Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 02:12
Behavioral task
behavioral1
Sample
pTdbWeYTRtzW2gi.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
pTdbWeYTRtzW2gi.exe
Resource
win10v2004-20221111-en
General
-
Target
pTdbWeYTRtzW2gi.exe
-
Size
1.1MB
-
MD5
8496c268e5795f8734c886bf68ee141c
-
SHA1
dc642bd6fc6fad71ab5ac10cc35a040ad993db5c
-
SHA256
576437a881af98afed6680cd7fe0ae52adb87a528ece6d367eaf436765fe1d9e
-
SHA512
f7b7681352174ec9096fdf0dca8bbfaabac219cbea6f134fcd139cc77b52f861cc2034f8dda8c7d945c57ed6777fc193805ada1b95f8f2408cfd023c77a2d026
-
SSDEEP
12288:t6NE5eSwJu37+GXJpkaI7ShG54v4ahgVY3whNG8/LI6i4ejmtnbAouuFteLBdBN9:t6NReJXJIwvJgVQSoPEzKkLXa
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 7 IoCs
Processes:
pTdbWeYTRtzW2gi.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Windows\\LiveKernelReports\\fontdrvhost.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Windows\\LiveKernelReports\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Windows\\LiveKernelReports\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Windows\\LiveKernelReports\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Google\\Policies\\smss.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\", \"C:\\Windows\\LiveKernelReports\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Google\\Policies\\smss.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\OfficeClickToRun.exe\"" pTdbWeYTRtzW2gi.exe -
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3096 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2804 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4628 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2500 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2540 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3976 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3388 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3440 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4540 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4620 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4588 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1004 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1288 1448 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2712 1448 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/4328-132-0x00000000000B0000-0x00000000001DC000-memory.dmp dcrat C:\Program Files (x86)\Google\Policies\smss.exe dcrat C:\Program Files (x86)\Google\Policies\smss.exe dcrat behavioral2/memory/1392-139-0x0000000000460000-0x000000000058C000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
smss.exepid process 1392 smss.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
pTdbWeYTRtzW2gi.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation pTdbWeYTRtzW2gi.exe -
Adds Run key to start application 2 TTPs 14 IoCs
Processes:
pTdbWeYTRtzW2gi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\OfficeClickToRun.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\OfficeClickToRun.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\LiveKernelReports\\fontdrvhost.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Google\\Policies\\smss.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\LiveKernelReports\\fontdrvhost.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Recovery\\WindowsRE\\lsass.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Google\\Policies\\smss.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Templates\\RuntimeBroker.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\RuntimeBroker.exe\"" pTdbWeYTRtzW2gi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" pTdbWeYTRtzW2gi.exe -
Drops file in Program Files directory 12 IoCs
Processes:
pTdbWeYTRtzW2gi.exedescription ioc process File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe pTdbWeYTRtzW2gi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\e6c9b481da804f pTdbWeYTRtzW2gi.exe File opened for modification C:\Program Files (x86)\Google\Policies\RCX9006.tmp pTdbWeYTRtzW2gi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\OfficeClickToRun.exe pTdbWeYTRtzW2gi.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe pTdbWeYTRtzW2gi.exe File opened for modification C:\Program Files (x86)\Google\Policies\smss.exe pTdbWeYTRtzW2gi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\RCX9288.tmp pTdbWeYTRtzW2gi.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\9e8d7a4ca61bd9 pTdbWeYTRtzW2gi.exe File created C:\Program Files (x86)\Google\Policies\smss.exe pTdbWeYTRtzW2gi.exe File created C:\Program Files (x86)\Google\Policies\69ddcba757bf72 pTdbWeYTRtzW2gi.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\OfficeClickToRun.exe pTdbWeYTRtzW2gi.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX85FF.tmp pTdbWeYTRtzW2gi.exe -
Drops file in Windows directory 4 IoCs
Processes:
pTdbWeYTRtzW2gi.exedescription ioc process File created C:\Windows\LiveKernelReports\fontdrvhost.exe pTdbWeYTRtzW2gi.exe File created C:\Windows\LiveKernelReports\5b884080fd4f94 pTdbWeYTRtzW2gi.exe File opened for modification C:\Windows\LiveKernelReports\RCX8881.tmp pTdbWeYTRtzW2gi.exe File opened for modification C:\Windows\LiveKernelReports\fontdrvhost.exe pTdbWeYTRtzW2gi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3976 schtasks.exe 1664 schtasks.exe 3388 schtasks.exe 2712 schtasks.exe 3096 schtasks.exe 2400 schtasks.exe 2540 schtasks.exe 4588 schtasks.exe 1288 schtasks.exe 2804 schtasks.exe 4628 schtasks.exe 2500 schtasks.exe 3496 schtasks.exe 1836 schtasks.exe 3068 schtasks.exe 4656 schtasks.exe 3440 schtasks.exe 4540 schtasks.exe 2808 schtasks.exe 4620 schtasks.exe 1004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
pTdbWeYTRtzW2gi.exesmss.exepid process 4328 pTdbWeYTRtzW2gi.exe 4328 pTdbWeYTRtzW2gi.exe 4328 pTdbWeYTRtzW2gi.exe 1392 smss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
pTdbWeYTRtzW2gi.exesmss.exedescription pid process Token: SeDebugPrivilege 4328 pTdbWeYTRtzW2gi.exe Token: SeDebugPrivilege 1392 smss.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
pTdbWeYTRtzW2gi.exedescription pid process target process PID 4328 wrote to memory of 1392 4328 pTdbWeYTRtzW2gi.exe smss.exe PID 4328 wrote to memory of 1392 4328 pTdbWeYTRtzW2gi.exe smss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pTdbWeYTRtzW2gi.exe"C:\Users\Admin\AppData\Local\Temp\pTdbWeYTRtzW2gi.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Policies\smss.exe"C:\Program Files (x86)\Google\Policies\smss.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Templates\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Policies\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Policies\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Policies\smss.exeFilesize
1.1MB
MD5661d31ee1fd0ae280009dbe9eea74e48
SHA10ba69113cf0b42774eb84cc9bfe6d793fc0290db
SHA256d8a75ab442421c30d5c08c9426792fd935453345b93ab4bc9752cc261f970529
SHA512e90ea07216dfd45e8c0d52978e7de03d5388b1ed5f36d07a6c40e7f6add59686e185725b990eb427f89caa05e9b7eb70ce4a1a202d0f0e376f532fa79d96a151
-
C:\Program Files (x86)\Google\Policies\smss.exeFilesize
1.1MB
MD5661d31ee1fd0ae280009dbe9eea74e48
SHA10ba69113cf0b42774eb84cc9bfe6d793fc0290db
SHA256d8a75ab442421c30d5c08c9426792fd935453345b93ab4bc9752cc261f970529
SHA512e90ea07216dfd45e8c0d52978e7de03d5388b1ed5f36d07a6c40e7f6add59686e185725b990eb427f89caa05e9b7eb70ce4a1a202d0f0e376f532fa79d96a151
-
memory/1392-136-0x0000000000000000-mapping.dmp
-
memory/1392-139-0x0000000000460000-0x000000000058C000-memory.dmpFilesize
1.2MB
-
memory/1392-141-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmpFilesize
10.8MB
-
memory/1392-142-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmpFilesize
10.8MB
-
memory/1392-143-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmpFilesize
10.8MB
-
memory/4328-132-0x00000000000B0000-0x00000000001DC000-memory.dmpFilesize
1.2MB
-
memory/4328-133-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmpFilesize
10.8MB
-
memory/4328-134-0x00000000023E0000-0x0000000002430000-memory.dmpFilesize
320KB
-
memory/4328-135-0x000000001D2E0000-0x000000001D808000-memory.dmpFilesize
5.2MB
-
memory/4328-140-0x00007FFF1D770000-0x00007FFF1E231000-memory.dmpFilesize
10.8MB