colibri | 4faa19632922332b8aedd25006c9c3349bcb9f2bf24bf116857258a7769efbf0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
06cb1bb9f65f954677aa5e66cfecad10.exe
Size 4.9MB
Sample221014-yd3yrsecfj
SHA256 4faa19632922332b8aedd25006c9c3349bcb9f2bf24bf116857258a7769efbf0
MD5 06cb1bb9f65f954677aa5e66cfecad10
SHA1 7226decd411a371d2727b8b6742f578425b0a7c2
SHA512 ea81cca73a9abad99666e974ae73b9cc38d19fa666b0914d518dee731eab4ed2ed3b7797f453db2f0f22ce6cdc2866591ac0cc56aa01d7530b29e30da8cc098b
SSDEEP 49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri dcrat build1 evasion infostealer loader rat spyware stealer trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	4220	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	4220	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	4220	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4220	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4180	4220	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	4220	schtasks.exe	82

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	06cb1bb9f65f954677aa5e66cfecad10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	06cb1bb9f65f954677aa5e66cfecad10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	06cb1bb9f65f954677aa5e66cfecad10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe

Executes dropped EXE 7 IoCs

pid	Process
3604	tmpF8BC.tmp.exe
204	tmpF8BC.tmp.exe
4500	tmpF8BC.tmp.exe
3600	tmpF8BC.tmp.exe
3472	wininit.exe
260	tmp972F.tmp.exe
3244	tmp972F.tmp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	06cb1bb9f65f954677aa5e66cfecad10.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wininit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	06cb1bb9f65f954677aa5e66cfecad10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	06cb1bb9f65f954677aa5e66cfecad10.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ipinfo.io
34	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4500 set thread context of 3600	4500	tmpF8BC.tmp.exe	92
PID 260 set thread context of 3244	260	tmp972F.tmp.exe	124

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\ShellComponents\56085415360792	06cb1bb9f65f954677aa5e66cfecad10.exe
File opened for modification	C:\Windows\ShellComponents\RCX10B.tmp	06cb1bb9f65f954677aa5e66cfecad10.exe
File created	C:\Windows\System\Speech\fontdrvhost.exe	06cb1bb9f65f954677aa5e66cfecad10.exe
File created	C:\Windows\ShellComponents\wininit.exe	06cb1bb9f65f954677aa5e66cfecad10.exe
File opened for modification	C:\Windows\ShellComponents\wininit.exe	06cb1bb9f65f954677aa5e66cfecad10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4180	schtasks.exe
3884	schtasks.exe
2020	schtasks.exe
3556	schtasks.exe
2300	schtasks.exe
5036	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	06cb1bb9f65f954677aa5e66cfecad10.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	wininit.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
4648	06cb1bb9f65f954677aa5e66cfecad10.exe
4648	06cb1bb9f65f954677aa5e66cfecad10.exe
4648	06cb1bb9f65f954677aa5e66cfecad10.exe
4648	06cb1bb9f65f954677aa5e66cfecad10.exe
4648	06cb1bb9f65f954677aa5e66cfecad10.exe
808	powershell.exe
808	powershell.exe
968	powershell.exe
968	powershell.exe
4324	powershell.exe
4324	powershell.exe
900	powershell.exe
900	powershell.exe
760	powershell.exe
760	powershell.exe
1852	powershell.exe
1852	powershell.exe
1844	powershell.exe
1844	powershell.exe
3296	powershell.exe
3296	powershell.exe
1316	powershell.exe
1316	powershell.exe
2848	powershell.exe
2848	powershell.exe
2528	powershell.exe
2528	powershell.exe
1956	powershell.exe
1956	powershell.exe
808	powershell.exe
808	powershell.exe
968	powershell.exe
900	powershell.exe
4324	powershell.exe
760	powershell.exe
1852	powershell.exe
1316	powershell.exe
1844	powershell.exe
3296	powershell.exe
2848	powershell.exe
2528	powershell.exe
1956	powershell.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe
3472	wininit.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	06cb1bb9f65f954677aa5e66cfecad10.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	3472	wininit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3472	wininit.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3604	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	81
PID 4648 wrote to memory of 3604	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	81
PID 4648 wrote to memory of 3604	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	81
PID 3604 wrote to memory of 204	3604	tmpF8BC.tmp.exe	90
PID 3604 wrote to memory of 204	3604	tmpF8BC.tmp.exe	90
PID 3604 wrote to memory of 204	3604	tmpF8BC.tmp.exe	90
PID 204 wrote to memory of 4500	204	tmpF8BC.tmp.exe	91
PID 204 wrote to memory of 4500	204	tmpF8BC.tmp.exe	91
PID 204 wrote to memory of 4500	204	tmpF8BC.tmp.exe	91
PID 4500 wrote to memory of 3600	4500	tmpF8BC.tmp.exe	92
PID 4500 wrote to memory of 3600	4500	tmpF8BC.tmp.exe	92
PID 4500 wrote to memory of 3600	4500	tmpF8BC.tmp.exe	92
PID 4500 wrote to memory of 3600	4500	tmpF8BC.tmp.exe	92
PID 4500 wrote to memory of 3600	4500	tmpF8BC.tmp.exe	92
PID 4500 wrote to memory of 3600	4500	tmpF8BC.tmp.exe	92
PID 4500 wrote to memory of 3600	4500	tmpF8BC.tmp.exe	92
PID 4648 wrote to memory of 808	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	93
PID 4648 wrote to memory of 808	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	93
PID 4648 wrote to memory of 760	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	94
PID 4648 wrote to memory of 760	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	94
PID 4648 wrote to memory of 968	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	98
PID 4648 wrote to memory of 968	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	98
PID 4648 wrote to memory of 900	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	97
PID 4648 wrote to memory of 900	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	97
PID 4648 wrote to memory of 1852	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	100
PID 4648 wrote to memory of 1852	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	100
PID 4648 wrote to memory of 4324	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	101
PID 4648 wrote to memory of 4324	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	101
PID 4648 wrote to memory of 1844	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	104
PID 4648 wrote to memory of 1844	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	104
PID 4648 wrote to memory of 3296	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	105
PID 4648 wrote to memory of 3296	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	105
PID 4648 wrote to memory of 2848	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	111
PID 4648 wrote to memory of 2848	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	111
PID 4648 wrote to memory of 1316	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	108
PID 4648 wrote to memory of 1316	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	108
PID 4648 wrote to memory of 1956	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	109
PID 4648 wrote to memory of 1956	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	109
PID 4648 wrote to memory of 2528	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	114
PID 4648 wrote to memory of 2528	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	114
PID 4648 wrote to memory of 3472	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	117
PID 4648 wrote to memory of 3472	4648	06cb1bb9f65f954677aa5e66cfecad10.exe	117
PID 3472 wrote to memory of 260	3472	wininit.exe	122
PID 3472 wrote to memory of 260	3472	wininit.exe	122
PID 3472 wrote to memory of 260	3472	wininit.exe	122
PID 260 wrote to memory of 3244	260	tmp972F.tmp.exe	124
PID 260 wrote to memory of 3244	260	tmp972F.tmp.exe	124
PID 260 wrote to memory of 3244	260	tmp972F.tmp.exe	124
PID 260 wrote to memory of 3244	260	tmp972F.tmp.exe	124
PID 260 wrote to memory of 3244	260	tmp972F.tmp.exe	124
PID 260 wrote to memory of 3244	260	tmp972F.tmp.exe	124
PID 260 wrote to memory of 3244	260	tmp972F.tmp.exe	124
PID 3472 wrote to memory of 2364	3472	wininit.exe	128
PID 3472 wrote to memory of 2364	3472	wininit.exe	128
PID 3472 wrote to memory of 4028	3472	wininit.exe	129
PID 3472 wrote to memory of 4028	3472	wininit.exe	129

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	06cb1bb9f65f954677aa5e66cfecad10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	06cb1bb9f65f954677aa5e66cfecad10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	06cb1bb9f65f954677aa5e66cfecad10.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe

C:\Users\Admin\AppData\Local\Temp\06cb1bb9f65f954677aa5e66cfecad10.exe
"C:\Users\Admin\AppData\Local\Temp\06cb1bb9f65f954677aa5e66cfecad10.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4648
- C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmpF8BC.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:3600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\ShellComponents\wininit.exe
  "C:\Windows\ShellComponents\wininit.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp972F.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:3244
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6b25c67-b63c-4af4-9af3-82aafaaf80a0.vbs"
    3⤵
    PID:2364
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf54d50b-189e-4011-b8e0-4238d33b324a.vbs"
    3⤵
    PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\ShellComponents\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\ShellComponents\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellComponents\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\My Documents\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download