colibri | 9f487d16cd0e0548b6bde75853d0cfcd4eb9362f61d101ce55740781e3e04b2d

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1fb476576bd4aeb366aa82b6240ff2e8.exe
Size 4.9MB
Sample221014-3ettpsehbq
SHA256 9f487d16cd0e0548b6bde75853d0cfcd4eb9362f61d101ce55740781e3e04b2d
MD5 1fb476576bd4aeb366aa82b6240ff2e8
SHA1 5ae8fba07122131f385bda0274967713d52057db
SHA512 360fcce899a22c55235078e3a72fe765fdedfeb9fc2effb3851dd629ea372440ca471dbe748a9e23ad41a3015c372f27a28c239c83abb186024b8c19026ebaa6
SSDEEP 49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri dcrat build1 evasion infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4900	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1704	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	476	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3164	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	704	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2056	schtasks.exe	12
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	2056	schtasks.exe	12

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1fb476576bd4aeb366aa82b6240ff2e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1fb476576bd4aeb366aa82b6240ff2e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1fb476576bd4aeb366aa82b6240ff2e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sppsvc.exe

Executes dropped EXE 5 IoCs

pid	Process
1732	tmpCBA2.tmp.exe
3180	tmpCBA2.tmp.exe
4744	sppsvc.exe
4256	tmpC06.tmp.exe
1360	tmpC06.tmp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	1fb476576bd4aeb366aa82b6240ff2e8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	sppsvc.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	1fb476576bd4aeb366aa82b6240ff2e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1fb476576bd4aeb366aa82b6240ff2e8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sppsvc.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ipinfo.io
33	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1732 set thread context of 3180	1732	tmpCBA2.tmp.exe	111
PID 4256 set thread context of 1360	4256	tmpC06.tmp.exe	156

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe
File created	C:\Program Files\Windows Mail\dllhost.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe
File created	C:\Program Files\Windows Mail\5940a34987c991	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RCXD289.tmp	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Program Files\Windows Mail\RCXDCED.tmp	1fb476576bd4aeb366aa82b6240ff2e8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\9e8d7a4ca61bd9	1fb476576bd4aeb366aa82b6240ff2e8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\smss.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\69ddcba757bf72	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Program Files\Windows Mail\dllhost.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\RCXE50F.tmp	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\smss.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ShellExperiences\OfficeClickToRun.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe
File created	C:\Windows\ShellExperiences\e6c9b481da804f	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Windows\ShellExperiences\RCXE27D.tmp	1fb476576bd4aeb366aa82b6240ff2e8.exe
File opened for modification	C:\Windows\ShellExperiences\OfficeClickToRun.exe	1fb476576bd4aeb366aa82b6240ff2e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1408	schtasks.exe
4840	schtasks.exe
2844	schtasks.exe
1704	schtasks.exe
476	schtasks.exe
540	schtasks.exe
4888	schtasks.exe
4900	schtasks.exe
4876	schtasks.exe
1636	schtasks.exe
2272	schtasks.exe
3164	schtasks.exe
704	schtasks.exe
4180	schtasks.exe
4804	schtasks.exe
2412	schtasks.exe
3760	schtasks.exe
1080	schtasks.exe
5080	schtasks.exe
1564	schtasks.exe
2252	schtasks.exe
1664	schtasks.exe
1592	schtasks.exe
852	schtasks.exe
2140	schtasks.exe
4908	schtasks.exe
4080	schtasks.exe
1964	schtasks.exe
2100	schtasks.exe
4444	schtasks.exe
2916	schtasks.exe
3020	schtasks.exe
4576	schtasks.exe
2684	schtasks.exe
2064	schtasks.exe
2860	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	1fb476576bd4aeb366aa82b6240ff2e8.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	sppsvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
3436	powershell.exe
3336	powershell.exe
3436	powershell.exe
3336	powershell.exe
3448	powershell.exe
3448	powershell.exe
756	powershell.exe
756	powershell.exe
5092	powershell.exe
5092	powershell.exe
1376	powershell.exe
1376	powershell.exe
2420	powershell.exe
2420	powershell.exe
4572	powershell.exe
4572	powershell.exe
2300	powershell.exe
2300	powershell.exe
424	powershell.exe
424	powershell.exe
3712	powershell.exe
3712	powershell.exe
3188	powershell.exe
3188	powershell.exe
2300	powershell.exe
3448	powershell.exe
3448	powershell.exe
3436	powershell.exe
3436	powershell.exe
3336	powershell.exe
3336	powershell.exe
756	powershell.exe
1376	powershell.exe
5092	powershell.exe
5092	powershell.exe
2420	powershell.exe
4572	powershell.exe
424	powershell.exe
3188	powershell.exe
3712	powershell.exe
4744	sppsvc.exe
4744	sppsvc.exe
4744	sppsvc.exe
4744	sppsvc.exe
4744	sppsvc.exe
4744	sppsvc.exe
4744	sppsvc.exe
4744	sppsvc.exe
4744	sppsvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4744	sppsvc.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	424	powershell.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	4744	sppsvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4744	sppsvc.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1732	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	101
PID 1016 wrote to memory of 1732	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	101
PID 1016 wrote to memory of 1732	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	101
PID 1732 wrote to memory of 3180	1732	tmpCBA2.tmp.exe	111
PID 1732 wrote to memory of 3180	1732	tmpCBA2.tmp.exe	111
PID 1732 wrote to memory of 3180	1732	tmpCBA2.tmp.exe	111
PID 1732 wrote to memory of 3180	1732	tmpCBA2.tmp.exe	111
PID 1732 wrote to memory of 3180	1732	tmpCBA2.tmp.exe	111
PID 1732 wrote to memory of 3180	1732	tmpCBA2.tmp.exe	111
PID 1732 wrote to memory of 3180	1732	tmpCBA2.tmp.exe	111
PID 1016 wrote to memory of 3448	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	127
PID 1016 wrote to memory of 3448	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	127
PID 1016 wrote to memory of 3436	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	133
PID 1016 wrote to memory of 3436	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	133
PID 1016 wrote to memory of 3336	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	129
PID 1016 wrote to memory of 3336	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	129
PID 1016 wrote to memory of 1376	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	130
PID 1016 wrote to memory of 1376	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	130
PID 1016 wrote to memory of 5092	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	134
PID 1016 wrote to memory of 5092	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	134
PID 1016 wrote to memory of 756	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	136
PID 1016 wrote to memory of 756	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	136
PID 1016 wrote to memory of 4572	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	138
PID 1016 wrote to memory of 4572	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	138
PID 1016 wrote to memory of 2420	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	140
PID 1016 wrote to memory of 2420	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	140
PID 1016 wrote to memory of 2300	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	141
PID 1016 wrote to memory of 2300	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	141
PID 1016 wrote to memory of 424	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	144
PID 1016 wrote to memory of 424	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	144
PID 1016 wrote to memory of 3712	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	145
PID 1016 wrote to memory of 3712	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	145
PID 1016 wrote to memory of 3188	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	147
PID 1016 wrote to memory of 3188	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	147
PID 1016 wrote to memory of 4744	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	151
PID 1016 wrote to memory of 4744	1016	1fb476576bd4aeb366aa82b6240ff2e8.exe	151
PID 4744 wrote to memory of 4256	4744	sppsvc.exe	152
PID 4744 wrote to memory of 4256	4744	sppsvc.exe	152
PID 4744 wrote to memory of 4256	4744	sppsvc.exe	152
PID 4256 wrote to memory of 1360	4256	tmpC06.tmp.exe	156
PID 4256 wrote to memory of 1360	4256	tmpC06.tmp.exe	156
PID 4256 wrote to memory of 1360	4256	tmpC06.tmp.exe	156
PID 4256 wrote to memory of 1360	4256	tmpC06.tmp.exe	156
PID 4256 wrote to memory of 1360	4256	tmpC06.tmp.exe	156
PID 4256 wrote to memory of 1360	4256	tmpC06.tmp.exe	156
PID 4256 wrote to memory of 1360	4256	tmpC06.tmp.exe	156
PID 4744 wrote to memory of 3804	4744	sppsvc.exe	154
PID 4744 wrote to memory of 3804	4744	sppsvc.exe	154
PID 4744 wrote to memory of 2684	4744	sppsvc.exe	155
PID 4744 wrote to memory of 2684	4744	sppsvc.exe	155

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1fb476576bd4aeb366aa82b6240ff2e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1fb476576bd4aeb366aa82b6240ff2e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1fb476576bd4aeb366aa82b6240ff2e8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sppsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\1fb476576bd4aeb366aa82b6240ff2e8.exe
"C:\Users\Admin\AppData\Local\Temp\1fb476576bd4aeb366aa82b6240ff2e8.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1016
- C:\Users\Admin\AppData\Local\Temp\tmpCBA2.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpCBA2.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\tmpCBA2.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpCBA2.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:3180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\odt\sppsvc.exe
  "C:\odt\sppsvc.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4744
- - C:\Users\Admin\AppData\Local\Temp\tmpC06.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpC06.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\tmpC06.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpC06.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:1360
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\793f3478-55ea-4c1a-815c-774d9b77ef15.vbs"
    3⤵
    PID:3804
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0f1ef14-adbc-4aeb-b23e-e2afc851138e.vbs"
    3⤵
    PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\odt\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\odt\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Application Data\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Application Data\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\odt\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Windows\ShellExperiences\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Windows\ShellExperiences\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\odt\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...