Analysis
-
max time kernel
112s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 08:41
Behavioral task
behavioral1
Sample
a8327e7f73f4d7a3931072ca1e489d82.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a8327e7f73f4d7a3931072ca1e489d82.exe
Resource
win10v2004-20221111-en
General
-
Target
a8327e7f73f4d7a3931072ca1e489d82.exe
-
Size
1.5MB
-
MD5
a8327e7f73f4d7a3931072ca1e489d82
-
SHA1
33fa6a7fa73a790c876582c9f638fc7e71a0f284
-
SHA256
38ee5db6247e3637509a731d894af10c97be040b388aac5a87b9b4a0b19a03c3
-
SHA512
d7f1ea19127350fc1f4fce1942342b52c128fec6113b7eceac7491da599a292b63e5c0508b2ef17df02aed853b9e24b2d17cc71342d56f9239df914a56e4dae4
-
SSDEEP
24576:P2G/nvxW3WV0Boz7PdSo8OhfvG83PxEXY5TZ95f+bYy4HKTtadCK2yseqa+B7:PbA3HBodSo80/GXC9+bl4ewpEe+h
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 792 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 848 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1916 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 584 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1920 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 984 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1792 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1220 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1208 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 916 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1556 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2028 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1172 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1264 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1328 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 608 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1484 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1388 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1760 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1560 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 392 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1400 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1104 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 912 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 276 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1084 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2084 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2104 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2124 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2160 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2176 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2200 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2240 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2280 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 564 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2340 564 schtasks.exe -
Processes:
resource yara_rule \brokerperf\Hypersaves.exe dcrat C:\brokerperf\Hypersaves.exe dcrat \brokerperf\Hypersaves.exe dcrat C:\brokerperf\Hypersaves.exe dcrat behavioral1/memory/1424-65-0x0000000000C10000-0x0000000000D46000-memory.dmp dcrat behavioral1/memory/2372-72-0x00000000002B0000-0x00000000003E6000-memory.dmp dcrat C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe dcrat C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe dcrat -
Executes dropped EXE 2 IoCs
Processes:
Hypersaves.exespoolsv.exepid process 1424 Hypersaves.exe 2372 spoolsv.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1176 cmd.exe 1176 cmd.exe -
Drops file in Program Files directory 10 IoCs
Processes:
Hypersaves.exedescription ioc process File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe Hypersaves.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\winlogon.exe Hypersaves.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\cc11b995f2a76d Hypersaves.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\69ddcba757bf72 Hypersaves.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe Hypersaves.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\b75386f1303e64 Hypersaves.exe File created C:\Program Files\Windows Portable Devices\conhost.exe Hypersaves.exe File created C:\Program Files\Windows Portable Devices\088424020bedd6 Hypersaves.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe Hypersaves.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\f3b6ecef712a24 Hypersaves.exe -
Drops file in Windows directory 9 IoCs
Processes:
Hypersaves.exedescription ioc process File created C:\Windows\IME\IMETC10\HELP\27d1bcfc3c54e0 Hypersaves.exe File created C:\Windows\Migration\WTR\sppsvc.exe Hypersaves.exe File created C:\Windows\Migration\WTR\0a1fd5f707cd16 Hypersaves.exe File created C:\Windows\servicing\GC64\Hypersaves.exe Hypersaves.exe File created C:\Windows\winsxs\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b0e32c20aec46b32\conhost.exe Hypersaves.exe File created C:\Windows\servicing\de-DE\dwm.exe Hypersaves.exe File created C:\Windows\winsxs\services.exe Hypersaves.exe File created C:\Windows\IME\IMETC10\HELP\System.exe Hypersaves.exe File opened for modification C:\Windows\IME\IMETC10\HELP\System.exe Hypersaves.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1484 schtasks.exe 2200 schtasks.exe 1760 schtasks.exe 2032 schtasks.exe 936 schtasks.exe 2084 schtasks.exe 1920 schtasks.exe 936 schtasks.exe 1328 schtasks.exe 1760 schtasks.exe 2176 schtasks.exe 792 schtasks.exe 1612 schtasks.exe 984 schtasks.exe 1704 schtasks.exe 1584 schtasks.exe 1532 schtasks.exe 1560 schtasks.exe 392 schtasks.exe 1104 schtasks.exe 2124 schtasks.exe 2160 schtasks.exe 2280 schtasks.exe 1600 schtasks.exe 2028 schtasks.exe 2300 schtasks.exe 1220 schtasks.exe 1208 schtasks.exe 1556 schtasks.exe 1172 schtasks.exe 1264 schtasks.exe 608 schtasks.exe 1184 schtasks.exe 1792 schtasks.exe 1084 schtasks.exe 2320 schtasks.exe 584 schtasks.exe 916 schtasks.exe 1796 schtasks.exe 1400 schtasks.exe 912 schtasks.exe 2340 schtasks.exe 848 schtasks.exe 1916 schtasks.exe 276 schtasks.exe 2060 schtasks.exe 2104 schtasks.exe 2240 schtasks.exe 2256 schtasks.exe 1704 schtasks.exe 1388 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Hypersaves.exespoolsv.exepid process 1424 Hypersaves.exe 1424 Hypersaves.exe 1424 Hypersaves.exe 1424 Hypersaves.exe 1424 Hypersaves.exe 2372 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe 2372 spoolsv.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Hypersaves.exespoolsv.exedescription pid process Token: SeDebugPrivilege 1424 Hypersaves.exe Token: SeDebugPrivilege 2372 spoolsv.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a8327e7f73f4d7a3931072ca1e489d82.exeWScript.execmd.exeHypersaves.exedescription pid process target process PID 884 wrote to memory of 2028 884 a8327e7f73f4d7a3931072ca1e489d82.exe WScript.exe PID 884 wrote to memory of 2028 884 a8327e7f73f4d7a3931072ca1e489d82.exe WScript.exe PID 884 wrote to memory of 2028 884 a8327e7f73f4d7a3931072ca1e489d82.exe WScript.exe PID 884 wrote to memory of 2028 884 a8327e7f73f4d7a3931072ca1e489d82.exe WScript.exe PID 2028 wrote to memory of 1176 2028 WScript.exe cmd.exe PID 2028 wrote to memory of 1176 2028 WScript.exe cmd.exe PID 2028 wrote to memory of 1176 2028 WScript.exe cmd.exe PID 2028 wrote to memory of 1176 2028 WScript.exe cmd.exe PID 1176 wrote to memory of 1424 1176 cmd.exe Hypersaves.exe PID 1176 wrote to memory of 1424 1176 cmd.exe Hypersaves.exe PID 1176 wrote to memory of 1424 1176 cmd.exe Hypersaves.exe PID 1176 wrote to memory of 1424 1176 cmd.exe Hypersaves.exe PID 1424 wrote to memory of 2372 1424 Hypersaves.exe spoolsv.exe PID 1424 wrote to memory of 2372 1424 Hypersaves.exe spoolsv.exe PID 1424 wrote to memory of 2372 1424 Hypersaves.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8327e7f73f4d7a3931072ca1e489d82.exe"C:\Users\Admin\AppData\Local\Temp\a8327e7f73f4d7a3931072ca1e489d82.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\brokerperf\yzbbss9f6DVhZcZfA4yi.vbe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\brokerperf\05no77bTSSxqXTtNATW8hKup6yLON.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\brokerperf\Hypersaves.exe"C:\brokerperf\Hypersaves.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe"C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\IME\IMETC10\HELP\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\IME\IMETC10\HELP\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\IMETC10\HELP\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\Migration\WTR\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "HypersavesH" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Pictures\Hypersaves.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Hypersaves" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Hypersaves.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "HypersavesH" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\Hypersaves.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\brokerperf\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\brokerperf\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\brokerperf\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "HypersavesH" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\Hypersaves.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Hypersaves" /sc ONLOGON /tr "'C:\MSOCache\All Users\Hypersaves.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "HypersavesH" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\Hypersaves.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Favorites\Windows Live\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Windows Live\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Favorites\Windows Live\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Recent\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Recent\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Recent\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\c11c4da2-1a8a-11ed-8505-e0b24281b398\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exeFilesize
1.2MB
MD5b313d25c0fed1c6069e6a72e73a5751f
SHA11717db41053d68f4b6cb0619eaee7d7617a6ebc9
SHA25601e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd
SHA5126807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3
-
C:\Program Files (x86)\Windows Defender\ja-JP\spoolsv.exeFilesize
1.2MB
MD5b313d25c0fed1c6069e6a72e73a5751f
SHA11717db41053d68f4b6cb0619eaee7d7617a6ebc9
SHA25601e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd
SHA5126807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3
-
C:\brokerperf\05no77bTSSxqXTtNATW8hKup6yLON.batFilesize
30B
MD540887cda573d24c154df9f6ecc8508b7
SHA12991ac00d79b896c1433fa0edba4b176a75738a4
SHA256fa50577412b6e089d86ea596b6838c2d9ee37c73c70815e546e71d759cd07b7e
SHA512593c9184332faedbc70a3152ee264850d5b0c39b7e080edf9bad9530fbb031964bede11e05617168c1ec9291c68c190db645215484f15f39d535c7d7fbcb77b7
-
C:\brokerperf\Hypersaves.exeFilesize
1.2MB
MD5b313d25c0fed1c6069e6a72e73a5751f
SHA11717db41053d68f4b6cb0619eaee7d7617a6ebc9
SHA25601e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd
SHA5126807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3
-
C:\brokerperf\Hypersaves.exeFilesize
1.2MB
MD5b313d25c0fed1c6069e6a72e73a5751f
SHA11717db41053d68f4b6cb0619eaee7d7617a6ebc9
SHA25601e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd
SHA5126807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3
-
C:\brokerperf\yzbbss9f6DVhZcZfA4yi.vbeFilesize
216B
MD5e7db9f8708a135db0bb83dafb0f9256b
SHA1fee4cc69a17f2633ead4ff37798d3dfdaba83081
SHA2562bbc8edaf231e644b254b41338ef3dd019bbbac117c0b204907d8274ea2dded9
SHA51209c201f43cd84008787c657810ec31936827026a6a05bc8ed502b0cb6cb850c81d60a712f98d8bbb7f921b4d2c686a007e456ca7b7455f4924537373ff90b83d
-
\brokerperf\Hypersaves.exeFilesize
1.2MB
MD5b313d25c0fed1c6069e6a72e73a5751f
SHA11717db41053d68f4b6cb0619eaee7d7617a6ebc9
SHA25601e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd
SHA5126807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3
-
\brokerperf\Hypersaves.exeFilesize
1.2MB
MD5b313d25c0fed1c6069e6a72e73a5751f
SHA11717db41053d68f4b6cb0619eaee7d7617a6ebc9
SHA25601e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd
SHA5126807bc163b386f0398a7195f83f7b0619d912724582780ace94d0cd115c2f192a90536f9950cf61c9f18d7df0da58ea9116a22544ff9f3a5489e6c2398d975d3
-
memory/884-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1176-59-0x0000000000000000-mapping.dmp
-
memory/1424-63-0x0000000000000000-mapping.dmp
-
memory/1424-66-0x0000000000550000-0x000000000056C000-memory.dmpFilesize
112KB
-
memory/1424-67-0x0000000000570000-0x0000000000586000-memory.dmpFilesize
88KB
-
memory/1424-68-0x0000000000590000-0x000000000059E000-memory.dmpFilesize
56KB
-
memory/1424-65-0x0000000000C10000-0x0000000000D46000-memory.dmpFilesize
1.2MB
-
memory/2028-55-0x0000000000000000-mapping.dmp
-
memory/2372-69-0x0000000000000000-mapping.dmp
-
memory/2372-72-0x00000000002B0000-0x00000000003E6000-memory.dmpFilesize
1.2MB