92ce94c4f305c473e5267ba28deb3dbcf375159176cd8f2b2c4df4341acef4ee

Analysis

max time kernel
4294183s
max time network
125s
platform
windows7_x64
resource
win7-20220311-en
submitted
13/04/2022, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1bead224c9147140d8c7b403e4d1f2f.exe
Size 1.3MB
Sample220413-cp5e3sdhd4
SHA256 92ce94c4f305c473e5267ba28deb3dbcf375159176cd8f2b2c4df4341acef4ee
MD5 a1bead224c9147140d8c7b403e4d1f2f
SHA1 8adf7067bbff2e980a853d9f22a45aa81045320a
SHA512 5612114d04c37b00db5601a395108ebc98e420de66b43c7af0e5a543d259818cc2c02f1217dbfe32714818b02207af266395ae329e9bf53416d113719bc242dd
MD5 SHA1 SHA512

Score

10^/10

persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\csrss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\\winlogon.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\\winlogon.exe\", \"C:\\Users\\Public\\Documents\\My Pictures\\smss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\\winlogon.exe\", \"C:\\Users\\Public\\Documents\\My Pictures\\smss.exe\", \"C:\\Windows\\inf\\.NET CLR Networking\\0000\\services.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\csrss.exe\", \"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\", \"C:\\Recovery\\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\\winlogon.exe\", \"C:\\Users\\Public\\Documents\\My Pictures\\smss.exe\", \"C:\\Windows\\inf\\.NET CLR Networking\\0000\\services.exe\", \"C:\\ProgramData\\Favorites\\winlogon.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	440	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1832	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1172	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1140	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	916	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	656	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	656	schtasks.exe	27

Executes dropped EXE 1 IoCs

pid	Process
372	services.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\csrss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\MSBuild\\spoolsv.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\\winlogon.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Documents\\My Pictures\\smss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Windows\\inf\\.NET CLR Networking\\0000\\services.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\ProgramData\\Favorites\\winlogon.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\spoolsv.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX8087.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX80F6.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCX8376.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files (x86)\MSBuild\spoolsv.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files (x86)\MSBuild\RCX83E4.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\886983d96e3d3e	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Program Files (x86)\MSBuild\f3b6ecef712a24	a1bead224c9147140d8c7b403e4d1f2f.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\diagnostics\index\dwm.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Windows\inf\.NET CLR Networking\0000\services.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Windows\inf\.NET CLR Networking\0000\c5b4cb5e9653cc	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking\0000\RCX8C23.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking\0000\RCX8C92.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking\0000\services.exe	a1bead224c9147140d8c7b403e4d1f2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	372	WerFault.exe	52

Creates scheduled task(s) 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
440	schtasks.exe
1200	schtasks.exe
1140	schtasks.exe
916	schtasks.exe
1644	schtasks.exe
1784	schtasks.exe
1532	schtasks.exe
628	schtasks.exe
1616	schtasks.exe
1832	schtasks.exe
1172	schtasks.exe
1116	schtasks.exe
1760	schtasks.exe
1376	schtasks.exe
1492	schtasks.exe
1816	schtasks.exe
1596	schtasks.exe
1840	schtasks.exe
704	schtasks.exe
676	schtasks.exe
1224	schtasks.exe
1600	schtasks.exe
1740	schtasks.exe
1064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
840	a1bead224c9147140d8c7b403e4d1f2f.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe
372	services.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	840	a1bead224c9147140d8c7b403e4d1f2f.exe
Token: SeDebugPrivilege	372	services.exe
Token: SeBackupPrivilege	1556	vssvc.exe
Token: SeRestorePrivilege	1556	vssvc.exe
Token: SeAuditPrivilege	1556	vssvc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 372	840	a1bead224c9147140d8c7b403e4d1f2f.exe	52
PID 840 wrote to memory of 372	840	a1bead224c9147140d8c7b403e4d1f2f.exe	52
PID 840 wrote to memory of 372	840	a1bead224c9147140d8c7b403e4d1f2f.exe	52
PID 372 wrote to memory of 1100	372	services.exe	58
PID 372 wrote to memory of 1100	372	services.exe	58
PID 372 wrote to memory of 1100	372	services.exe	58

C:\Users\Admin\AppData\Local\Temp\a1bead224c9147140d8c7b403e4d1f2f.exe
"C:\Users\Admin\AppData\Local\Temp\a1bead224c9147140d8c7b403e4d1f2f.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\inf\.NET CLR Networking\0000\services.exe
  "C:\Windows\inf\.NET CLR Networking\0000\services.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 372 -s 892
    3⤵
    - Program crash
    PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONSTART /tr "'C:\Program Files (x86)\MSBuild\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 5 /tr "'C:\Recovery\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONSTART /tr "'C:\Recovery\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\4d4ae842-a16e-11ec-a3b9-b9f5cc8293ef\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Documents\My Pictures\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Pictures\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONSTART /tr "'C:\Users\Public\Documents\My Pictures\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Documents\My Pictures\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc MINUTE /mo 12 /tr "'C:\Windows\inf\.NET CLR Networking\0000\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\inf\.NET CLR Networking\0000\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONSTART /tr "'C:\Windows\inf\.NET CLR Networking\0000\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\inf\.NET CLR Networking\0000\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 6 /tr "'C:\ProgramData\Favorites\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\ProgramData\Favorites\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONSTART /tr "'C:\ProgramData\Favorites\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\ProgramData\Favorites\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

services.exe

Path C:\Windows\inf\.NET CLR Networking\0000\services.exe
Size 1.3MB
SHA256 0c19cde94ef836aed8a458efd4d1ea94963d3a40424fd9764de3a21794c06d23
MD5 0f3ba3393e8d6ff4356ef4a92e4b2f4e
SHA1 e5c4cdf61b0753b9c26a201ed1dd689819664060
SHA512 21203a2d77da21526a0371da59569ed5ef40c4a605a72b968fdc604e6cbed5ee0adf48cf66d531d0243354927a5fb99fc593f85ceb33fe24fc44e219de583037
SSDEEP 24576:9Q/uxY9zm6xWaaTW3icQadL7AvlwQzZi41EzG7zBY:KoYBRZ3i4iviQzD1EzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

services.exe

Path C:\Windows\inf\.NET CLR Networking\0000\services.exe
Size 1.3MB
SHA256 0c19cde94ef836aed8a458efd4d1ea94963d3a40424fd9764de3a21794c06d23
MD5 0f3ba3393e8d6ff4356ef4a92e4b2f4e
SHA1 e5c4cdf61b0753b9c26a201ed1dd689819664060
SHA512 21203a2d77da21526a0371da59569ed5ef40c4a605a72b968fdc604e6cbed5ee0adf48cf66d531d0243354927a5fb99fc593f85ceb33fe24fc44e219de583037
SSDEEP 24576:9Q/uxY9zm6xWaaTW3icQadL7AvlwQzZi41EzG7zBY:KoYBRZ3i4iviQzD1EzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/372-71-0x000000001AEC6000-0x000000001AEE5000-memory.dmp

Download

memory/372-70-0x00000000008D0000-0x00000000008E2000-memory.dmp

Download

memory/372-69-0x000000001AEC0000-0x000000001AEC2000-memory.dmp

Download

memory/372-68-0x0000000001190000-0x00000000012DA000-memory.dmp

Download

memory/840-58-0x00000000006D0000-0x00000000006D8000-memory.dmp

Download

memory/840-62-0x0000000002050000-0x000000000205C000-memory.dmp

Download

memory/840-63-0x000000001B0B0000-0x000000001B0B2000-memory.dmp

Download

memory/840-64-0x000000001B0B6000-0x000000001B0D5000-memory.dmp

Download

memory/840-61-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Download

memory/840-60-0x00000000008B0000-0x00000000008BC000-memory.dmp

Download

memory/840-59-0x00000000006E0000-0x00000000006F2000-memory.dmp

Download

memory/840-54-0x00000000001A0000-0x00000000002EA000-memory.dmp

Download

memory/840-57-0x00000000004B0000-0x00000000004C0000-memory.dmp

Download

memory/840-56-0x00000000006B0000-0x00000000006CC000-memory.dmp

Download

memory/840-55-0x0000000000490000-0x0000000000498000-memory.dmp

Download