Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 02:04
Behavioral task
behavioral1
Sample
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe
Resource
win7-20230220-en
General
-
Target
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe
-
Size
2.9MB
-
MD5
9781aaa439fcf85da08d40c5c3e3909f
-
SHA1
edd84aae94017cdde7dd564d2791c6389f98c01f
-
SHA256
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35
-
SHA512
27be25ed8a4df487bbb3066a9d67ee8403cb91ec8f21aeb2367252c57cf209903f01f770394f6e9d05e627a7697a9ba446bea98f65f5be166f7be33c74dedd02
-
SSDEEP
49152:VVqaWggE8cLbTM0Qpx80y5tq4JyiK+RzzO/twfoLFAq4JNpFLP7:zqLggl0QpC0qt/JyV+hz5foLB4Jn
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 30 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1420 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2888 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3632 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 368 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1380 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3332 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4740 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3128 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3320 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4900 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3112 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1056 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 312 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1484 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3824 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4132 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4244 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4228 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1764 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3528 1140 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4812 1140 schtasks.exe -
Processes:
smss.exe413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe -
Processes:
resource yara_rule behavioral2/memory/2144-133-0x00000000009F0000-0x0000000000CD6000-memory.dmp dcrat C:\odt\lsass.exe dcrat C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe dcrat C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe dcrat -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exesmss.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation smss.exe -
Executes dropped EXE 1 IoCs
Processes:
smss.exepid process 3808 smss.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
smss.exe413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 26 ipinfo.io 27 ipinfo.io -
Drops file in Program Files directory 6 IoCs
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exedescription ioc process File created C:\Program Files (x86)\Windows Sidebar\sysmon.exe 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe File created C:\Program Files (x86)\Windows Sidebar\121e5b5079f7c0 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\69ddcba757bf72 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe File created C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe File created C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe -
Drops file in Windows directory 3 IoCs
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exedescription ioc process File created C:\Windows\WaaS\services\sppsvc.exe 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe File created C:\Windows\Help\System.exe 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe File created C:\Windows\Help\27d1bcfc3c54e0 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 30 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4740 schtasks.exe 5108 schtasks.exe 1420 schtasks.exe 2888 schtasks.exe 3632 schtasks.exe 3320 schtasks.exe 1484 schtasks.exe 4900 schtasks.exe 1880 schtasks.exe 3528 schtasks.exe 2056 schtasks.exe 3980 schtasks.exe 2276 schtasks.exe 2924 schtasks.exe 3332 schtasks.exe 3128 schtasks.exe 1056 schtasks.exe 1380 schtasks.exe 312 schtasks.exe 4132 schtasks.exe 4244 schtasks.exe 4812 schtasks.exe 368 schtasks.exe 3824 schtasks.exe 4520 schtasks.exe 628 schtasks.exe 4444 schtasks.exe 4228 schtasks.exe 1764 schtasks.exe 3112 schtasks.exe -
Modifies registry class 2 IoCs
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exesmss.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings smss.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exesmss.exepid process 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe 3808 smss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
smss.exepid process 3808 smss.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exesmss.exevssvc.exedescription pid process Token: SeDebugPrivilege 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Token: SeDebugPrivilege 3808 smss.exe Token: SeBackupPrivilege 3632 vssvc.exe Token: SeRestorePrivilege 3632 vssvc.exe Token: SeAuditPrivilege 3632 vssvc.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.execmd.exesmss.exedescription pid process target process PID 2144 wrote to memory of 2476 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe cmd.exe PID 2144 wrote to memory of 2476 2144 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe cmd.exe PID 2476 wrote to memory of 3300 2476 cmd.exe w32tm.exe PID 2476 wrote to memory of 3300 2476 cmd.exe w32tm.exe PID 2476 wrote to memory of 3808 2476 cmd.exe smss.exe PID 2476 wrote to memory of 3808 2476 cmd.exe smss.exe PID 3808 wrote to memory of 4920 3808 smss.exe WScript.exe PID 3808 wrote to memory of 4920 3808 smss.exe WScript.exe PID 3808 wrote to memory of 1920 3808 smss.exe WScript.exe PID 3808 wrote to memory of 1920 3808 smss.exe WScript.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exesmss.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" smss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" smss.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe"C:\Users\Admin\AppData\Local\Temp\413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WeO8CiHSUz.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe"C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\232515ec-cf0c-4aaf-b1e4-c053ab764ac4.vbs"4⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6d278c5-41f5-4c71-9055-af18bbee99b4.vbs"4⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\odt\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\odt\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\Help\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Help\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exeFilesize
2.9MB
MD59781aaa439fcf85da08d40c5c3e3909f
SHA1edd84aae94017cdde7dd564d2791c6389f98c01f
SHA256413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35
SHA51227be25ed8a4df487bbb3066a9d67ee8403cb91ec8f21aeb2367252c57cf209903f01f770394f6e9d05e627a7697a9ba446bea98f65f5be166f7be33c74dedd02
-
C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\smss.exeFilesize
2.9MB
MD59781aaa439fcf85da08d40c5c3e3909f
SHA1edd84aae94017cdde7dd564d2791c6389f98c01f
SHA256413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35
SHA51227be25ed8a4df487bbb3066a9d67ee8403cb91ec8f21aeb2367252c57cf209903f01f770394f6e9d05e627a7697a9ba446bea98f65f5be166f7be33c74dedd02
-
C:\Users\Admin\AppData\Local\Temp\232515ec-cf0c-4aaf-b1e4-c053ab764ac4.vbsFilesize
738B
MD581dabaaa2567214a38e43f0bd2f68c87
SHA130259b8cb6f815fa89adc6332c55f182d39db411
SHA25611c9717fc59cf3a20e7bb52ad5784401d751e44d84a772d141c56ad71aacb0df
SHA5127502428ea602549e2c94a12df19fafe73b854e816ab664a6bb7d230d28490f7782ea50f2de008d6461eb53777600c3d074fcc583ab57cc1ee664c9989950a10b
-
C:\Users\Admin\AppData\Local\Temp\WeO8CiHSUz.batFilesize
227B
MD5cc7bd8f76ff46bed12676785a0b62677
SHA1509be54ed0db3ae1adfb0be78f315dcdf395d6ba
SHA2561ebc2c20717100054afaeb71749e65fd73dddda535a0c2ccc6f7f12b8ad4d3f1
SHA512c8d1060d9ae948b65a3432e81efdb52e9d3e04d94b27fb283c082e9ce82c4132674988b5ac689bb0607f9a5eade8ae319c05ab4bda2d33829af91f66aabec3cc
-
C:\Users\Admin\AppData\Local\Temp\a6d278c5-41f5-4c71-9055-af18bbee99b4.vbsFilesize
514B
MD560daabfb15d85d0e06b5a314ee051a55
SHA1c4149208ad99fbe30cc1f3cca4ae12bb7c36c341
SHA2562dba22d64f60ebf6d5c68bc7e6498c882432948a39dd24500e17548b02d18686
SHA5125a64c010d20d08c1ea30d85553a3fbce5c41b8008cf2cccb9c9d847fd9457f3008525f62a00857e016d5ef1b86b3cc8cb2fba0d188228d46ca1e326760aa0297
-
C:\odt\lsass.exeFilesize
2.9MB
MD59781aaa439fcf85da08d40c5c3e3909f
SHA1edd84aae94017cdde7dd564d2791c6389f98c01f
SHA256413e93938387abf6009f38e415cdbb6d2c800a4a163cd3987c68bee89d432f35
SHA51227be25ed8a4df487bbb3066a9d67ee8403cb91ec8f21aeb2367252c57cf209903f01f770394f6e9d05e627a7697a9ba446bea98f65f5be166f7be33c74dedd02
-
memory/2144-133-0x00000000009F0000-0x0000000000CD6000-memory.dmpFilesize
2.9MB
-
memory/2144-134-0x000000001B970000-0x000000001B980000-memory.dmpFilesize
64KB
-
memory/2144-135-0x000000001B8F0000-0x000000001B940000-memory.dmpFilesize
320KB
-
memory/2144-136-0x000000001D1A0000-0x000000001D6C8000-memory.dmpFilesize
5.2MB