dcrat | 45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
Size 1.3MB
Sample260910-tesrzasblf
SHA256 45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83
MD5 f67c67bdda4cdaa19d82bd08cee5357b
SHA1 9db72665a31458416b1de5171322db6f884b0dbc
SHA512 9013c1823b8948d463204acafe3333f4b0148dd4edd04aef21ae3b56ce9bb86abf4a8c89789dc677bc681b54327050b354ed41857e992ce7514d1a1de791500a
SSDEEP 12288:ON2N7N9FS18IHXlakldxx04Y6CVZ2ms78SZVACKDG4Ps4Em8V0w6akNDaIVAdPQd:ON2NcJlDxPFXZ5yl+06W7BQZxpuztRt
TLSH
T1BC5530342EEA102AF173BF7D8AE47596DA5EBAA33707985D10B103C60723A42DDD153E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1288-0-0x0000000000550000-0x00000000006AA000-memory.dmp	dcrat
behavioral1/memory/1288-0-0x0000000000550000-0x00000000006AA000-memory.dmp	family_dcrat_v2
behavioral1/files/0x0007000000024552-35.dat	dcrat
behavioral1/files/0x0007000000024552-35.dat	family_dcrat_v2

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1632	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	600	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1280	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	4880	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	4880	schtasks.exe	87

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2256	powershell.exe
3244	powershell.exe
2108	powershell.exe
1884	powershell.exe
4160	powershell.exe
4792	powershell.exe
3076	powershell.exe
1160	powershell.exe
988	powershell.exe
1856	powershell.exe
396	powershell.exe
692	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe

Executes dropped EXE 12 IoCs

pid	Process
4192	fontdrvhost.exe
4660	Registry.exe
4572	RuntimeBroker.exe
2376	dwm.exe
5092	taskhostw.exe
5108	RuntimeBroker.exe
3260	SearchApp.exe
904	RuntimeBroker.exe
3216	backgroundTaskHost.exe
2916	WUDFHost.exe
752	csrss.exe
5960	RuntimeBroker.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/1288-5-0x0000000000EC0000-0x0000000000ED0000-memory.dmp	SmartAssembly
behavioral1/memory/1288-10-0x000000001B340000-0x000000001B34A000-memory.dmp	SmartAssembly
behavioral1/memory/1288-17-0x000000001C3A0000-0x000000001C3AC000-memory.dmp	SmartAssembly
behavioral1/memory/1288-21-0x000000001C4E0000-0x000000001C4EC000-memory.dmp	SmartAssembly
behavioral1/memory/1288-23-0x000000001C500000-0x000000001C50A000-memory.dmp	SmartAssembly

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCX739B.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\RCX739C.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\38384e6a620884	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX5F95.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\DigitalLocker\en-US\9e8d7a4ca61bd9	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\Migration\WTR\RCX619A.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\addins\RCX6F81.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\addins\RuntimeBroker.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\IME\fontdrvhost.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\addins\9e8d7a4ca61bd9	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\Migration\WTR\RCX6199.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\Migration\WTR\taskhostw.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\addins\RCX6F80.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX5E6B.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\IME\fontdrvhost.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\IME\5b884080fd4f94	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\Migration\WTR\taskhostw.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\Migration\WTR\ea9f0e6c9e2dcd	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\addins\RuntimeBroker.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\IME\RCX5C56.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File opened for modification	C:\Windows\IME\RCX5C66.tmp	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
File created	C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1280	schtasks.exe
3788	schtasks.exe
1484	schtasks.exe
3752	schtasks.exe
396	schtasks.exe
1164	schtasks.exe
4344	schtasks.exe
3864	schtasks.exe
3444	schtasks.exe
3636	schtasks.exe
4032	schtasks.exe
1596	schtasks.exe
3504	schtasks.exe
2732	schtasks.exe
3164	schtasks.exe
2608	schtasks.exe
4808	schtasks.exe
600	schtasks.exe
3512	schtasks.exe
1964	schtasks.exe
116	schtasks.exe
1652	schtasks.exe
3448	schtasks.exe
2444	schtasks.exe
5072	schtasks.exe
3732	schtasks.exe
964	schtasks.exe
4236	schtasks.exe
3272	schtasks.exe
2468	schtasks.exe
1436	schtasks.exe
2636	schtasks.exe
1632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
2108	powershell.exe
3076	powershell.exe
3076	powershell.exe
2108	powershell.exe
2256	powershell.exe
2256	powershell.exe
692	powershell.exe
692	powershell.exe
4160	powershell.exe
4792	powershell.exe
4792	powershell.exe
4160	powershell.exe
1160	powershell.exe
1160	powershell.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
988	powershell.exe
988	powershell.exe
1884	powershell.exe
1884	powershell.exe
3244	powershell.exe
3244	powershell.exe
1856	powershell.exe
1856	powershell.exe
396	powershell.exe
396	powershell.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
4160	powershell.exe
692	powershell.exe
2256	powershell.exe
2108	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
Token: SeDebugPrivilege	4660	Registry.exe
Token: SeDebugPrivilege	4192	fontdrvhost.exe
Token: SeDebugPrivilege	4572	RuntimeBroker.exe
Token: SeDebugPrivilege	2376	dwm.exe
Token: SeDebugPrivilege	5108	RuntimeBroker.exe
Token: SeDebugPrivilege	904	RuntimeBroker.exe
Token: SeDebugPrivilege	5092	taskhostw.exe
Token: SeDebugPrivilege	3216	backgroundTaskHost.exe
Token: SeDebugPrivilege	3260	SearchApp.exe
Token: SeDebugPrivilege	2916	WUDFHost.exe
Token: SeDebugPrivilege	752	csrss.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4160	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	988	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	5960	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1856	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	144
PID 1288 wrote to memory of 1884	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	145
PID 1288 wrote to memory of 396	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	146
PID 1288 wrote to memory of 4160	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	147
PID 1288 wrote to memory of 692	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	148
PID 1288 wrote to memory of 4792	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	149
PID 1288 wrote to memory of 3076	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	150
PID 1288 wrote to memory of 2256	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	151
PID 1288 wrote to memory of 3244	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	152
PID 1288 wrote to memory of 2108	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	153
PID 1288 wrote to memory of 1160	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	154
PID 1288 wrote to memory of 988	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	155
PID 1288 wrote to memory of 5960	1288	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe	168

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe
"C:\Users\Admin\AppData\Local\Temp\45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\taskhostw.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Music\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\WUDFHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\OneDrive\Registry.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\addins\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:988
- C:\Users\Admin\Searches\RuntimeBroker.exe
  "C:\Users\Admin\Searches\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\IME\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\IME\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\My Music\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Documents\My Music\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Videos\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\Videos\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Favorites\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Favorites\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\OneDrive\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\OneDrive\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Searches\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Searches\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Searches\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\addins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\IME\fontdrvhost.exe
"C:\Windows\IME\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Users\Admin\OneDrive\Registry.exe
"C:\Users\Admin\OneDrive\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\addins\RuntimeBroker.exe
"C:\Windows\addins\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Users\Public\Documents\My Music\dwm.exe
"C:\Users\Public\Documents\My Music\dwm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\Migration\WTR\taskhostw.exe
"C:\Windows\Migration\WTR\taskhostw.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe
"C:\Windows\DigitalLocker\en-US\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Users\Public\Videos\backgroundTaskHost.exe
"C:\Users\Public\Videos\backgroundTaskHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Users\Admin\Searches\RuntimeBroker.exe
"C:\Users\Admin\Searches\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe
"C:\Program Files (x86)\Windows Defender\es-ES\SearchApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Users\Admin\Favorites\WUDFHost.exe
"C:\Users\Admin\Favorites\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Recovery\WindowsRE\csrss.exe
"C:\Recovery\WindowsRE\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

taskhostw.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\taskhostw.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 c604c709aa50f7f59c87b4420713c8563bc5b80d9bce8f812d26e0a7c25d13f7
MD5 2cb0c163f92e343cbfa657ce4d842fb6
SHA1 0299696d7430f09f9e3d32aa5b95f01363b405f5
SHA512 780353a0fa086a96d6b186a4f38160b0521e972ccfa18803db64ecd2ef6d3c1c69ea4dba0b557f1cf7c1ff6ab8720e447e827c92549b6aea5a0ecacd0494b8d8
TLSH
T14E112223F38C8921CC96163A509DAC5172B586CB81AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 db908d6ae1a8ae3e77e93332eaa24f8316aa9e65285996439d35a133024e1a63
MD5 94f35f261590c8add6967ae13ee05fab
SHA1 e0e5828e2c4b7d1937fde13dbfcc63f59c1899c7
SHA512 3e3438bc5e8dfe738d8cf374d444f9f8600cadac6071708426b7852d3a84f0363f79ae6895f11206b5c7fbb8c850725318196c4171112634cfef3d2d70d1e8fb
TLSH
T116112227F38C8921CC96163A509DAC5172B586CB91AEDF9F7FC0C210A1BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 cf8f4a84a53607b45f9dfed75c34776b03777d64ac3c44112ccc5638957557d8
MD5 56addce8ad0788fa7ed121c8239f965f
SHA1 ac9482a712ad866d8d8ba241489613344883ba32
SHA512 ecb98df46c6ccec6e9f401f1c8456b26cf38afe82e2bea885c8dc10619fcbaba9e89432f055b1bdbcce40254b06b1e20e330ea4ac724e4f0c673a5697c548521
TLSH
T161112223F38C8921CC96163A509DAC5172B586CB91AEDF9F7FC0C210A1BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d8ce1dc945725e1a003fcad77de1db795d498003228c088506d286c613cd2e31
MD5 414d3c7be38a289ed476cbb4ac51ae02
SHA1 da5113d85edeefb5a20093e40bb548356316f3d4
SHA512 a6db753e6e9515ad845b8073e725b2d0182697c6dd77475291aefd19e7331d78039c00b9d41ee8cccfabe9a2e0e2ab25753ebf9a865c4a3c18d77ee27cbbae93
TLSH
T17B112223F38C8921CC961A3A509DAC5172B586CB81AEDF9F7FC0C210A5BF984CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wyvizf4r.nsq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wyvizf4r.nsq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

backgroundTaskHost.exe

Path C:\Users\Public\Videos\backgroundTaskHost.exe
Size 1.3MB
SHA256 45984cc61e76697cbaaa208580b6f50ab4f2033b817aff01d0d824253385bf83
MD5 f67c67bdda4cdaa19d82bd08cee5357b
SHA1 9db72665a31458416b1de5171322db6f884b0dbc
SHA512 9013c1823b8948d463204acafe3333f4b0148dd4edd04aef21ae3b56ce9bb86abf4a8c89789dc677bc681b54327050b354ed41857e992ce7514d1a1de791500a
SSDEEP 12288:ON2N7N9FS18IHXlakldxx04Y6CVZ2ms78SZVACKDG4Ps4Em8V0w6akNDaIVAdPQd:ON2NcJlDxPFXZ5yl+06W7BQZxpuztRt
TLSH
T1BC5530342EEA102AF173BF7D8AE47596DA5EBAA33707985D10B103C60723A42DDD153E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-6-0x00000000027D0000-0x00000000027E6000-memory.dmp

Download

memory/1288-24-0x000000001C510000-0x000000001C51C000-memory.dmp

Download

memory/1288-10-0x000000001B340000-0x000000001B34A000-memory.dmp

Download

memory/1288-11-0x000000001B350000-0x000000001B358000-memory.dmp

Download

memory/1288-12-0x000000001B360000-0x000000001B36C000-memory.dmp

Download

memory/1288-13-0x000000001C350000-0x000000001C362000-memory.dmp

Download

memory/1288-14-0x000000001CBA0000-0x000000001D0C8000-memory.dmp

Download

memory/1288-16-0x000000001C390000-0x000000001C39C000-memory.dmp

Download

memory/1288-15-0x000000001C380000-0x000000001C388000-memory.dmp

Download

memory/1288-17-0x000000001C3A0000-0x000000001C3AC000-memory.dmp

Download

memory/1288-18-0x000000001C4B0000-0x000000001C4B8000-memory.dmp

Download

memory/1288-19-0x000000001C4C0000-0x000000001C4CE000-memory.dmp

Download

memory/1288-21-0x000000001C4E0000-0x000000001C4EC000-memory.dmp

Download

memory/1288-23-0x000000001C500000-0x000000001C50A000-memory.dmp

Download

memory/1288-20-0x000000001C4D0000-0x000000001C4D8000-memory.dmp

Download

memory/1288-0-0x0000000000550000-0x00000000006AA000-memory.dmp

Download

memory/1288-22-0x000000001C4F0000-0x000000001C4F8000-memory.dmp

Download

memory/1288-25-0x0000000000E70000-0x0000000000E80000-memory.dmp

Download

memory/1288-28-0x0000000000E70000-0x0000000000E80000-memory.dmp

Download

memory/1288-8-0x000000001B320000-0x000000001B328000-memory.dmp

Download

memory/1288-130-0x0000000000E70000-0x0000000000E80000-memory.dmp

Download

memory/1288-1-0x0000000000E70000-0x0000000000E80000-memory.dmp

Download

memory/1288-9-0x000000001B330000-0x000000001B340000-memory.dmp

Download

memory/1288-7-0x00000000027F0000-0x00000000027F8000-memory.dmp

Download

memory/1288-5-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

Download

memory/1288-4-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Download

memory/1288-3-0x000000001C300000-0x000000001C350000-memory.dmp

Download

memory/1288-2-0x0000000000E80000-0x0000000000E9C000-memory.dmp

Download

memory/2108-141-0x000001F34B580000-0x000001F34B5A2000-memory.dmp

Download