Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2023 16:47
Behavioral task
behavioral1
Sample
5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe
Resource
win10v2004-20220812-en
General
-
Target
5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe
-
Size
1.3MB
-
MD5
b9a0002e9a104374dea2f4ba571f1764
-
SHA1
627488abb7aeeb5f8f411a9694cebd6b4748a86f
-
SHA256
5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18
-
SHA512
439d0ad76753bf88adc6d92e80fda5bbc64c5724180d8689f79fbf48a80754eb5f127284f123a71129a110ccfeeccb1c3c4cb0879f7859a0648aa0e09ba805b5
-
SSDEEP
24576:U2G/nvxW3Ww0t4952ytIS/Zgi5N5vC8bg7Mj9W4eHdELPh:UbA30QAytISht5q8bQMB4o
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 9 IoCs
Processes:
hyperReviewwin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\hyperReviewwin.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\hyperReviewwin.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\hyperReviewwin.exe\", \"C:\\Users\\Default\\Videos\\csrss.exe\", \"C:\\Program Files\\Internet Explorer\\ja-JP\\SppExtComObj.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\"" hyperReviewwin.exe -
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1168 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 332 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2632 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1444 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5048 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1380 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 808 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4396 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 744 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3776 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3100 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1948 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1316 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3412 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 204 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4468 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1820 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3592 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3372 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3488 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3928 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3692 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3612 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4568 1116 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5080 1116 schtasks.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\hyperReviewwin.exe dcrat C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\hyperReviewwin.exe dcrat behavioral1/memory/2440-139-0x0000000000CD0000-0x0000000000DDA000-memory.dmp dcrat C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe dcrat C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe dcrat -
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
Processes:
hyperReviewwin.exeSppExtComObj.exepid process 2440 hyperReviewwin.exe 1108 SppExtComObj.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exeWScript.exehyperReviewwin.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation hyperReviewwin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 18 IoCs
Processes:
hyperReviewwin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Videos\\csrss.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Internet Explorer\\ja-JP\\SppExtComObj.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Internet Explorer\\ja-JP\\SppExtComObj.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Recovery\\WindowsRE\\Registry.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperReviewwin = "\"C:\\Program Files (x86)\\Microsoft.NET\\hyperReviewwin.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Videos\\csrss.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Users\\Public\\Libraries\\WmiPrvSE.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\winlogon.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\ja-JP\\smss.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows Media Player\\Skins\\lsass.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\"" hyperReviewwin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperReviewwin = "\"C:\\Program Files (x86)\\Microsoft.NET\\hyperReviewwin.exe\"" hyperReviewwin.exe -
Drops file in Program Files directory 12 IoCs
Processes:
hyperReviewwin.exedescription ioc process File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\69ddcba757bf72 hyperReviewwin.exe File created C:\Program Files (x86)\Windows Media Player\Skins\lsass.exe hyperReviewwin.exe File created C:\Program Files (x86)\Windows Media Player\Skins\6203df4a6bafc7 hyperReviewwin.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\9e8d7a4ca61bd9 hyperReviewwin.exe File created C:\Program Files (x86)\Microsoft.NET\hyperReviewwin.exe hyperReviewwin.exe File created C:\Program Files\Internet Explorer\ja-JP\e1ef82546f0b02 hyperReviewwin.exe File created C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe hyperReviewwin.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe hyperReviewwin.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\cc11b995f2a76d hyperReviewwin.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe hyperReviewwin.exe File created C:\Program Files (x86)\Microsoft.NET\f7894aa59cf215 hyperReviewwin.exe File created C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe hyperReviewwin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1820 schtasks.exe 744 schtasks.exe 4468 schtasks.exe 1316 schtasks.exe 3412 schtasks.exe 332 schtasks.exe 1380 schtasks.exe 204 schtasks.exe 3372 schtasks.exe 3612 schtasks.exe 1444 schtasks.exe 3100 schtasks.exe 3488 schtasks.exe 4568 schtasks.exe 3692 schtasks.exe 1168 schtasks.exe 5048 schtasks.exe 3776 schtasks.exe 2536 schtasks.exe 2632 schtasks.exe 808 schtasks.exe 1948 schtasks.exe 4396 schtasks.exe 4124 schtasks.exe 3928 schtasks.exe 3592 schtasks.exe 5080 schtasks.exe -
Modifies registry class 2 IoCs
Processes:
5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exehyperReviewwin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings hyperReviewwin.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
hyperReviewwin.exeSppExtComObj.exepid process 2440 hyperReviewwin.exe 2440 hyperReviewwin.exe 2440 hyperReviewwin.exe 2440 hyperReviewwin.exe 2440 hyperReviewwin.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe 1108 SppExtComObj.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SppExtComObj.exepid process 1108 SppExtComObj.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
hyperReviewwin.exeSppExtComObj.exedescription pid process Token: SeDebugPrivilege 2440 hyperReviewwin.exe Token: SeDebugPrivilege 1108 SppExtComObj.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exeWScript.execmd.exehyperReviewwin.execmd.exedescription pid process target process PID 3008 wrote to memory of 384 3008 5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe WScript.exe PID 3008 wrote to memory of 384 3008 5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe WScript.exe PID 3008 wrote to memory of 384 3008 5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe WScript.exe PID 384 wrote to memory of 4844 384 WScript.exe cmd.exe PID 384 wrote to memory of 4844 384 WScript.exe cmd.exe PID 384 wrote to memory of 4844 384 WScript.exe cmd.exe PID 4844 wrote to memory of 2440 4844 cmd.exe hyperReviewwin.exe PID 4844 wrote to memory of 2440 4844 cmd.exe hyperReviewwin.exe PID 2440 wrote to memory of 1012 2440 hyperReviewwin.exe cmd.exe PID 2440 wrote to memory of 1012 2440 hyperReviewwin.exe cmd.exe PID 4844 wrote to memory of 4976 4844 cmd.exe reg.exe PID 4844 wrote to memory of 4976 4844 cmd.exe reg.exe PID 4844 wrote to memory of 4976 4844 cmd.exe reg.exe PID 1012 wrote to memory of 4348 1012 cmd.exe w32tm.exe PID 1012 wrote to memory of 4348 1012 cmd.exe w32tm.exe PID 1012 wrote to memory of 1108 1012 cmd.exe SppExtComObj.exe PID 1012 wrote to memory of 1108 1012 cmd.exe SppExtComObj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe"C:\Users\Admin\AppData\Local\Temp\5d05c7d74af3f812e23c91cb9cf1e346af9e8e074515862c7449cd8ff2dd8b18.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\GkeJrm3LHsNPCuEbXf7u.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\87AREt1.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\hyperReviewwin.exe"C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\hyperReviewwin.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Uy6LsnJKZb.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe"C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Libraries\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\Public\Libraries\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Libraries\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "hyperReviewwinh" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\hyperReviewwin.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "hyperReviewwin" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\hyperReviewwin.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "hyperReviewwinh" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\hyperReviewwin.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Videos\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Videos\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exeFilesize
1.0MB
MD5ce9d81db072369459840b1fe59a54ac9
SHA15813fcd53f7670656d036dfb49c6f9ed8f6eebbf
SHA25662a30529b4349757f575cba71300e5deed89c480293142d92b44a314849a04bf
SHA5126be82ee4dcf8bae4ee17ca174d4a90a7b74c4fd2494aefb2091d4edcefba4dfaa4db94bef180cce39959ed6997bde96f8914996138f188be2d880e86a4dfb97b
-
C:\Program Files\Internet Explorer\ja-JP\SppExtComObj.exeFilesize
1.0MB
MD5ce9d81db072369459840b1fe59a54ac9
SHA15813fcd53f7670656d036dfb49c6f9ed8f6eebbf
SHA25662a30529b4349757f575cba71300e5deed89c480293142d92b44a314849a04bf
SHA5126be82ee4dcf8bae4ee17ca174d4a90a7b74c4fd2494aefb2091d4edcefba4dfaa4db94bef180cce39959ed6997bde96f8914996138f188be2d880e86a4dfb97b
-
C:\Users\Admin\AppData\Local\Temp\Uy6LsnJKZb.batFilesize
222B
MD57d8b8a904e5741fb91828b6e6e6b6726
SHA158279ccd03332ddf2b902140a10dab55a2660d9d
SHA2569645ddfcec31844fe57b735fbbf3dc607844986754bcf7e6743d08332a5ad2dc
SHA5127778ec1b7f0b4348bdadee2228eed61fea0b56c7bae778708715416c41d9e341c30961891825b7efa8b62949df8f32cbd7e5fad4158ebb9b980ad8ea3be95b63
-
C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\87AREt1.batFilesize
173B
MD52445216481e9c79fe7a7d2dddd5dd047
SHA15caaf8f423f587b26c0d98bb57db0e295d7ca6a7
SHA2560d8405ad4bde2e23144377872f204baf9cdbc1343a55c075dabeec49a64c7c3d
SHA5127000b171a053a0bb20c435765f2c76272e71eb4f429e2b500282f4765b9141757cdcb93a94480ae8ae0b78624098a02bb71caa111e8ab516f12c863725f86484
-
C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\GkeJrm3LHsNPCuEbXf7u.vbeFilesize
221B
MD5fc584ab062886ba5b7b34c8a8e4f1809
SHA16be7eeee2021f69be9e4513f0cb28408a56caba9
SHA256873395e08f2ca43b4698329c5e2b6667dec76f2eeb08b05a1cff0a14e5a9db76
SHA512a74d1b3567e169ed0ec0d135e31312eeae71f87e43c2311a16539f670116f2ce75bb4b4f33a6b462aa417c3764637b3e6c027b44728b2da7874031ac0cc4a7b8
-
C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\hyperReviewwin.exeFilesize
1.0MB
MD5ce9d81db072369459840b1fe59a54ac9
SHA15813fcd53f7670656d036dfb49c6f9ed8f6eebbf
SHA25662a30529b4349757f575cba71300e5deed89c480293142d92b44a314849a04bf
SHA5126be82ee4dcf8bae4ee17ca174d4a90a7b74c4fd2494aefb2091d4edcefba4dfaa4db94bef180cce39959ed6997bde96f8914996138f188be2d880e86a4dfb97b
-
C:\Users\Admin\AppData\Roaming\containerfontSessionmonitorsvc\hyperReviewwin.exeFilesize
1.0MB
MD5ce9d81db072369459840b1fe59a54ac9
SHA15813fcd53f7670656d036dfb49c6f9ed8f6eebbf
SHA25662a30529b4349757f575cba71300e5deed89c480293142d92b44a314849a04bf
SHA5126be82ee4dcf8bae4ee17ca174d4a90a7b74c4fd2494aefb2091d4edcefba4dfaa4db94bef180cce39959ed6997bde96f8914996138f188be2d880e86a4dfb97b
-
memory/384-132-0x0000000000000000-mapping.dmp
-
memory/1012-141-0x0000000000000000-mapping.dmp
-
memory/1108-146-0x0000000000000000-mapping.dmp
-
memory/1108-150-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmpFilesize
10.8MB
-
memory/1108-149-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmpFilesize
10.8MB
-
memory/2440-140-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmpFilesize
10.8MB
-
memory/2440-142-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmpFilesize
10.8MB
-
memory/2440-139-0x0000000000CD0000-0x0000000000DDA000-memory.dmpFilesize
1.0MB
-
memory/2440-136-0x0000000000000000-mapping.dmp
-
memory/4348-145-0x0000000000000000-mapping.dmp
-
memory/4844-135-0x0000000000000000-mapping.dmp
-
memory/4976-143-0x0000000000000000-mapping.dmp