Analysis
-
max time kernel
88s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11-01-2023 05:01
Behavioral task
behavioral1
Sample
0b0ec65382f89a78a0fe6e8806692b3c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0b0ec65382f89a78a0fe6e8806692b3c.exe
Resource
win10v2004-20221111-en
General
-
Target
0b0ec65382f89a78a0fe6e8806692b3c.exe
-
Size
1.4MB
-
MD5
0b0ec65382f89a78a0fe6e8806692b3c
-
SHA1
c53d487fe509f97d8f25565afa6b93a7ddc5a32d
-
SHA256
025f59dd06ad2bd27f44923788303977c9c35274632bd4a0068a4d2d01faec5f
-
SHA512
7672df5a954cc1be0d507d9e87af0301d70f031ce083b0bb145ba5f45b4de3c5478c27b8f34e8c304e556728e81389c5cde30242f2bb40b3eff7ddbadb0c9c92
-
SSDEEP
24576:DnTvNh6VDOAxsd05hhdshr0SafxxyiDSvGzNlZhlUmbhL:DLNh6ViAxsqr6r0hfqY/lb2
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1624 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 824 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1552 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 736 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 968 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1568 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2000 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 884 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 768 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 240 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1256 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1344 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1484 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1300 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1652 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1988 1360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 588 1360 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/1816-54-0x00000000010F0000-0x000000000125E000-memory.dmp dcrat C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe dcrat C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe dcrat behavioral1/memory/1984-91-0x0000000000FB0000-0x000000000111E000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1984 csrss.exe -
Drops file in Program Files directory 5 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exedescription ioc process File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\69ddcba757bf72 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\RCX6A83.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\RCX6DFD.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\smss.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\smss.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Drops file in Windows directory 10 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.exedescription ioc process File created C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\System.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\TAPI\smss.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\TAPI\smss.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\RCX3E5E.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\System.exe 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\TAPI\RCX7667.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\TAPI\RCX79D2.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\27d1bcfc3c54e0 0b0ec65382f89a78a0fe6e8806692b3c.exe File created C:\Windows\TAPI\69ddcba757bf72 0b0ec65382f89a78a0fe6e8806692b3c.exe File opened for modification C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\RCX3AF3.tmp 0b0ec65382f89a78a0fe6e8806692b3c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 884 schtasks.exe 240 schtasks.exe 1532 schtasks.exe 968 schtasks.exe 736 schtasks.exe 1568 schtasks.exe 1512 schtasks.exe 1344 schtasks.exe 1724 schtasks.exe 948 schtasks.exe 1548 schtasks.exe 1536 schtasks.exe 1484 schtasks.exe 1652 schtasks.exe 1624 schtasks.exe 1740 schtasks.exe 2000 schtasks.exe 768 schtasks.exe 1256 schtasks.exe 1300 schtasks.exe 1988 schtasks.exe 588 schtasks.exe 824 schtasks.exe 1552 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.execsrss.exepid process 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe 1984 csrss.exe 1984 csrss.exe 1984 csrss.exe 1984 csrss.exe 1984 csrss.exe 1984 csrss.exe 1984 csrss.exe 1984 csrss.exe 1984 csrss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.execsrss.exedescription pid process Token: SeDebugPrivilege 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe Token: SeDebugPrivilege 1984 csrss.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
0b0ec65382f89a78a0fe6e8806692b3c.execsrss.exedescription pid process target process PID 1816 wrote to memory of 1172 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1172 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1172 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 992 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 992 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 992 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1672 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1672 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1672 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 368 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 368 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 368 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1624 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1624 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1624 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1456 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1456 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1456 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1476 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1476 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1476 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 2000 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 2000 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 2000 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 424 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 424 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 424 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe powershell.exe PID 1816 wrote to memory of 1984 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe csrss.exe PID 1816 wrote to memory of 1984 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe csrss.exe PID 1816 wrote to memory of 1984 1816 0b0ec65382f89a78a0fe6e8806692b3c.exe csrss.exe PID 1984 wrote to memory of 1668 1984 csrss.exe WScript.exe PID 1984 wrote to memory of 1668 1984 csrss.exe WScript.exe PID 1984 wrote to memory of 1668 1984 csrss.exe WScript.exe PID 1984 wrote to memory of 1636 1984 csrss.exe WScript.exe PID 1984 wrote to memory of 1636 1984 csrss.exe WScript.exe PID 1984 wrote to memory of 1636 1984 csrss.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b0ec65382f89a78a0fe6e8806692b3c.exe"C:\Users\Admin\AppData\Local\Temp\0b0ec65382f89a78a0fe6e8806692b3c.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\0b0ec65382f89a78a0fe6e8806692b3c.exe'2⤵PID:1172
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'2⤵PID:992
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\System.exe'2⤵PID:1672
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\csrss.exe'2⤵PID:368
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\spoolsv.exe'2⤵PID:1624
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'2⤵PID:1456
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\smss.exe'2⤵PID:1476
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\smss.exe'2⤵PID:2000
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\sppsvc.exe'2⤵PID:424
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e023718-f75d-4261-a67f-9c040c310fca.vbs"3⤵PID:1668
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3d36a0d2-2a3b-46ec-ab3b-4b7551233f34.vbs"3⤵PID:1636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\PCHEALTH\ERRORREP\QSIGNOFF\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla\updates\308046B0AF4A39CB\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\TAPI\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\TAPI\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:588
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exeFilesize
1.4MB
MD5bf92b5b35c261c0215e830967e38df18
SHA19e5ce5125225420ea8e394d9ab91bf8eef5754a9
SHA2561aff2414b03aa0802b941a3b3dad45fdab9cb6d2ddfb14c4d2366d52aa910f77
SHA512a8095002ba5bf226dbfd80a64ca102d66c1da21ee062edc40be9fdfa7a043fc5d70945bdd6c4127e8f97b45e0ce42c07d4a9cc35c440b126a81bf84e3d51014c
-
C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exeFilesize
1.4MB
MD5bf92b5b35c261c0215e830967e38df18
SHA19e5ce5125225420ea8e394d9ab91bf8eef5754a9
SHA2561aff2414b03aa0802b941a3b3dad45fdab9cb6d2ddfb14c4d2366d52aa910f77
SHA512a8095002ba5bf226dbfd80a64ca102d66c1da21ee062edc40be9fdfa7a043fc5d70945bdd6c4127e8f97b45e0ce42c07d4a9cc35c440b126a81bf84e3d51014c
-
C:\Users\Admin\AppData\Local\Temp\3d36a0d2-2a3b-46ec-ab3b-4b7551233f34.vbsFilesize
529B
MD5a685210edbd2347a3f068e06a8554627
SHA18ca5603c6ee3d646ccf5dd1f9ac056f205e42360
SHA2566ba0f0b54efa1de5f4bb5b31695a16a4887e398d024c8bdddb446afc43275f4a
SHA5123fd3d1a71ba78b7ae8d01f573df859ad703f28bd39b3a13580fea2f4e65a3cd6e3a1b30583402866051b56db43f5646d59b44f96444bd6a80aac365d821a8412
-
C:\Users\Admin\AppData\Local\Temp\8e023718-f75d-4261-a67f-9c040c310fca.vbsFilesize
753B
MD5454831c49c975d7598552e06e159d787
SHA139f8559290e617bd3098c884c48f26fa723d00ac
SHA25629ae4cf8d57e8e53126be16b2541ca8f6f1cf7f094b3ec38e3f9eb0bf7651fa6
SHA5122a6b243bb6b9c3d0b6829ffa8c0761a941f0e7f7f920f5d36b948696fa2bbd95efecfc8e4de797518612396b1610d159978ac26476ddb1a3ea3545f544f07723
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5fc504f11a3f40f9bbe34dfd3689e1ef4
SHA1548864b3a277204d454383254ee47a9bfd5798ea
SHA25653adc24596ffd2c6cc195b39475ba21c182e582a58735891d4e60d9260b9ce4e
SHA512f5652c28babf2cfcb63aa0e5d8ecf606e47c13c6f2e427f1c5b15bf1bc5fe62948598e7b962973261d1fbc8121d889da808349a766407861f6f29286db39b290
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5fc504f11a3f40f9bbe34dfd3689e1ef4
SHA1548864b3a277204d454383254ee47a9bfd5798ea
SHA25653adc24596ffd2c6cc195b39475ba21c182e582a58735891d4e60d9260b9ce4e
SHA512f5652c28babf2cfcb63aa0e5d8ecf606e47c13c6f2e427f1c5b15bf1bc5fe62948598e7b962973261d1fbc8121d889da808349a766407861f6f29286db39b290
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5fc504f11a3f40f9bbe34dfd3689e1ef4
SHA1548864b3a277204d454383254ee47a9bfd5798ea
SHA25653adc24596ffd2c6cc195b39475ba21c182e582a58735891d4e60d9260b9ce4e
SHA512f5652c28babf2cfcb63aa0e5d8ecf606e47c13c6f2e427f1c5b15bf1bc5fe62948598e7b962973261d1fbc8121d889da808349a766407861f6f29286db39b290
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5fc504f11a3f40f9bbe34dfd3689e1ef4
SHA1548864b3a277204d454383254ee47a9bfd5798ea
SHA25653adc24596ffd2c6cc195b39475ba21c182e582a58735891d4e60d9260b9ce4e
SHA512f5652c28babf2cfcb63aa0e5d8ecf606e47c13c6f2e427f1c5b15bf1bc5fe62948598e7b962973261d1fbc8121d889da808349a766407861f6f29286db39b290
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5fc504f11a3f40f9bbe34dfd3689e1ef4
SHA1548864b3a277204d454383254ee47a9bfd5798ea
SHA25653adc24596ffd2c6cc195b39475ba21c182e582a58735891d4e60d9260b9ce4e
SHA512f5652c28babf2cfcb63aa0e5d8ecf606e47c13c6f2e427f1c5b15bf1bc5fe62948598e7b962973261d1fbc8121d889da808349a766407861f6f29286db39b290
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5fc504f11a3f40f9bbe34dfd3689e1ef4
SHA1548864b3a277204d454383254ee47a9bfd5798ea
SHA25653adc24596ffd2c6cc195b39475ba21c182e582a58735891d4e60d9260b9ce4e
SHA512f5652c28babf2cfcb63aa0e5d8ecf606e47c13c6f2e427f1c5b15bf1bc5fe62948598e7b962973261d1fbc8121d889da808349a766407861f6f29286db39b290
-
memory/368-137-0x000000000284B000-0x000000000286A000-memory.dmpFilesize
124KB
-
memory/368-135-0x000000001B800000-0x000000001BAFF000-memory.dmpFilesize
3.0MB
-
memory/368-136-0x0000000002844000-0x0000000002847000-memory.dmpFilesize
12KB
-
memory/368-134-0x0000000002844000-0x0000000002847000-memory.dmpFilesize
12KB
-
memory/368-66-0x0000000000000000-mapping.dmp
-
memory/368-133-0x000007FEEA300000-0x000007FEEAE5D000-memory.dmpFilesize
11.4MB
-
memory/368-132-0x000007FEEC3D0000-0x000007FEECDF3000-memory.dmpFilesize
10.1MB
-
memory/424-112-0x000007FEEAE60000-0x000007FEEB9BD000-memory.dmpFilesize
11.4MB
-
memory/424-71-0x0000000000000000-mapping.dmp
-
memory/424-111-0x00000000023A4000-0x00000000023A7000-memory.dmpFilesize
12KB
-
memory/424-94-0x000007FEEC3B0000-0x000007FEECDD3000-memory.dmpFilesize
10.1MB
-
memory/424-114-0x000000001B7F0000-0x000000001BAEF000-memory.dmpFilesize
3.0MB
-
memory/424-124-0x00000000023AB000-0x00000000023CA000-memory.dmpFilesize
124KB
-
memory/424-122-0x00000000023A4000-0x00000000023A7000-memory.dmpFilesize
12KB
-
memory/992-118-0x00000000023EB000-0x000000000240A000-memory.dmpFilesize
124KB
-
memory/992-119-0x00000000023E4000-0x00000000023E7000-memory.dmpFilesize
12KB
-
memory/992-120-0x00000000023EB000-0x000000000240A000-memory.dmpFilesize
124KB
-
memory/992-107-0x00000000023E4000-0x00000000023E7000-memory.dmpFilesize
12KB
-
memory/992-102-0x000007FEEAE60000-0x000007FEEB9BD000-memory.dmpFilesize
11.4MB
-
memory/992-83-0x000007FEEC3B0000-0x000007FEECDD3000-memory.dmpFilesize
10.1MB
-
memory/992-64-0x0000000000000000-mapping.dmp
-
memory/1172-125-0x0000000002814000-0x0000000002817000-memory.dmpFilesize
12KB
-
memory/1172-113-0x000000001B760000-0x000000001BA5F000-memory.dmpFilesize
3.0MB
-
memory/1172-63-0x0000000000000000-mapping.dmp
-
memory/1172-128-0x000000000281B000-0x000000000283A000-memory.dmpFilesize
124KB
-
memory/1172-110-0x0000000002814000-0x0000000002817000-memory.dmpFilesize
12KB
-
memory/1172-104-0x000007FEEAE60000-0x000007FEEB9BD000-memory.dmpFilesize
11.4MB
-
memory/1172-98-0x000007FEEC3B0000-0x000007FEECDD3000-memory.dmpFilesize
10.1MB
-
memory/1456-82-0x000007FEEC3B0000-0x000007FEECDD3000-memory.dmpFilesize
10.1MB
-
memory/1456-123-0x00000000027AB000-0x00000000027CA000-memory.dmpFilesize
124KB
-
memory/1456-116-0x000000001B810000-0x000000001BB0F000-memory.dmpFilesize
3.0MB
-
memory/1456-121-0x00000000027A4000-0x00000000027A7000-memory.dmpFilesize
12KB
-
memory/1456-72-0x000007FEFC001000-0x000007FEFC003000-memory.dmpFilesize
8KB
-
memory/1456-103-0x00000000027A4000-0x00000000027A7000-memory.dmpFilesize
12KB
-
memory/1456-68-0x0000000000000000-mapping.dmp
-
memory/1456-101-0x000007FEEAE60000-0x000007FEEB9BD000-memory.dmpFilesize
11.4MB
-
memory/1476-69-0x0000000000000000-mapping.dmp
-
memory/1624-106-0x000007FEEAE60000-0x000007FEEB9BD000-memory.dmpFilesize
11.4MB
-
memory/1624-100-0x000007FEEC3B0000-0x000007FEECDD3000-memory.dmpFilesize
10.1MB
-
memory/1624-130-0x000000000290B000-0x000000000292A000-memory.dmpFilesize
124KB
-
memory/1624-117-0x000000001B8A0000-0x000000001BB9F000-memory.dmpFilesize
3.0MB
-
memory/1624-67-0x0000000000000000-mapping.dmp
-
memory/1624-109-0x0000000002904000-0x0000000002907000-memory.dmpFilesize
12KB
-
memory/1624-127-0x0000000002904000-0x0000000002907000-memory.dmpFilesize
12KB
-
memory/1636-95-0x0000000000000000-mapping.dmp
-
memory/1668-93-0x0000000000000000-mapping.dmp
-
memory/1672-65-0x0000000000000000-mapping.dmp
-
memory/1816-62-0x00000000005F0000-0x00000000005FC000-memory.dmpFilesize
48KB
-
memory/1816-61-0x0000000000360000-0x000000000036A000-memory.dmpFilesize
40KB
-
memory/1816-55-0x0000000000240000-0x000000000024E000-memory.dmpFilesize
56KB
-
memory/1816-56-0x0000000000250000-0x000000000026C000-memory.dmpFilesize
112KB
-
memory/1816-57-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/1816-54-0x00000000010F0000-0x000000000125E000-memory.dmpFilesize
1.4MB
-
memory/1816-58-0x0000000000280000-0x0000000000288000-memory.dmpFilesize
32KB
-
memory/1816-59-0x0000000000310000-0x0000000000318000-memory.dmpFilesize
32KB
-
memory/1816-60-0x0000000000320000-0x0000000000330000-memory.dmpFilesize
64KB
-
memory/1984-88-0x0000000000000000-mapping.dmp
-
memory/1984-91-0x0000000000FB0000-0x000000000111E000-memory.dmpFilesize
1.4MB
-
memory/2000-105-0x000007FEEAE60000-0x000007FEEB9BD000-memory.dmpFilesize
11.4MB
-
memory/2000-129-0x00000000025EB000-0x000000000260A000-memory.dmpFilesize
124KB
-
memory/2000-97-0x000007FEEC3B0000-0x000007FEECDD3000-memory.dmpFilesize
10.1MB
-
memory/2000-108-0x00000000025E4000-0x00000000025E7000-memory.dmpFilesize
12KB
-
memory/2000-126-0x00000000025E4000-0x00000000025E7000-memory.dmpFilesize
12KB
-
memory/2000-70-0x0000000000000000-mapping.dmp
-
memory/2000-115-0x000000001B860000-0x000000001BB5F000-memory.dmpFilesize
3.0MB