Analysis
-
max time kernel
129s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 22:52
Behavioral task
behavioral1
Sample
336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe
Resource
win10v2004-20220812-en
General
-
Target
336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe
-
Size
1.3MB
-
MD5
edacf8fc9bd46fe0eecc69dc224c771a
-
SHA1
cdd3f00e14add9d82629e71143684178519509c5
-
SHA256
336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0
-
SHA512
7f818a9db084e24181762025380848d07cf5f08fcc4e88d6fe410369112c2c8130397fb1d72b6cea1944f042676c7f8f360d111d0be2af26107ad1b03c4976d2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3428 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1476 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1560 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 316 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2656 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1500 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2472 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3212 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2196 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3248 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4432 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4456 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 380 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4876 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5084 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3320 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4964 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3004 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1492 2604 schtasks.exe 67 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4364 2604 schtasks.exe 67 -
resource yara_rule behavioral1/files/0x0006000000022e6e-137.dat dcrat behavioral1/files/0x0006000000022e6e-138.dat dcrat behavioral1/memory/3208-139-0x0000000000CC0000-0x0000000000DD0000-memory.dmp dcrat behavioral1/files/0x0006000000022e71-191.dat dcrat behavioral1/files/0x0006000000022e71-192.dat dcrat -
Executes dropped EXE 2 IoCs
pid Process 3208 DllCommonsvc.exe 3544 csrss.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Mail\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\55b276f4edf653 DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\debug\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\debug\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Windows\Offline Web Pages\dwm.exe DllCommonsvc.exe File created C:\Windows\Offline Web Pages\6cb0b6c459d5d3 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3028 schtasks.exe 4492 schtasks.exe 1796 schtasks.exe 3248 schtasks.exe 4876 schtasks.exe 220 schtasks.exe 1500 schtasks.exe 1560 schtasks.exe 1868 schtasks.exe 3004 schtasks.exe 4364 schtasks.exe 2096 schtasks.exe 1476 schtasks.exe 2472 schtasks.exe 3212 schtasks.exe 3320 schtasks.exe 4964 schtasks.exe 1492 schtasks.exe 2184 schtasks.exe 1504 schtasks.exe 316 schtasks.exe 2196 schtasks.exe 4432 schtasks.exe 5084 schtasks.exe 3980 schtasks.exe 380 schtasks.exe 3428 schtasks.exe 2468 schtasks.exe 2656 schtasks.exe 4456 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings DllCommonsvc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 3208 DllCommonsvc.exe 376 powershell.exe 376 powershell.exe 4280 powershell.exe 4280 powershell.exe 2484 powershell.exe 2484 powershell.exe 3504 powershell.exe 3504 powershell.exe 1496 powershell.exe 1496 powershell.exe 1800 powershell.exe 1800 powershell.exe 4484 powershell.exe 4484 powershell.exe 4448 powershell.exe 4448 powershell.exe 1204 powershell.exe 1204 powershell.exe 4476 powershell.exe 4476 powershell.exe 4260 powershell.exe 4260 powershell.exe 3504 powershell.exe 4280 powershell.exe 376 powershell.exe 1496 powershell.exe 2484 powershell.exe 1800 powershell.exe 1204 powershell.exe 4484 powershell.exe 4448 powershell.exe 4476 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3544 csrss.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3208 DllCommonsvc.exe Token: SeDebugPrivilege 376 powershell.exe Token: SeDebugPrivilege 4280 powershell.exe Token: SeDebugPrivilege 2484 powershell.exe Token: SeDebugPrivilege 3504 powershell.exe Token: SeDebugPrivilege 1496 powershell.exe Token: SeDebugPrivilege 1800 powershell.exe Token: SeDebugPrivilege 4484 powershell.exe Token: SeDebugPrivilege 4448 powershell.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeDebugPrivilege 4260 powershell.exe Token: SeDebugPrivilege 4476 powershell.exe Token: SeDebugPrivilege 3544 csrss.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4176 wrote to memory of 4336 4176 336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe 81 PID 4176 wrote to memory of 4336 4176 336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe 81 PID 4176 wrote to memory of 4336 4176 336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe 81 PID 4336 wrote to memory of 2116 4336 WScript.exe 85 PID 4336 wrote to memory of 2116 4336 WScript.exe 85 PID 4336 wrote to memory of 2116 4336 WScript.exe 85 PID 2116 wrote to memory of 3208 2116 cmd.exe 87 PID 2116 wrote to memory of 3208 2116 cmd.exe 87 PID 3208 wrote to memory of 4260 3208 DllCommonsvc.exe 119 PID 3208 wrote to memory of 4260 3208 DllCommonsvc.exe 119 PID 3208 wrote to memory of 376 3208 DllCommonsvc.exe 120 PID 3208 wrote to memory of 376 3208 DllCommonsvc.exe 120 PID 3208 wrote to memory of 3504 3208 DllCommonsvc.exe 122 PID 3208 wrote to memory of 3504 3208 DllCommonsvc.exe 122 PID 3208 wrote to memory of 4280 3208 DllCommonsvc.exe 124 PID 3208 wrote to memory of 4280 3208 DllCommonsvc.exe 124 PID 3208 wrote to memory of 1800 3208 DllCommonsvc.exe 125 PID 3208 wrote to memory of 1800 3208 DllCommonsvc.exe 125 PID 3208 wrote to memory of 2484 3208 DllCommonsvc.exe 127 PID 3208 wrote to memory of 2484 3208 DllCommonsvc.exe 127 PID 3208 wrote to memory of 4448 3208 DllCommonsvc.exe 128 PID 3208 wrote to memory of 4448 3208 DllCommonsvc.exe 128 PID 3208 wrote to memory of 1496 3208 DllCommonsvc.exe 129 PID 3208 wrote to memory of 1496 3208 DllCommonsvc.exe 129 PID 3208 wrote to memory of 1204 3208 DllCommonsvc.exe 130 PID 3208 wrote to memory of 1204 3208 DllCommonsvc.exe 130 PID 3208 wrote to memory of 4484 3208 DllCommonsvc.exe 135 PID 3208 wrote to memory of 4484 3208 DllCommonsvc.exe 135 PID 3208 wrote to memory of 4476 3208 DllCommonsvc.exe 136 PID 3208 wrote to memory of 4476 3208 DllCommonsvc.exe 136 PID 3208 wrote to memory of 1952 3208 DllCommonsvc.exe 141 PID 3208 wrote to memory of 1952 3208 DllCommonsvc.exe 141 PID 1952 wrote to memory of 1156 1952 cmd.exe 143 PID 1952 wrote to memory of 1156 1952 cmd.exe 143 PID 1952 wrote to memory of 3544 1952 cmd.exe 146 PID 1952 wrote to memory of 3544 1952 cmd.exe 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe"C:\Users\Admin\AppData\Local\Temp\336f376bf8ddebf6e022f59f386c85af32c727d85836b3c1cafbd7805073e9e0.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\RuntimeBroker.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\StartMenuExperienceHost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Offline Web Pages\dwm.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\Idle.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Pictures\Saved Pictures\dwm.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Rvqx6vHdfc.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1156
-
-
C:\Recovery\WindowsRE\csrss.exe"C:\Recovery\WindowsRE\csrss.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\providercommon\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Windows\Offline Web Pages\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\Offline Web Pages\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Default\My Documents\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\My Documents\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Pictures\Saved Pictures\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Saved Pictures\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Pictures\Saved Pictures\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
196B
MD521bbaf557b758bb6b3360810574eae5f
SHA1cb1e6d177c8b108448e68dff31fd96e10ffc88a5
SHA2564e9723aa31a327d1fcfdc13459767b22e4b2e738c6d4af35cb8812192fbe0a36
SHA512e6c651c497f75cb55bb4fb42ecf8bb20733449570a26a3c1c9e41c632a63a53586986b67898ef692f596d8db8002ab68470e9b6a2b580b137bbe903a10558843
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478