Analysis
-
max time kernel
119s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 05:31
Static task
static1
Behavioral task
behavioral1
Sample
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe
Resource
win10v2004-20230220-en
General
-
Target
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe
-
Size
1.1MB
-
MD5
7b2cc7bd31191fc112de760c996e56a1
-
SHA1
8c87bbdd79eda5b6f6612a9d828d10924071e959
-
SHA256
168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
-
SHA512
9c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
SSDEEP
24576:JpyruWBdka5dL1NELih7LqxLBwceZEY2Onj3JniDq0A5BfJXA6:Jpm9nkIdL1WCnwmDZJ2Q3ZB5BfJXA6
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 39 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3332 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3792 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4332 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2248 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4640 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3624 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2324 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3224 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4156 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4540 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3032 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 624 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4816 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 464 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4876 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 444 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4076 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3528 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5072 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4768 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1040 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3220 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4040 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4944 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1116 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1344 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2144 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1292 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 956 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4904 2060 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 792 2060 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/212-138-0x0000000000400000-0x0000000000601000-memory.dmp dcrat behavioral2/memory/212-187-0x0000000000400000-0x0000000000601000-memory.dmp dcrat behavioral2/memory/1140-196-0x0000000000400000-0x0000000000601000-memory.dmp dcrat behavioral2/memory/1140-199-0x0000000000400000-0x0000000000601000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe -
Executes dropped EXE 1 IoCs
Processes:
services.exepid process 1140 services.exe -
Drops file in Program Files directory 5 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exedescription ioc process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\38384e6a620884 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files\Microsoft Office\root\RuntimeBroker.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files\Microsoft Office\root\9e8d7a4ca61bd9 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\taskhostw.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\SearchApp.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe -
Drops file in Windows directory 8 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exedescription ioc process File opened for modification C:\Windows\addins\System.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\addins\27d1bcfc3c54e0 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\WaaS\tasks\sysmon.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\Provisioning\services.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\Provisioning\c5b4cb5e9653cc 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\Offline Web Pages\dllhost.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\Offline Web Pages\5940a34987c991 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe File created C:\Windows\addins\System.exe 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 39 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3528 schtasks.exe 636 schtasks.exe 1836 schtasks.exe 4640 schtasks.exe 3032 schtasks.exe 624 schtasks.exe 956 schtasks.exe 2248 schtasks.exe 4876 schtasks.exe 5072 schtasks.exe 1292 schtasks.exe 4768 schtasks.exe 4944 schtasks.exe 3792 schtasks.exe 4656 schtasks.exe 2276 schtasks.exe 444 schtasks.exe 1576 schtasks.exe 4076 schtasks.exe 4040 schtasks.exe 2144 schtasks.exe 2324 schtasks.exe 4476 schtasks.exe 1040 schtasks.exe 3220 schtasks.exe 4540 schtasks.exe 8 schtasks.exe 2032 schtasks.exe 4816 schtasks.exe 3332 schtasks.exe 3624 schtasks.exe 3224 schtasks.exe 4156 schtasks.exe 464 schtasks.exe 1116 schtasks.exe 4904 schtasks.exe 4332 schtasks.exe 1344 schtasks.exe 792 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exeservices.exepid process 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe 1140 services.exe 1140 services.exe 1140 services.exe 1140 services.exe 1140 services.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exeservices.exedescription pid process Token: SeDebugPrivilege 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe Token: SeDebugPrivilege 1140 services.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exedescription pid process target process PID 212 wrote to memory of 1140 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe services.exe PID 212 wrote to memory of 1140 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe services.exe PID 212 wrote to memory of 1140 212 168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe services.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe"C:\Users\Admin\AppData\Local\Temp\168DD964CEDAB347B56461282AB409B5FB19DE28F50F6.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Provisioning\services.exe"C:\Windows\Provisioning\services.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\TrustedInstaller.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Users\Default User\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\root\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\root\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Desktop\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Desktop\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Music\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\Provisioning\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Provisioning\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\Provisioning\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\odt\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Offline Web Pages\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\RuntimeBroker.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
C:\Windows\Provisioning\services.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
C:\Windows\Provisioning\services.exeFilesize
1.1MB
MD57b2cc7bd31191fc112de760c996e56a1
SHA18c87bbdd79eda5b6f6612a9d828d10924071e959
SHA256168dd964cedab347b56461282ab409b5fb19de28f50f635d7071dfce39c04ed5
SHA5129c7b924020c2c7c8d485100429449f4d0221e73ddf4f00ea197efa539a29d9cd74528928371a9640c05f8cf27f2b37348bec7b3d3a9c1006bcc304ebc85fbd7a
-
memory/212-147-0x0000000005F50000-0x000000000647C000-memory.dmpFilesize
5.2MB
-
memory/212-151-0x00000000065C0000-0x0000000006626000-memory.dmpFilesize
408KB
-
memory/212-138-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/212-141-0x0000000005430000-0x00000000059D4000-memory.dmpFilesize
5.6MB
-
memory/212-142-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/212-143-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/212-144-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/212-145-0x0000000004B40000-0x0000000004B50000-memory.dmpFilesize
64KB
-
memory/212-146-0x00000000023E0000-0x0000000002430000-memory.dmpFilesize
320KB
-
memory/212-133-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/212-148-0x0000000005B40000-0x0000000005BD2000-memory.dmpFilesize
584KB
-
memory/212-137-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/212-136-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/212-135-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/212-134-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/212-187-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1140-188-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1140-189-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1140-190-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1140-191-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1140-192-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1140-196-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB
-
memory/1140-197-0x0000000007410000-0x000000000741A000-memory.dmpFilesize
40KB
-
memory/1140-199-0x0000000000400000-0x0000000000601000-memory.dmpFilesize
2.0MB