92ce94c4f305c473e5267ba28deb3dbcf375159176cd8f2b2c4df4341acef4ee

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
13/04/2022, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1bead224c9147140d8c7b403e4d1f2f.exe
Size 1.3MB
Sample220413-cp5e3sdhd4
SHA256 92ce94c4f305c473e5267ba28deb3dbcf375159176cd8f2b2c4df4341acef4ee
MD5 a1bead224c9147140d8c7b403e4d1f2f
SHA1 8adf7067bbff2e980a853d9f22a45aa81045320a
SHA512 5612114d04c37b00db5601a395108ebc98e420de66b43c7af0e5a543d259818cc2c02f1217dbfe32714818b02207af266395ae329e9bf53416d113719bc242dd
MD5 SHA1 SHA512

Score

10^/10

persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\csrss.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\csrss.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Pictures\\winlogon.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\csrss.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Pictures\\winlogon.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\services.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\csrss.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Pictures\\winlogon.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\services.exe\", \"C:\\Users\\Admin\\smss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\csrss.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Pictures\\winlogon.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\services.exe\", \"C:\\Users\\Admin\\smss.exe\", \"C:\\Windows\\TAPI\\System.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\csrss.exe\", \"C:\\odt\\StartMenuExperienceHost.exe\", \"C:\\Users\\Public\\Pictures\\winlogon.exe\", \"C:\\Program Files\\Common Files\\DESIGNER\\services.exe\", \"C:\\Users\\Admin\\smss.exe\", \"C:\\Windows\\TAPI\\System.exe\", \"C:\\odt\\System.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\odt\\csrss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe

Process spawned unexpected child process 28 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4476	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4236	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4528	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3276	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	488	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	760	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3156	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	528	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3812	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	4248	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1740	4248	schtasks.exe	80

Executes dropped EXE 1 IoCs

pid	Process
936	smss.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	a1bead224c9147140d8c7b403e4d1f2f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\TAPI\\System.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\odt\\System.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\odt\\StartMenuExperienceHost.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Public\\Pictures\\winlogon.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Common Files\\DESIGNER\\services.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\smss.exe\""	a1bead224c9147140d8c7b403e4d1f2f.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\DESIGNER\c5b4cb5e9653cc	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RCX6E9E.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\RCX6F2B.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\services.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Program Files\Common Files\DESIGNER\services.exe	a1bead224c9147140d8c7b403e4d1f2f.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\TAPI\System.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Windows\TAPI\System.exe	a1bead224c9147140d8c7b403e4d1f2f.exe
File created	C:\Windows\TAPI\27d1bcfc3c54e0	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Windows\TAPI\RCX74CC.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe
File opened for modification	C:\Windows\TAPI\RCX754A.tmp	a1bead224c9147140d8c7b403e4d1f2f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
800	schtasks.exe
1536	schtasks.exe
1360	schtasks.exe
1604	schtasks.exe
1884	schtasks.exe
1220	schtasks.exe
528	schtasks.exe
4728	schtasks.exe
4180	schtasks.exe
4468	schtasks.exe
4528	schtasks.exe
760	schtasks.exe
3956	schtasks.exe
3276	schtasks.exe
3156	schtasks.exe
1272	schtasks.exe
552	schtasks.exe
1744	schtasks.exe
1572	schtasks.exe
3220	schtasks.exe
3812	schtasks.exe
1740	schtasks.exe
4476	schtasks.exe
4236	schtasks.exe
1164	schtasks.exe
1276	schtasks.exe
1356	schtasks.exe
488	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	a1bead224c9147140d8c7b403e4d1f2f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
5048	a1bead224c9147140d8c7b403e4d1f2f.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe
936	smss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
936	smss.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	a1bead224c9147140d8c7b403e4d1f2f.exe
Token: SeDebugPrivilege	936	smss.exe
Token: SeBackupPrivilege	1808	vssvc.exe
Token: SeRestorePrivilege	1808	vssvc.exe
Token: SeAuditPrivilege	1808	vssvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 936	5048	a1bead224c9147140d8c7b403e4d1f2f.exe	113
PID 5048 wrote to memory of 936	5048	a1bead224c9147140d8c7b403e4d1f2f.exe	113

C:\Users\Admin\AppData\Local\Temp\a1bead224c9147140d8c7b403e4d1f2f.exe
"C:\Users\Admin\AppData\Local\Temp\a1bead224c9147140d8c7b403e4d1f2f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\smss.exe
  "C:\Users\Admin\smss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 13 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONSTART /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc MINUTE /mo 8 /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONSTART /tr "'C:\odt\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\odt\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONSTART /tr "'C:\Users\Public\Pictures\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\DESIGNER\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONSTART /tr "'C:\Program Files\Common Files\DESIGNER\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\DESIGNER\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONSTART /tr "'C:\Users\Admin\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\TAPI\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONSTART /tr "'C:\Windows\TAPI\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc MINUTE /mo 6 /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONSTART /tr "'C:\odt\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\odt\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\Users\Admin\smss.exe
Size 1.3MB
SHA256 4dbcfd7f6e119c19502d591b9a8b78ed95a8527fa37629596f84bd0b89a4bded
MD5 96c73940013b06e0675b50a25878de8c
SHA1 b16ee38be7f36e1b9045b88c3aeeccc6e4b4ea15
SHA512 f4e842c316a8f29c68d997412220789e42448e74b3366f6787d410744e278abecc01a6b564e6ae45a2cda75c33ea1a5810992a93e5f48b579c4003b1861e6750
SSDEEP 24576:lQ/uxY9zm6xWaaTW3icQadL7AvlwQzZi41EzG7zBY:ioYBRZ3i4iviQzD1EzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\Users\Admin\smss.exe
Size 1.3MB
SHA256 4dbcfd7f6e119c19502d591b9a8b78ed95a8527fa37629596f84bd0b89a4bded
MD5 96c73940013b06e0675b50a25878de8c
SHA1 b16ee38be7f36e1b9045b88c3aeeccc6e4b4ea15
SHA512 f4e842c316a8f29c68d997412220789e42448e74b3366f6787d410744e278abecc01a6b564e6ae45a2cda75c33ea1a5810992a93e5f48b579c4003b1861e6750
SSDEEP 24576:lQ/uxY9zm6xWaaTW3icQadL7AvlwQzZi41EzG7zBY:ioYBRZ3i4iviQzD1EzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/936-148-0x00007FFB685E0000-0x00007FFB690A1000-memory.dmp

Download

memory/936-147-0x00000000008E0000-0x0000000000A2A000-memory.dmp

Download

memory/5048-140-0x000000001C915000-0x000000001C917000-memory.dmp

Download

memory/5048-134-0x0000000000670000-0x00000000007BA000-memory.dmp

Download

memory/5048-141-0x000000001C917000-0x000000001C919000-memory.dmp

Download

memory/5048-142-0x000000001C919000-0x000000001C91F000-memory.dmp

Download

memory/5048-143-0x000000001E260000-0x000000001E264000-memory.dmp

Download

memory/5048-139-0x000000001C913000-0x000000001C915000-memory.dmp

Download

memory/5048-138-0x000000001D730000-0x000000001DC58000-memory.dmp

Download

memory/5048-137-0x000000001C8B0000-0x000000001C900000-memory.dmp

Download

memory/5048-135-0x00007FFB685E0000-0x00007FFB690A1000-memory.dmp

Download

memory/5048-136-0x000000001C910000-0x000000001C912000-memory.dmp

Download