Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 11:11
Behavioral task
behavioral1
Sample
b5dfa64f79e3272dd6ccb91a40a3206c.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b5dfa64f79e3272dd6ccb91a40a3206c.exe
Resource
win10v2004-20230221-en
General
-
Target
b5dfa64f79e3272dd6ccb91a40a3206c.exe
-
Size
1.5MB
-
MD5
b5dfa64f79e3272dd6ccb91a40a3206c
-
SHA1
ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
-
SHA256
68da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
-
SHA512
c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
SSDEEP
49152:Ug7eMAlDZSskPpc6r1deUNWiP3XtGfAGOw:UJMAlDAdPpF1YbifXtg9
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 976 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 568 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4252 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1428 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1264 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1060 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1640 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4696 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 732 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3576 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4056 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3548 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1664 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3264 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4280 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 216 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2116 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 660 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4984 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4968 1940 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1848 1940 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/2752-133-0x0000000000F20000-0x00000000010AE000-memory.dmp dcrat C:\odt\winlogon.exe dcrat C:\Windows\Registration\RuntimeBroker.exe dcrat C:\Windows\Registration\RuntimeBroker.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation b5dfa64f79e3272dd6ccb91a40a3206c.exe -
Executes dropped EXE 1 IoCs
Processes:
RuntimeBroker.exepid process 3804 RuntimeBroker.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ipinfo.io 23 ipinfo.io -
Drops file in Program Files directory 5 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exedescription ioc process File created C:\Program Files\Windows Sidebar\Gadgets\winlogon.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\winlogon.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files\Windows Sidebar\Gadgets\cc11b995f2a76d b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\6ccacd8608530f b5dfa64f79e3272dd6ccb91a40a3206c.exe -
Drops file in Windows directory 4 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exedescription ioc process File created C:\Windows\Registration\RuntimeBroker.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Windows\Registration\9e8d7a4ca61bd9 b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Windows\Logs\SIH\upfc.exe b5dfa64f79e3272dd6ccb91a40a3206c.exe File created C:\Windows\Logs\SIH\ea1d8f6d871115 b5dfa64f79e3272dd6ccb91a40a3206c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3548 schtasks.exe 1664 schtasks.exe 1264 schtasks.exe 4252 schtasks.exe 1428 schtasks.exe 2456 schtasks.exe 4696 schtasks.exe 3576 schtasks.exe 4056 schtasks.exe 3264 schtasks.exe 976 schtasks.exe 4984 schtasks.exe 2736 schtasks.exe 1848 schtasks.exe 3216 schtasks.exe 1060 schtasks.exe 1640 schtasks.exe 732 schtasks.exe 4280 schtasks.exe 216 schtasks.exe 2116 schtasks.exe 660 schtasks.exe 568 schtasks.exe 4968 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\Local Settings b5dfa64f79e3272dd6ccb91a40a3206c.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeRuntimeBroker.exepid process 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe 2232 powershell.exe 2232 powershell.exe 3912 powershell.exe 3912 powershell.exe 4796 powershell.exe 4796 powershell.exe 4344 powershell.exe 4344 powershell.exe 3560 powershell.exe 3560 powershell.exe 2100 powershell.exe 2100 powershell.exe 3560 powershell.exe 4256 powershell.exe 4256 powershell.exe 3228 powershell.exe 3228 powershell.exe 2120 powershell.exe 2120 powershell.exe 2100 powershell.exe 3912 powershell.exe 2232 powershell.exe 4796 powershell.exe 4344 powershell.exe 2120 powershell.exe 3228 powershell.exe 4256 powershell.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe 3804 RuntimeBroker.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RuntimeBroker.exepid process 3804 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeRuntimeBroker.exedescription pid process Token: SeDebugPrivilege 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeDebugPrivilege 4344 powershell.exe Token: SeDebugPrivilege 3560 powershell.exe Token: SeDebugPrivilege 2120 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeDebugPrivilege 4256 powershell.exe Token: SeDebugPrivilege 3228 powershell.exe Token: SeDebugPrivilege 3804 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
b5dfa64f79e3272dd6ccb91a40a3206c.execmd.exedescription pid process target process PID 2752 wrote to memory of 4796 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 4796 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 2232 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 2232 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 4344 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 4344 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 2120 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 2120 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 3912 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 3912 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 4256 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 4256 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 2100 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 2100 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 3560 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 3560 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 3228 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 3228 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe powershell.exe PID 2752 wrote to memory of 1980 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe cmd.exe PID 2752 wrote to memory of 1980 2752 b5dfa64f79e3272dd6ccb91a40a3206c.exe cmd.exe PID 1980 wrote to memory of 2736 1980 cmd.exe w32tm.exe PID 1980 wrote to memory of 2736 1980 cmd.exe w32tm.exe PID 1980 wrote to memory of 3804 1980 cmd.exe RuntimeBroker.exe PID 1980 wrote to memory of 3804 1980 cmd.exe RuntimeBroker.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5dfa64f79e3272dd6ccb91a40a3206c.exe"C:\Users\Admin\AppData\Local\Temp\b5dfa64f79e3272dd6ccb91a40a3206c.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\RuntimeBroker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\winlogon.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\sppsvc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\winlogon.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\b5dfa64f79e3272dd6ccb91a40a3206c.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\SIH\upfc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\SppExtComObj.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\PrintHood\b5dfa64f79e3272dd6ccb91a40a3206c.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R7zgRx03dO.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Windows\Registration\RuntimeBroker.exe"C:\Windows\Registration\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\Gadgets\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Application Data\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\odt\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\Logs\SIH\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Logs\SIH\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Windows\Logs\SIH\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\odt\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "b5dfa64f79e3272dd6ccb91a40a3206cb" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\PrintHood\b5dfa64f79e3272dd6ccb91a40a3206c.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "b5dfa64f79e3272dd6ccb91a40a3206c" /sc ONLOGON /tr "'C:\Users\Admin\PrintHood\b5dfa64f79e3272dd6ccb91a40a3206c.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "b5dfa64f79e3272dd6ccb91a40a3206cb" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\PrintHood\b5dfa64f79e3272dd6ccb91a40a3206c.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Temp\R7zgRx03dO.batFilesize
206B
MD5ecde0e5b5db636b60ef562f72697afb0
SHA121e2de87e32e12ee233ecc9faef7593c2fc8ee3a
SHA25699b369e3dc2a0c4470b79c64c1ea7dd798af3b484ebac79534b8f411b02e4ca9
SHA5126da1a0fc86d33dc8f22cbd5d7d56961f7bab3b0f6088a53dd4c57066ef9bb01386c428cb630e6c4fb5b8849736f7eab6421f6aaf3f1a070f555620cb9308974b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pxrqcbcb.yqy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\Registration\RuntimeBroker.exeFilesize
1.5MB
MD5b5dfa64f79e3272dd6ccb91a40a3206c
SHA1ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
SHA25668da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
SHA512c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
C:\Windows\Registration\RuntimeBroker.exeFilesize
1.5MB
MD5b5dfa64f79e3272dd6ccb91a40a3206c
SHA1ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
SHA25668da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
SHA512c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
C:\odt\winlogon.exeFilesize
1.5MB
MD5b5dfa64f79e3272dd6ccb91a40a3206c
SHA1ca02a91baa75c5e7ca5f0a5a28e3187ab87778e4
SHA25668da9464f3455f8a65b4bc540f00c525ebf26a05cd6b07f1d5ad3e76f2f43469
SHA512c9f32e08351f405d0c1bd40da364a9f30c494ade9a775039494d9ebbf1fa2835879ed333a2b5b6ea3e7d37bad815f00563f107c3aeeba7bd065be6ba96808289
-
memory/2100-246-0x000001DC5DD70000-0x000001DC5DD80000-memory.dmpFilesize
64KB
-
memory/2120-243-0x00000253E5940000-0x00000253E5950000-memory.dmpFilesize
64KB
-
memory/2232-241-0x000002334ADB0000-0x000002334ADC0000-memory.dmpFilesize
64KB
-
memory/2232-166-0x000002334AD20000-0x000002334AD42000-memory.dmpFilesize
136KB
-
memory/2232-240-0x000002334ADB0000-0x000002334ADC0000-memory.dmpFilesize
64KB
-
memory/2752-133-0x0000000000F20000-0x00000000010AE000-memory.dmpFilesize
1.6MB
-
memory/2752-134-0x000000001BCB0000-0x000000001BCC0000-memory.dmpFilesize
64KB
-
memory/2752-135-0x000000001CEC0000-0x000000001CF10000-memory.dmpFilesize
320KB
-
memory/2752-136-0x000000001D610000-0x000000001DB38000-memory.dmpFilesize
5.2MB
-
memory/3228-250-0x000001ECE02E0000-0x000001ECE02F0000-memory.dmpFilesize
64KB
-
memory/3560-248-0x0000020626570000-0x0000020626580000-memory.dmpFilesize
64KB
-
memory/3560-247-0x0000020626570000-0x0000020626580000-memory.dmpFilesize
64KB
-
memory/3560-252-0x0000020626570000-0x0000020626580000-memory.dmpFilesize
64KB
-
memory/3804-274-0x0000000021AF0000-0x0000000021CB2000-memory.dmpFilesize
1.8MB
-
memory/3912-242-0x0000014477000000-0x0000014477010000-memory.dmpFilesize
64KB
-
memory/4256-249-0x000001CA76B80000-0x000001CA76B90000-memory.dmpFilesize
64KB
-
memory/4256-251-0x000001CA76B80000-0x000001CA76B90000-memory.dmpFilesize
64KB
-
memory/4344-245-0x0000021F9DCE0000-0x0000021F9DCF0000-memory.dmpFilesize
64KB
-
memory/4796-244-0x0000020DB2E40000-0x0000020DB2E50000-memory.dmpFilesize
64KB