Overview

overview

10

Static

static

3

2026-05-25...ee.exe

windows10-2004-x64

10

2026-05-25...ee.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    80s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/05/2026, 09:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-25_1ea42fa88bdb8d87186975ee5438db72_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.7MB
  • Sample260525-lpfamaf181
  • SHA256 81e8e2b5be9ecb54100dbd4448f805b6fc7acad9b9ca32118477bfc0eea9a7b6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutiondcratinfostealerpersistencerattrojan

Malware Config

Signatures

  • Family: DcRat 35 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Detects executables packed with SmartAssembly 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Adds Run key to start application 2 TTPs 22 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • SmartAssembly .NET packer 5 IoCs

    Detects SmartAssembly .NET packer.

  • Drops file in Program Files directory 20 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • System policy modification 1 TTPs 3 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_1ea42fa88bdb8d87186975ee5438db72_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-25_1ea42fa88bdb8d87186975ee5438db72_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Family: DcRat
    • Modifies WinLogon for persistence
    • UAC bypass
    • Checks computer location settings
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4468
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5156
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:6192
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6740
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6288
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6260
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6224
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6352
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6380
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1060
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6444
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6472
    • C:\Windows\Prefetch\ReadyBoot\RuntimeBroker.exe
      "C:\Windows\Prefetch\ReadyBoot\RuntimeBroker.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:6936
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\wininit.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3852
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3576
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\Update\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1160
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2396
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3828
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1944
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Windows\Vss\Writers\System\winlogon.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4136
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2848
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Windows\Vss\Writers\System\winlogon.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:5068
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4184
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4744
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4892
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1380
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2524
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\WUDFHost.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4528
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Crypto\Keys\OfficeClickToRun.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1912
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Crypto\Keys\OfficeClickToRun.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:5072
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\Crypto\Keys\OfficeClickToRun.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2532
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Prefetch\ReadyBoot\RuntimeBroker.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4764
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:948
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Prefetch\ReadyBoot\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3928
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\upfc.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:2664
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:964
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1500
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\Media\Savanna\SearchApp.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1992
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\Media\Savanna\SearchApp.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1268
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\Savanna\SearchApp.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4400
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3980
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:1272
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3836
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\smss.exe'" /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4816
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:3532
  • C:\Windows\system32\schtasks.exe
    schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
    1⤵
    • Family: DcRat
    • Process spawned unexpected child process
    • Scheduled Task/Job: Scheduled Task
    PID:4332
  • C:\Windows\Prefetch\ReadyBoot\RuntimeBroker.exe
    "C:\Windows\Prefetch\ReadyBoot\RuntimeBroker.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2168
  • C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe
    "C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2276
  • C:\Recovery\WindowsRE\WUDFHost.exe
    "C:\Recovery\WindowsRE\WUDFHost.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:5948
  • C:\Users\Default User\smss.exe
    "C:\Users\Default User\smss.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:5840
  • C:\Users\All Users\Microsoft\Crypto\Keys\OfficeClickToRun.exe
    "C:\Users\All Users\Microsoft\Crypto\Keys\OfficeClickToRun.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4372
  • C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe
    "C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:5820
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2ade3ff-9118-41ae-b6c0-3dacff29afe9.vbs"
      2⤵
        PID:6040
        • C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe
          "C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe"
          3⤵
            PID:13700
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\954a0c6e-f248-4417-bb02-1f5e2050b6cc.vbs"
          2⤵
            PID:6996
        • C:\Program Files (x86)\Google\Update\wininit.exe
          "C:\Program Files (x86)\Google\Update\wininit.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5336
        • C:\Users\Default User\upfc.exe
          "C:\Users\Default User\upfc.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5672
        • C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe
          "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\wininit.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5400
        • C:\Windows\Media\Savanna\SearchApp.exe
          "C:\Windows\Media\Savanna\SearchApp.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6720
        • C:\Windows\Vss\Writers\System\winlogon.exe
          "C:\Windows\Vss\Writers\System\winlogon.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:11836

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              1
              T1562

              Disable or Modify Tools

              1
              T1562.001

              Modify Registry

              4
              T1112

              Credential Access

              Discovery

              Query Registry

              2
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              WUDFHost.exe
              • Path C:\Recovery\WindowsRE\WUDFHost.exe
              • Size 1.7MB
              • SHA256 81e8e2b5be9ecb54100dbd4448f805b6fc7acad9b9ca32118477bfc0eea9a7b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RuntimeBroker.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RuntimeBroker.exe.log
              • Size 410B
              • SHA256 d9c6d00fad02f7a9ef0fcddc298ffd58b17020fb12b1336d5733237cbfadb1e0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
              • Size 1KB
              • SHA256 2bc2bc398504fddc7b5fc4099792e87db95cacb4f59e6003cb4241cd58d23421
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wininit.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wininit.exe.log
              • Size 942B
              • SHA256 c295416053705f71b5287254d10d37efcbce5a07deda8785b1e5fc0985eeb00c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 6d0d7f0384ec2d12d6e5115f6e5f0b7e2fbefefa7c866053fed00009ce64d812
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 9baf43b98a8740ebc417f015b5921f978db1b1c13727df8a4e661f8fcc3b474c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 b09b238b364f5933d9e1bdac5e02273210232278e284c47bd1f19e96ae556626
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 2ba2708c6e3dc5ade94646ca578fd12038244cee4f51aaa04a990c5ca766df3b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 a832cd19eedeff5aa685353b64385a0cafdb9c92a7168231bf512fa4c001f013
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 ffe3d0b7aed204fc6532280f247ec6c31018499610d6248d1aa78ed945e57529
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 18KB
              • SHA256 84afcbf7fd825455b9e991ce9b97a17ddcecc8de50278012877a285e2e195fc8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              954a0c6e-f248-4417-bb02-1f5e2050b6cc.vbs
              • Path C:\Users\Admin\AppData\Local\Temp\954a0c6e-f248-4417-bb02-1f5e2050b6cc.vbs
              • Size 526B
              • SHA256 519610b0cd48f295b5742c74bc8910614468cc7089ff9952a4ff5cee082575ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              __PSScriptPolicyTest_2ss1mtc5.ete.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ss1mtc5.ete.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              d2ade3ff-9118-41ae-b6c0-3dacff29afe9.vbs
              • Path C:\Users\Admin\AppData\Local\Temp\d2ade3ff-9118-41ae-b6c0-3dacff29afe9.vbs
              • Size 750B
              • SHA256 024ab225a01e454d712c334ee7ba387453100fd7e926df45018a9c4b52a07345
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1060-68148-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/4468-98-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-5240-0x00000000067D0000-0x00000000067DC000-memory.dmp
              Download

              memory/4468-90-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-88-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-84-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-82-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-80-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-78-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-76-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-74-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-70-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-66-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-64-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-60-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-58-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-56-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-54-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-52-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-62-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-50-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-48-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-46-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-44-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-42-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-40-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-36-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-32-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-30-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-38-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-28-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-26-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-22-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-18-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-16-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-12-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-8-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-20-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-6-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-5-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-120-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-128-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-126-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-124-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-5230-0x0000000002BA0000-0x0000000002BF0000-memory.dmp
              Download

              memory/4468-116-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-114-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-112-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-110-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-108-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-106-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-104-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-102-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-100-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-94-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-97-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-130-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-122-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-1694-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-2056-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-2332-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-92-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-5228-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-118-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-5232-0x0000000006010000-0x0000000006020000-memory.dmp
              Download

              memory/4468-5231-0x0000000002C00000-0x0000000002C08000-memory.dmp
              Download

              memory/4468-5233-0x00000000066E0000-0x00000000066F6000-memory.dmp
              Download

              memory/4468-5234-0x0000000006070000-0x0000000006078000-memory.dmp
              Download

              memory/4468-5235-0x0000000006840000-0x0000000006850000-memory.dmp
              Download

              memory/4468-5236-0x0000000006700000-0x000000000670A000-memory.dmp
              Download

              memory/4468-5237-0x0000000006730000-0x000000000673C000-memory.dmp
              Download

              memory/4468-5238-0x0000000006740000-0x0000000006752000-memory.dmp
              Download

              memory/4468-5239-0x0000000006860000-0x0000000006D8C000-memory.dmp
              Download

              memory/4468-5229-0x0000000002B70000-0x0000000002B8C000-memory.dmp
              Download

              memory/4468-5241-0x00000000067E0000-0x00000000067EC000-memory.dmp
              Download

              memory/4468-5243-0x0000000006830000-0x0000000006838000-memory.dmp
              Download

              memory/4468-5244-0x0000000007110000-0x000000000711C000-memory.dmp
              Download

              memory/4468-5242-0x0000000006810000-0x000000000681A000-memory.dmp
              Download

              memory/4468-5246-0x0000000007200000-0x000000000720C000-memory.dmp
              Download

              memory/4468-5247-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-5245-0x0000000007120000-0x00000000071B2000-memory.dmp
              Download

              memory/4468-5250-0x0000000007360000-0x00000000073C6000-memory.dmp
              Download

              memory/4468-7852-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-8050-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-0-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-1-0x0000000005340000-0x00000000055BC000-memory.dmp
              Download

              memory/4468-2-0x0000000002A20000-0x0000000002A30000-memory.dmp
              Download

              memory/4468-86-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-72-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-3-0x00000000055C0000-0x0000000005B64000-memory.dmp
              Download

              memory/4468-4-0x00000000050B0000-0x000000000532A000-memory.dmp
              Download

              memory/4468-10-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-14-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-24-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-34-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/4468-68-0x00000000050B0000-0x0000000005324000-memory.dmp
              Download

              memory/5156-68221-0x0000000007460000-0x000000000747A000-memory.dmp
              Download

              memory/5156-8580-0x0000000002830000-0x0000000002866000-memory.dmp
              Download

              memory/5156-68182-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/5156-68220-0x0000000007360000-0x0000000007374000-memory.dmp
              Download

              memory/6192-68210-0x0000000007A70000-0x0000000007A81000-memory.dmp
              Download

              memory/6192-68191-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6224-68199-0x00000000071E0000-0x0000000007276000-memory.dmp
              Download

              memory/6224-68180-0x00000000075A0000-0x0000000007C1A000-memory.dmp
              Download

              memory/6224-68181-0x0000000006F60000-0x0000000006F7A000-memory.dmp
              Download

              memory/6224-68190-0x0000000006FD0000-0x0000000006FDA000-memory.dmp
              Download

              memory/6224-68140-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6260-8581-0x0000000004E10000-0x0000000005438000-memory.dmp
              Download

              memory/6260-68211-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6288-68172-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6288-68222-0x00000000076F0000-0x00000000076F8000-memory.dmp
              Download

              memory/6288-68117-0x0000000005B80000-0x0000000005B9E000-memory.dmp
              Download

              memory/6288-68118-0x00000000060A0000-0x00000000060EC000-memory.dmp
              Download

              memory/6352-12716-0x0000000005D10000-0x0000000005D76000-memory.dmp
              Download

              memory/6352-12715-0x0000000005C70000-0x0000000005C92000-memory.dmp
              Download

              memory/6380-68200-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6444-68156-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6472-68164-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6740-22566-0x0000000005850000-0x0000000005BA4000-memory.dmp
              Download

              memory/6740-68130-0x0000000070FC0000-0x000000007100C000-memory.dmp
              Download

              memory/6740-68219-0x00000000073A0000-0x00000000073AE000-memory.dmp
              Download

              memory/6740-68129-0x0000000006FC0000-0x0000000006FF2000-memory.dmp
              Download

              memory/6740-68138-0x0000000007000000-0x000000000701E000-memory.dmp
              Download

              memory/6740-68139-0x0000000007030000-0x00000000070D3000-memory.dmp
              Download