Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 22:56
Behavioral task
behavioral1
Sample
119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe
Resource
win10v2004-20220901-en
General
-
Target
119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe
-
Size
1.3MB
-
MD5
9ef31ccf1aae9382bf05defe3e67e8e9
-
SHA1
d2ed1b863682c62220ad1f1243958be628e8cd76
-
SHA256
119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c
-
SHA512
bd1a4e0a8c5fe56a2db45357763b4295094cf0994dec984a4a011982cc58f4692528b83a195bcaaaf8959f57a389fd6f2496c5a47d94269d498b42f0c374aeb6
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4512 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3208 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1084 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4616 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4496 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 216 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 672 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4824 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1572 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4220 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3888 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2264 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1120 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4312 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 844 3108 schtasks.exe 55 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 3108 schtasks.exe 55 -
resource yara_rule behavioral1/files/0x0002000000022df7-137.dat dcrat behavioral1/files/0x0002000000022df7-138.dat dcrat behavioral1/memory/1872-139-0x0000000000410000-0x0000000000520000-memory.dmp dcrat behavioral1/files/0x0001000000022e10-187.dat dcrat behavioral1/files/0x0001000000022e10-188.dat dcrat -
Executes dropped EXE 2 IoCs
pid Process 1872 DllCommonsvc.exe 784 RuntimeBroker.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\55b276f4edf653 DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Temp\c82b8037eab33d DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\088424020bedd6 DllCommonsvc.exe File created C:\Program Files\VideoLAN\wininit.exe DllCommonsvc.exe File opened for modification C:\Program Files\VideoLAN\wininit.exe DllCommonsvc.exe File created C:\Program Files\VideoLAN\56085415360792 DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Temp\WaaSMedicAgent.exe DllCommonsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Performance\WinSAT\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\Performance\WinSAT\9e8d7a4ca61bd9 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3700 schtasks.exe 4372 schtasks.exe 216 schtasks.exe 4220 schtasks.exe 4312 schtasks.exe 4512 schtasks.exe 1084 schtasks.exe 5060 schtasks.exe 844 schtasks.exe 4616 schtasks.exe 4496 schtasks.exe 3888 schtasks.exe 2264 schtasks.exe 672 schtasks.exe 4824 schtasks.exe 3916 schtasks.exe 3472 schtasks.exe 3208 schtasks.exe 1768 schtasks.exe 4660 schtasks.exe 1120 schtasks.exe 2752 schtasks.exe 4760 schtasks.exe 1572 schtasks.exe 2932 schtasks.exe 2288 schtasks.exe 1772 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings DllCommonsvc.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 1872 DllCommonsvc.exe 4772 powershell.exe 4772 powershell.exe 4252 powershell.exe 4252 powershell.exe 3112 powershell.exe 3112 powershell.exe 4500 powershell.exe 4500 powershell.exe 2036 powershell.exe 2036 powershell.exe 4756 powershell.exe 4756 powershell.exe 972 powershell.exe 972 powershell.exe 3288 powershell.exe 3288 powershell.exe 3156 powershell.exe 3156 powershell.exe 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe 4772 powershell.exe 4772 powershell.exe 4252 powershell.exe 4756 powershell.exe 4500 powershell.exe 2036 powershell.exe 3112 powershell.exe 3288 powershell.exe 3156 powershell.exe 972 powershell.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe 784 RuntimeBroker.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 784 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1872 DllCommonsvc.exe Token: SeDebugPrivilege 4772 powershell.exe Token: SeDebugPrivilege 4252 powershell.exe Token: SeDebugPrivilege 3112 powershell.exe Token: SeDebugPrivilege 4500 powershell.exe Token: SeDebugPrivilege 2036 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeDebugPrivilege 972 powershell.exe Token: SeDebugPrivilege 3288 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeDebugPrivilege 1604 powershell.exe Token: SeDebugPrivilege 784 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4384 wrote to memory of 4048 4384 119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe 81 PID 4384 wrote to memory of 4048 4384 119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe 81 PID 4384 wrote to memory of 4048 4384 119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe 81 PID 4048 wrote to memory of 1956 4048 WScript.exe 85 PID 4048 wrote to memory of 1956 4048 WScript.exe 85 PID 4048 wrote to memory of 1956 4048 WScript.exe 85 PID 1956 wrote to memory of 1872 1956 cmd.exe 87 PID 1956 wrote to memory of 1872 1956 cmd.exe 87 PID 1872 wrote to memory of 4252 1872 DllCommonsvc.exe 116 PID 1872 wrote to memory of 4252 1872 DllCommonsvc.exe 116 PID 1872 wrote to memory of 4772 1872 DllCommonsvc.exe 122 PID 1872 wrote to memory of 4772 1872 DllCommonsvc.exe 122 PID 1872 wrote to memory of 4500 1872 DllCommonsvc.exe 118 PID 1872 wrote to memory of 4500 1872 DllCommonsvc.exe 118 PID 1872 wrote to memory of 4756 1872 DllCommonsvc.exe 119 PID 1872 wrote to memory of 4756 1872 DllCommonsvc.exe 119 PID 1872 wrote to memory of 3112 1872 DllCommonsvc.exe 123 PID 1872 wrote to memory of 3112 1872 DllCommonsvc.exe 123 PID 1872 wrote to memory of 2036 1872 DllCommonsvc.exe 124 PID 1872 wrote to memory of 2036 1872 DllCommonsvc.exe 124 PID 1872 wrote to memory of 3156 1872 DllCommonsvc.exe 126 PID 1872 wrote to memory of 3156 1872 DllCommonsvc.exe 126 PID 1872 wrote to memory of 3288 1872 DllCommonsvc.exe 128 PID 1872 wrote to memory of 3288 1872 DllCommonsvc.exe 128 PID 1872 wrote to memory of 972 1872 DllCommonsvc.exe 131 PID 1872 wrote to memory of 972 1872 DllCommonsvc.exe 131 PID 1872 wrote to memory of 1604 1872 DllCommonsvc.exe 132 PID 1872 wrote to memory of 1604 1872 DllCommonsvc.exe 132 PID 1872 wrote to memory of 456 1872 DllCommonsvc.exe 136 PID 1872 wrote to memory of 456 1872 DllCommonsvc.exe 136 PID 456 wrote to memory of 1508 456 cmd.exe 138 PID 456 wrote to memory of 1508 456 cmd.exe 138 PID 456 wrote to memory of 784 456 cmd.exe 141 PID 456 wrote to memory of 784 456 cmd.exe 141
Processes
-
C:\Users\Admin\AppData\Local\Temp\119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe"C:\Users\Admin\AppData\Local\Temp\119d7f9dd6bba42d28b8911292e77bea666dee2ec920c93eaf81712a0752103c.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Temp\WaaSMedicAgent.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\wininit.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\OfficeClickToRun.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YaGsWAAxf1.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:1508
-
-
C:\Windows\Performance\WinSAT\RuntimeBroker.exe"C:\Windows\Performance\WinSAT\RuntimeBroker.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Temp\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\Temp\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\providercommon\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Public\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Public\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Public\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\WinSAT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2288
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
212B
MD5da2fa77b7e7d872d490a966be9a304ed
SHA1bf26dda4d5ca693c487aaa66ed735cc2e8553386
SHA2567f3b831de302b64bc67c979e4b3d653c4999f2f7a7edb4bc49c0e0f9c2967fda
SHA51252a5a01b8e45c90c4dfd57f025a6ac670e91ffc731f44a2d78b4264f4f35bd87a6788c48c5c6dc6b85d4b553af64e3566be238371af0dfcfd10af240997aae3b
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478