Overview

overview

10

Static

static

10

DCRatBuild121212.exe

windows10-2004-x64

10

DCRatBuild121212.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    900s
  • max time network
    551s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 11:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DCRatBuild121212.exe
  • Size 2.9MB
  • Sample260715-nnd3aaev71
  • SHA256 2e8b7a738ae3982c77f5751b4be096be2841167625190c245b7fb1858cd4ccd5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoveryexecutiondcratinfostealerpersistenceransomwareratspyware

Malware Config

Signatures

  • Family: DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • DCRat payload 2 IoCs
    rat
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 20 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 44 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\DCRatBuild121212.exe
    "C:\Users\Admin\AppData\Local\Temp\DCRatBuild121212.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\QXOxC7m7bDPPkgkvCappPoYma6Hu9G9i3un0C9o5Lri5Xn.vbe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4212
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\Bgs4QmuzpNkE3eFhZ7BSNDwJfhFcfUXAGAWI61Y9XalSRMbtbge.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5964
        • C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe
          "C:\Users\Admin\AppData\Local\Temp\ComcontainerSession/bridgeagentWebRef.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5588
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2796
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\SearchHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3524
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2712
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:5724
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2856
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zweASVM0Ld.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3792
            • C:\Windows\system32\chcp.com
              chcp 65001
              6⤵
                PID:4148
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                6⤵
                  PID:1296
                • C:\Recovery\WindowsRE\cmd.exe
                  "C:\Recovery\WindowsRE\cmd.exe"
                  6⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:5060
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TipjmLA2pW.bat"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4144
                    • C:\Windows\system32\chcp.com
                      chcp 65001
                      8⤵
                        PID:6136
                      • C:\Windows\system32\PING.EXE
                        ping -n 10 localhost
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:2356
                      • C:\Recovery\WindowsRE\cmd.exe
                        "C:\Recovery\WindowsRE\cmd.exe"
                        8⤵
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4792
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat"
                          9⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4448
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            10⤵
                              PID:4636
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              10⤵
                                PID:4116
                              • C:\Recovery\WindowsRE\cmd.exe
                                "C:\Recovery\WindowsRE\cmd.exe"
                                10⤵
                                • Executes dropped EXE
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:3480
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\W7vO5ocqvr.bat"
                                  11⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3316
                                  • C:\Windows\system32\chcp.com
                                    chcp 65001
                                    12⤵
                                      PID:2332
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      12⤵
                                        PID:3796
                                      • C:\Recovery\WindowsRE\cmd.exe
                                        "C:\Recovery\WindowsRE\cmd.exe"
                                        12⤵
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:2768
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cE5h37GJz6.bat"
                                          13⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5108
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            14⤵
                                              PID:3720
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              14⤵
                                                PID:1968
                                              • C:\Recovery\WindowsRE\cmd.exe
                                                "C:\Recovery\WindowsRE\cmd.exe"
                                                14⤵
                                                • Executes dropped EXE
                                                PID:4816
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:3900
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:6064
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:4600
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Updates\SearchHost.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:4396
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\SearchHost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:1256
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office\Updates\SearchHost.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:4968
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:5416
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:6032
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:1648
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:5404
                    • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe
                      "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6036
                    • C:\Program Files\Microsoft Office\Updates\SearchHost.exe
                      "C:\Program Files\Microsoft Office\Updates\SearchHost.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4084
                    • C:\Recovery\WindowsRE\cmd.exe
                      "C:\Recovery\WindowsRE\cmd.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2360
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:1944
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Desktop\Idle.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:2392
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\ServiceProfiles\csrss.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:5920
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\csrss.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:2992
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\ServiceProfiles\csrss.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:2684
                    • C:\Users\Admin\Desktop\Idle.exe
                      "C:\Users\Admin\Desktop\Idle.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5140
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "bridgeagentWebRefb" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe'" /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:5956
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "bridgeagentWebRef" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:1456
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /tn "bridgeagentWebRefb" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe'" /rl HIGHEST /f
                      1⤵
                      • Process spawned unexpected child process
                      • Scheduled Task/Job: Scheduled Task
                      PID:5804
                    • C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe
                      "C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4592
                    • C:\Windows\ServiceProfiles\csrss.exe
                      "C:\Windows\ServiceProfiles\csrss.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2340
                    • C:\Users\Admin\Desktop\Idle.exe
                      "C:\Users\Admin\Desktop\Idle.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:2376
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                      1⤵
                        PID:1952
                      • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe
                        "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:1652
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:4232
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:956
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:5044
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:1080
                      • C:\Recovery\WindowsRE\cmd.exe
                        "C:\Recovery\WindowsRE\cmd.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:5048
                      • C:\Program Files\Microsoft Office\Updates\SearchHost.exe
                        "C:\Program Files\Microsoft Office\Updates\SearchHost.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:5988
                      • C:\Windows\ServiceProfiles\csrss.exe
                        "C:\Windows\ServiceProfiles\csrss.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:5056
                      • C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe
                        "C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:4040
                      • C:\Users\Admin\Desktop\Idle.exe
                        "C:\Users\Admin\Desktop\Idle.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:5772
                      • C:\Windows\System32\SecurityHealthHost.exe
                        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                        1⤵
                          PID:1340
                        • C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe
                          "C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:5136

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Active Setup

                              1
                              T1547.014

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Modify Registry

                              2
                              T1112

                              Credential Access

                              Discovery

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              3
                              T1012

                              Remote System Discovery

                              1
                              T1018

                              System Information Discovery

                              3
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              System Network Configuration Discovery

                              1
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Lateral Movement

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              6CCACD8608530F
                              • Path C:\USERS\ADMIN\DESKTOP\6CCACD8608530F
                              • Size 955B
                              • SHA256 fd7ebe01f858dd8867c829a1a30dfb36032e2707bc98f6bdf00f8c081b4d9242
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 1599754af315bf45fc5c21a5d9d6289ee5d77b66ecc79c44b56e93a2e4a258b3
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              prep_Activatable Class_Hermes_perf.cache
                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                              • Size 595B
                              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              40vfctpQnk.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\40vfctpQnk.bat
                              • Size 205B
                              • SHA256 29061e73dedc8e2811dbd961cf45fb433301e5657d3a9fa5fbf9331e193fc871
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Bgs4QmuzpNkE3eFhZ7BSNDwJfhFcfUXAGAWI61Y9XalSRMbtbge.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\Bgs4QmuzpNkE3eFhZ7BSNDwJfhFcfUXAGAWI61Y9XalSRMbtbge.bat
                              • Size 100B
                              • SHA256 91461264aeeb1696f5b3b71037816bc44c727e4d9adf41dc7afb036723c42afd
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              QXOxC7m7bDPPkgkvCappPoYma6Hu9G9i3un0C9o5Lri5Xn.vbe
                              • Path C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\QXOxC7m7bDPPkgkvCappPoYma6Hu9G9i3un0C9o5Lri5Xn.vbe
                              • Size 249B
                              • SHA256 41eeea84d2377000f2e61344c28b871b81f5a1a6b74bba0914904fd30bf19fa5
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              bridgeagentWebRef.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\ComcontainerSession\bridgeagentWebRef.exe
                              • Size 2.4MB
                              • SHA256 9e3a4d73345f068d9a6142ca75b6d0ad17b68aa3187fd57fcc55157308adc554
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              TipjmLA2pW.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\TipjmLA2pW.bat
                              • Size 157B
                              • SHA256 8da6f939c811d7dc3aedebc3083709831e13fcd05c3fc8e757c959006804ea63
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              W7vO5ocqvr.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\W7vO5ocqvr.bat
                              • Size 205B
                              • SHA256 9d98ef9ab2ad485550f186c20438b4345e436437646416bb25f21299fcb2da8c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              __PSScriptPolicyTest_gv2goido.p43.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gv2goido.p43.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              cE5h37GJz6.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\cE5h37GJz6.bat
                              • Size 205B
                              • SHA256 171ba17e20bc5bb786b8e0c48847989793538f013bed83c2a59e69fc1b234386
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              zweASVM0Ld.bat
                              • Path C:\Users\Admin\AppData\Local\Temp\zweASVM0Ld.bat
                              • Size 205B
                              • SHA256 8356bbd34bed640249f9ba6099adeb9a2a9532b46a5bca9ae666c960e30e9cb2
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/2856-75-0x000002805E730000-0x000002805E74E000-memory.dmp
                              Download

                              memory/2856-78-0x000002805E750000-0x000002805E802000-memory.dmp
                              Download

                              memory/3524-61-0x000001E9ED0E0000-0x000001E9ED102000-memory.dmp
                              Download

                              memory/4260-79-0x000001CB5F7B0000-0x000001CB5F7BA000-memory.dmp
                              Download

                              memory/5044-183-0x0000023903C90000-0x0000023903CB0000-memory.dmp
                              Download

                              memory/5044-167-0x0000023903A30000-0x0000023903A50000-memory.dmp
                              Download

                              memory/5044-202-0x0000023914210000-0x0000023914230000-memory.dmp
                              Download

                              memory/5044-168-0x0000023913E90000-0x0000023913F90000-memory.dmp
                              Download

                              memory/5044-157-0x00000239001E0000-0x00000239002E0000-memory.dmp
                              Download

                              memory/5588-23-0x000000001B310000-0x000000001B322000-memory.dmp
                              Download

                              memory/5588-27-0x000000001B690000-0x000000001B6A2000-memory.dmp
                              Download

                              memory/5588-37-0x000000001B770000-0x000000001B788000-memory.dmp
                              Download

                              memory/5588-38-0x000000001B6E0000-0x000000001B6EC000-memory.dmp
                              Download

                              memory/5588-39-0x000000001B7E0000-0x000000001B82E000-memory.dmp
                              Download

                              memory/5588-35-0x000000001B6C0000-0x000000001B6CE000-memory.dmp
                              Download

                              memory/5588-34-0x000000001B6B0000-0x000000001B6C0000-memory.dmp
                              Download

                              memory/5588-33-0x000000001B470000-0x000000001B47E000-memory.dmp
                              Download

                              memory/5588-32-0x000000001B710000-0x000000001B76A000-memory.dmp
                              Download

                              memory/5588-31-0x000000001B330000-0x000000001B340000-memory.dmp
                              Download

                              memory/5588-30-0x0000000002A30000-0x0000000002A40000-memory.dmp
                              Download

                              memory/5588-29-0x0000000002A20000-0x0000000002A2C000-memory.dmp
                              Download

                              memory/5588-28-0x000000001BBE0000-0x000000001C108000-memory.dmp
                              Download

                              memory/5588-36-0x000000001B6D0000-0x000000001B6D8000-memory.dmp
                              Download

                              memory/5588-26-0x000000001B450000-0x000000001B466000-memory.dmp
                              Download

                              memory/5588-25-0x0000000002A10000-0x0000000002A20000-memory.dmp
                              Download

                              memory/5588-24-0x00000000029B0000-0x00000000029BC000-memory.dmp
                              Download

                              memory/5588-22-0x0000000002840000-0x000000000284E000-memory.dmp
                              Download

                              memory/5588-21-0x0000000002800000-0x0000000002810000-memory.dmp
                              Download

                              memory/5588-20-0x00000000027F0000-0x0000000002800000-memory.dmp
                              Download

                              memory/5588-19-0x00000000027B0000-0x00000000027C0000-memory.dmp
                              Download

                              memory/5588-18-0x00000000029C0000-0x0000000002A10000-memory.dmp
                              Download

                              memory/5588-17-0x0000000002810000-0x000000000282C000-memory.dmp
                              Download

                              memory/5588-16-0x00000000027A0000-0x00000000027AE000-memory.dmp
                              Download

                              memory/5588-15-0x00000000027C0000-0x00000000027E6000-memory.dmp
                              Download

                              memory/5588-14-0x0000000000320000-0x000000000058C000-memory.dmp
                              Download