dcrat | a1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49

Analysis

max time kernel
140s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Size 1.7MB
Sample260524-twcr3set3y
SHA256 a1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49
MD5 9682fbbbef064863edc9d6aa0186a4aa
SHA1 3112f5cbfac63dc42caeada0cb5868d5443a2ecd
SHA512 106c32911f0955a2f6b491b76f50b854f3b72b6a012dbd881b137a31d21e0fc407133fa20f3348f2c6ee961c6fbc2427fd9ab486128e2029a1d9441e8a423f88
SSDEEP 49152:ckQTAkIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc+:casuRD9JdOR4m+lmY/4rx8c+
TLSH
T1D58523157181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB660C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat 53 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		2440	schtasks.exe
		1052	schtasks.exe
		3008	schtasks.exe
		3204	schtasks.exe
		3480	schtasks.exe
		4192	schtasks.exe
		4440	schtasks.exe
		768	schtasks.exe
		708	schtasks.exe
		1600	schtasks.exe
		564	schtasks.exe
		3256	schtasks.exe
		3788	schtasks.exe
		2660	schtasks.exe
		1116	schtasks.exe
		2276	schtasks.exe
		660	schtasks.exe
		2908	schtasks.exe
		3132	schtasks.exe
		4700	schtasks.exe
		4060	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language		xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
		2776	schtasks.exe
		1072	schtasks.exe
		1308	schtasks.exe
		1944	schtasks.exe
File created	C:\Program Files\Uninstall Information\cc11b995f2a76d		xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
		852	schtasks.exe
		3500	schtasks.exe
		4720	schtasks.exe
		2552	schtasks.exe
		568	schtasks.exe
		1896	schtasks.exe
		4832	schtasks.exe
		4292	schtasks.exe
		2456	schtasks.exe
		5076	schtasks.exe
		4912	schtasks.exe
		4452	schtasks.exe
		2956	schtasks.exe
		2368	schtasks.exe
		4788	schtasks.exe
		4960	schtasks.exe
		4688	schtasks.exe
		3812	schtasks.exe
		2912	schtasks.exe
		1736	schtasks.exe
		4316	schtasks.exe
		4728	schtasks.exe
		3280	schtasks.exe
		3484	schtasks.exe
		800	schtasks.exe
		3084	schtasks.exe

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\winlogon.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\SearchHost.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\winlogon.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

Process spawned unexpected child process 51 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4912	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4452	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4720	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1896	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1052	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2660	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	3448	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3448	schtasks.exe	80

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5440	powershell.exe
6668	powershell.exe
6740	powershell.exe
5100	powershell.exe
5348	powershell.exe
5668	powershell.exe
6640	powershell.exe
7436	powershell.exe
6224	powershell.exe
5456	powershell.exe
5224	powershell.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\Users\\Admin\\SearchHost.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\Users\\Admin\\SearchHost.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Uninstall Information\\winlogon.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Uninstall Information\\winlogon.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2896-5232-0x0000000005190000-0x00000000051A0000-memory.dmp	SmartAssembly
behavioral2/memory/2896-5236-0x00000000066B0000-0x00000000066BA000-memory.dmp	SmartAssembly
behavioral2/memory/2896-5241-0x0000000006CC0000-0x0000000006CCC000-memory.dmp	SmartAssembly
behavioral2/memory/2896-5242-0x0000000006CF0000-0x0000000006CFA000-memory.dmp	SmartAssembly
behavioral2/memory/2896-5244-0x00000000070C0000-0x00000000070CC000-memory.dmp	SmartAssembly

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\winlogon.exe	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
File opened for modification	C:\Program Files\Uninstall Information\winlogon.exe	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
File created	C:\Program Files\Uninstall Information\cc11b995f2a76d	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
File created	C:\Program Files\dotnet\StartMenuExperienceHost.exe	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
File created	C:\Program Files\dotnet\55b276f4edf653	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3280	schtasks.exe
800	schtasks.exe
4960	schtasks.exe
2276	schtasks.exe
2456	schtasks.exe
4788	schtasks.exe
3204	schtasks.exe
4440	schtasks.exe
2368	schtasks.exe
4316	schtasks.exe
2908	schtasks.exe
708	schtasks.exe
1116	schtasks.exe
2552	schtasks.exe
2912	schtasks.exe
4452	schtasks.exe
4728	schtasks.exe
3008	schtasks.exe
4192	schtasks.exe
1052	schtasks.exe
660	schtasks.exe
568	schtasks.exe
4292	schtasks.exe
3256	schtasks.exe
1736	schtasks.exe
4912	schtasks.exe
3480	schtasks.exe
5076	schtasks.exe
852	schtasks.exe
1896	schtasks.exe
4688	schtasks.exe
3812	schtasks.exe
1944	schtasks.exe
3484	schtasks.exe
4060	schtasks.exe
2776	schtasks.exe
4720	schtasks.exe
2440	schtasks.exe
2660	schtasks.exe
3084	schtasks.exe
4700	schtasks.exe
1308	schtasks.exe
2956	schtasks.exe
768	schtasks.exe
564	schtasks.exe
1072	schtasks.exe
4832	schtasks.exe
1600	schtasks.exe
3500	schtasks.exe
3132	schtasks.exe
3788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2896	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
2896	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
2896	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
2896	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
2896	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
"C:\Users\Admin\AppData\Local\Temp\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe"
1⤵
- Family: DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kcs6m8zvUk.bat"
  2⤵
  PID:11068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\winlogon.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\SearchHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Users\Admin\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\StartMenuExperienceHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\dotnet\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\services.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\services.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\WindowsPowerShell\Modules\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Modules\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft\Provisioning\AssetCache\WUDFHost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Provisioning\AssetCache\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft\Provisioning\AssetCache\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49x" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\es-ES\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\es-ES\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49x" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\es-ES\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\fontdrvhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\tracing\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\tracing\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\root\fre\dllhost.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\fre\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\root\fre\dllhost.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49x" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49x" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\fr-FR\RuntimeBroker.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\DESIGNER\csrss.exe'" /rl HIGHEST /f
1⤵
- Family: DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
PID:1052

C:\Windows\fr-FR\RuntimeBroker.exe
"C:\Windows\fr-FR\RuntimeBroker.exe"
1⤵
PID:3984

C:\Users\All Users\Microsoft\Provisioning\AssetCache\WUDFHost.exe
"C:\Users\All Users\Microsoft\Provisioning\AssetCache\WUDFHost.exe"
1⤵
PID:5644

C:\Users\Admin\SearchHost.exe
"C:\Users\Admin\SearchHost.exe"
1⤵
PID:5424

C:\Program Files\WindowsPowerShell\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
"C:\Program Files\WindowsPowerShell\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe"
1⤵
PID:5420

C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe
"C:\Program Files\Windows Photo Viewer\fr-FR\lsass.exe"
1⤵
PID:6284

C:\Program Files\Uninstall Information\winlogon.exe
"C:\Program Files\Uninstall Information\winlogon.exe"
1⤵
PID:4388

C:\Program Files\WindowsPowerShell\Modules\RuntimeBroker.exe
"C:\Program Files\WindowsPowerShell\Modules\RuntimeBroker.exe"
1⤵
PID:1044

C:\Program Files\Windows Media Player\es-ES\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe
"C:\Program Files\Windows Media Player\es-ES\xa1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49.exe"
1⤵
PID:9888

C:\Program Files\Reference Assemblies\Microsoft\Framework\services.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\services.exe"
1⤵
PID:10380

C:\Program Files\Microsoft Office\root\fre\dllhost.exe
"C:\Program Files\Microsoft Office\root\fre\dllhost.exe"
1⤵
PID:3848

C:\Program Files\dotnet\StartMenuExperienceHost.exe
"C:\Program Files\dotnet\StartMenuExperienceHost.exe"
1⤵
PID:9716

C:\Program Files\Common Files\DESIGNER\csrss.exe
"C:\Program Files\Common Files\DESIGNER\csrss.exe"
1⤵
PID:11872

C:\Recovery\WindowsRE\lsass.exe
"C:\Recovery\WindowsRE\lsass.exe"
1⤵
PID:7120

C:\Program Files\Windows Photo Viewer\en-US\OfficeClickToRun.exe
"C:\Program Files\Windows Photo Viewer\en-US\OfficeClickToRun.exe"
1⤵
PID:8800

C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe
"C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe"
1⤵
PID:8356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\Program Files\Reference Assemblies\Microsoft\Framework\services.exe
Size 1.7MB
SHA256 a1fa8d13cd3316deaf4553ed3a96aa6b68b7e2150193427ab7cd303daa5f9e49
MD5 9682fbbbef064863edc9d6aa0186a4aa
SHA1 3112f5cbfac63dc42caeada0cb5868d5443a2ecd
SHA512 106c32911f0955a2f6b491b76f50b854f3b72b6a012dbd881b137a31d21e0fc407133fa20f3348f2c6ee961c6fbc2427fd9ab486128e2029a1d9441e8a423f88
SSDEEP 49152:ckQTAkIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sc+:casuRD9JdOR4m+lmY/4rx8c+
TLSH
T1D58523157181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB660C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Program Files\Windows Photo Viewer\en-US\OfficeClickToRun.exe
Size 640KB
SHA256 835f4e17c8e621346a9136df7598e8a1467df6c66b9306226158b3e90350c74e
MD5 22eba60b5d5846b3a066e83c4be6dd1a
SHA1 1ea3f6b8a492cd0a56adf576b0a19c2753a8628f
SHA512 f6daad5d3effced98e59695ff931b7e31518118d769fd31d0ad15338bb3a64592cf0db5ea8fb5fa2cb3ef5334ed0bb34db9842f55042f696af0ea40a3e103327
SSDEEP 12288:gh1Lk70TnvjcoUgAgux61IP20vhe/ShQnvgTRPxX3VOKGHYxi2yqJT+gLa4r+:ck70TrcTgBukmO0ZthkvMjHVOKG4s0Ty
TLSH
T175D412117180D2B3C5F7017184E5CB359A3635710B6AA6EBBAD92BB62F203E4B7361CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dfojkgca.ycm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfojkgca.ycm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2896-0-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-1-0x0000000005460000-0x00000000056DC000-memory.dmp

Download

memory/2896-2-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-3-0x00000000056E0000-0x0000000005C86000-memory.dmp

Download

memory/2896-4-0x00000000051D0000-0x000000000544A000-memory.dmp

Download

memory/2896-6-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-14-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-18-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-52-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-44-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-36-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-34-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-32-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-58-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-68-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-72-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-107-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-104-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-118-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-116-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-114-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-112-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-110-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-108-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-102-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-100-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-98-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-96-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-94-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-92-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-90-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-88-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-87-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-84-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-82-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-80-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-78-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-76-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-74-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-71-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-66-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-64-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-62-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-60-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-56-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-54-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-50-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-48-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-46-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-42-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-40-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-38-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-30-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-28-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-26-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-24-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-23-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-20-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-12-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-10-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-16-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-8-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-5-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-120-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-129-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-124-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-130-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-126-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-122-0x00000000051D0000-0x0000000005444000-memory.dmp

Download

memory/2896-1555-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-1812-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-2109-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-5228-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-5229-0x0000000004B70000-0x0000000004B8C000-memory.dmp

Download

memory/2896-5230-0x0000000004BA0000-0x0000000004BF0000-memory.dmp

Download

memory/2896-5232-0x0000000005190000-0x00000000051A0000-memory.dmp

Download

memory/2896-5231-0x0000000004C00000-0x0000000004C08000-memory.dmp

Download

memory/2896-5233-0x0000000005FE0000-0x0000000005FF6000-memory.dmp

Download

memory/2896-5234-0x0000000005F90000-0x0000000005F98000-memory.dmp

Download

memory/2896-5235-0x0000000005FB0000-0x0000000005FC0000-memory.dmp

Download

memory/2896-5236-0x00000000066B0000-0x00000000066BA000-memory.dmp

Download

memory/2896-5237-0x00000000066E0000-0x00000000066EC000-memory.dmp

Download

memory/2896-5238-0x00000000066F0000-0x0000000006702000-memory.dmp

Download

memory/2896-5239-0x0000000006720000-0x0000000006C4C000-memory.dmp

Download

memory/2896-5240-0x0000000006CB0000-0x0000000006CBC000-memory.dmp

Download

memory/2896-5241-0x0000000006CC0000-0x0000000006CCC000-memory.dmp

Download

memory/2896-5242-0x0000000006CF0000-0x0000000006CFA000-memory.dmp

Download

memory/2896-5243-0x0000000007090000-0x0000000007098000-memory.dmp

Download

memory/2896-5245-0x00000000070D0000-0x0000000007162000-memory.dmp

Download

memory/2896-5244-0x00000000070C0000-0x00000000070CC000-memory.dmp

Download

memory/2896-5246-0x0000000007190000-0x000000000719C000-memory.dmp

Download

memory/2896-5247-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-5250-0x00000000071B0000-0x0000000007216000-memory.dmp

Download

memory/2896-7874-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/2896-7511-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/5668-13916-0x0000000005740000-0x0000000005D6A000-memory.dmp

Download

memory/5668-13915-0x0000000004F50000-0x0000000004F86000-memory.dmp

Download

memory/5668-24352-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Download

memory/5668-25549-0x0000000005F00000-0x0000000006257000-memory.dmp

Download

memory/5668-24351-0x0000000005550000-0x0000000005572000-memory.dmp

Download