87fb916876bcadbf69431bdd836ebf0f1af35cf59ad212de913854c293c9d69793addf9125a4
SSDEEP 1536:MxxKY+T6KW5CvEyXWvE344wAL5LO8XvdPTwZI3sq5gnToIfnIOlIOjcTp5XzkyB:MnDKW1LgppLRHMY0TBfJvjcTp5XzkyB
TLSH
T1F0A56B2175C1C1B3C4B7113044E6CB799A7A3071076A96D7B7DD2BBA6E213E1A3362CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_um1tbw0s.acu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_um1tbw0s.acu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

af573376-b2df-4711-b284-58be640905d7.vbs

Path C:\Users\Admin\AppData\Local\Temp\af573376-b2df-4711-b284-58be640905d7.vbs
Size 737B
SHA256 e92a8bd8054707ea4f8c52efea90ccfa3498453a411edf4c942aed834e91151b
MD5 116beb535bc8f2335efd1dc415dfea08
SHA1 58fb56d69f4c3658ca4b4cac393f0ad1ab12372d
SHA512 085a778527ebe1302e31e2d3250838c6ad750798fdaf9f690b81fdac07db6c688f606556e6f8b53a048ae1dc5b5fac778521d3394c70280d0ecfc30865f6b190
TLSH
T1A601DC06BE0FE63020A1234091F6547B6AD8C02C2177B857BA60E46C2745E2400AC4ED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2812-21102-0x0000000007C10000-0x0000000007C2A000-memory.dmp

Download

memory/2812-21131-0x0000000007E50000-0x0000000007E64000-memory.dmp

Download

memory/2812-21111-0x0000000007C90000-0x0000000007C9A000-memory.dmp

Download

memory/2812-6985-0x0000000003240000-0x0000000003276000-memory.dmp

Download

memory/2812-21101-0x0000000008260000-0x00000000088DA000-memory.dmp

Download

memory/2812-21073-0x00000000077F0000-0x0000000007822000-memory.dmp

Download

memory/2812-11047-0x0000000006250000-0x00000000065A4000-memory.dmp

Download

memory/2812-10931-0x0000000006170000-0x00000000061D6000-memory.dmp

Download

memory/2812-21074-0x0000000071400000-0x000000007144C000-memory.dmp

Download

memory/2812-21112-0x0000000007E90000-0x0000000007F26000-memory.dmp

Download

memory/2812-10930-0x0000000005AA0000-0x0000000005AC2000-memory.dmp

Download

memory/4256-21082-0x0000000071400000-0x000000007144C000-memory.dmp

Download

memory/4256-20235-0x0000000005180000-0x000000000519E000-memory.dmp

Download

memory/4256-21130-0x00000000074C0000-0x00000000074CE000-memory.dmp

Download

memory/4256-20379-0x0000000006390000-0x00000000063DC000-memory.dmp

Download

memory/4256-21098-0x0000000007100000-0x000000000711E000-memory.dmp

Download

memory/4256-21113-0x0000000007490000-0x00000000074A1000-memory.dmp

Download

memory/5012-21090-0x0000000071400000-0x000000007144C000-memory.dmp

Download

memory/5012-21099-0x0000000006CD0000-0x0000000006D73000-memory.dmp

Download

memory/5012-21133-0x0000000007320000-0x0000000007328000-memory.dmp

Download

memory/5124-58-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-5243-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Download

memory/5124-60-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-0-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/5124-56-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-54-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-48-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-46-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-44-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-42-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-40-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-84-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-116-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-114-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-130-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-128-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-126-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-124-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-122-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-120-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-118-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-112-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-110-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-108-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-106-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-104-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-102-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-98-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-96-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-94-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-92-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-86-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-82-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-80-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-78-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-100-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-90-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-88-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-1797-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/5124-2030-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/5124-2315-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/5124-5231-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/5124-5232-0x00000000023F0000-0x000000000240C000-memory.dmp

Download

memory/5124-5233-0x0000000002420000-0x0000000002470000-memory.dmp

Download

memory/5124-5235-0x0000000006430000-0x0000000006440000-memory.dmp

Download

memory/5124-5234-0x0000000002480000-0x0000000002488000-memory.dmp

Download

memory/5124-5236-0x0000000006470000-0x0000000006486000-memory.dmp

Download

memory/5124-5237-0x0000000006B50000-0x0000000006B58000-memory.dmp

Download

memory/5124-5238-0x0000000006CA0000-0x0000000006CB2000-memory.dmp

Download

memory/5124-5239-0x0000000006B60000-0x0000000006B68000-memory.dmp

Download

memory/5124-5240-0x0000000006BD0000-0x0000000006BE0000-memory.dmp

Download

memory/5124-5242-0x0000000006C00000-0x0000000006C92000-memory.dmp

Download

memory/5124-5241-0x0000000006BC0000-0x0000000006BCA000-memory.dmp

Download

memory/5124-64-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-5244-0x0000000006DF0000-0x0000000006DFC000-memory.dmp

Download

memory/5124-5247-0x0000000006E20000-0x0000000006E32000-memory.dmp

Download

memory/5124-5245-0x0000000006E10000-0x0000000006E18000-memory.dmp

Download

memory/5124-5248-0x0000000007E60000-0x000000000838C000-memory.dmp

Download

memory/5124-5250-0x0000000008400000-0x000000000840C000-memory.dmp

Download

memory/5124-5249-0x00000000083E0000-0x00000000083EC000-memory.dmp

Download

memory/5124-5251-0x0000000008410000-0x000000000841C000-memory.dmp

Download

memory/5124-5253-0x0000000008440000-0x0000000008448000-memory.dmp

Download

memory/5124-5254-0x00000000087E0000-0x00000000087EA000-memory.dmp

Download

memory/5124-5252-0x0000000008430000-0x000000000843C000-memory.dmp

Download

memory/5124-5258-0x0000000008840000-0x000000000884A000-memory.dmp

Download

memory/5124-5262-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/5124-5263-0x0000000008890000-0x00000000088F6000-memory.dmp

Download

memory/5124-5259-0x0000000008850000-0x000000000885C000-memory.dmp

Download

memory/5124-5257-0x0000000008830000-0x0000000008838000-memory.dmp

Download

memory/5124-5256-0x0000000008820000-0x0000000008828000-memory.dmp

Download

memory/5124-5255-0x00000000087F0000-0x00000000087FE000-memory.dmp

Download

memory/5124-66-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-68-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-70-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-1-0x0000000005640000-0x00000000058F8000-memory.dmp

Download

memory/5124-72-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-74-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-76-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-50-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-52-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-62-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-38-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-5-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-7-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-8-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-14-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-16-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-18-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-2-0x0000000002B00000-0x0000000002B10000-memory.dmp

Download

memory/5124-26-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-20-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-22-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-24-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-28-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-30-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-32-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-3-0x0000000005900000-0x0000000005EA4000-memory.dmp

Download

memory/5124-36-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-34-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-10-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-12-0x0000000005380000-0x0000000005631000-memory.dmp

Download

memory/5124-4-0x0000000005380000-0x0000000005636000-memory.dmp

Download

memory/5612-21132-0x0000000008040000-0x000000000805A000-memory.dmp

Download

memory/5612-21103-0x0000000071400000-0x000000007144C000-memory.dmp

Download

memory/5612-7166-0x0000000005A60000-0x0000000006088000-memory.dmp

Download