Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
287s -
max time network
300s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11/04/2023, 08:29
Behavioral task
behavioral1
Sample
agentbroker-cleaned.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
agentbroker-cleaned.exe
Resource
win10v2004-20230220-en
General
-
Target
agentbroker-cleaned.exe
-
Size
324KB
-
MD5
13574e140395ffcbedf91cfbe7a3cdaf
-
SHA1
dcd4ce19754c56a5c0c65012fde8ac14c4932124
-
SHA256
7b2a00a5aa73f0bb88c2d4751423d55a9c30d3cc665e05a9710db83723223a35
-
SHA512
18b3e95aafaa0a55d29ac55ea54dc32b44d41f525407158c43b0cc18b2c58ed07b8db4f8cf9131a454145dbe79d35cd0197a70022c5125108176e3ff5a02ad03
-
SSDEEP
6144:K71egH5NLdW7/foTziLGm//2VWhdi1HbXPk7Dbc/Qf:K5BZNZW7/b56C0
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1096 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1000 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1044 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1544 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 748 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1896 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1036 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 812 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1364 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 668 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1064 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 836 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1240 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1160 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1624 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 576 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1340 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 868 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1092 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1940 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1456 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 432 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1596 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 520 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 676 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1580 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 748 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1944 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1804 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2012 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1000 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 328 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1076 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1464 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1972 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 816 1752 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 380 1752 schtasks.exe 27 -
resource yara_rule behavioral1/memory/1984-54-0x0000000001370000-0x00000000013C8000-memory.dmp dcrat behavioral1/files/0x00080000000122f5-64.dat dcrat behavioral1/files/0x00070000000126c9-94.dat dcrat behavioral1/files/0x0006000000014232-95.dat dcrat behavioral1/files/0x0006000000014232-96.dat dcrat behavioral1/memory/1472-97-0x0000000000860000-0x00000000008B8000-memory.dmp dcrat behavioral1/memory/1472-98-0x000000001B090000-0x000000001B110000-memory.dmp dcrat -
Executes dropped EXE 2 IoCs
pid Process 1416 System.exe 1472 agentbroker-cleaned.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ipinfo.io 6 ipinfo.io -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\agentbroker-cleaned.exe agentbroker-cleaned.exe File created C:\Program Files (x86)\Microsoft Sync Framework\agentbroker-cleaned.exe agentbroker-cleaned.exe File created C:\Program Files (x86)\Windows Sidebar\WMIADAP.exe agentbroker-cleaned.exe File created C:\Program Files\Google\Chrome\cc11b995f2a76d agentbroker-cleaned.exe File created C:\Program Files\DVD Maker\6cb0b6c459d5d3 agentbroker-cleaned.exe File created C:\Program Files\Windows NT\TableTextService\27d1bcfc3c54e0 agentbroker-cleaned.exe File created C:\Program Files (x86)\Windows Sidebar\agentbroker-cleaned.exe agentbroker-cleaned.exe File created C:\Program Files\Google\Chrome\1a9859f8bc2e9b agentbroker-cleaned.exe File created C:\Program Files\DVD Maker\dwm.exe agentbroker-cleaned.exe File created C:\Program Files (x86)\Microsoft Sync Framework\1a9859f8bc2e9b agentbroker-cleaned.exe File created C:\Program Files (x86)\Windows Sidebar\75a57c1bdf437c agentbroker-cleaned.exe File created C:\Program Files\Google\Chrome\winlogon.exe agentbroker-cleaned.exe File created C:\Program Files\Windows NT\TableTextService\System.exe agentbroker-cleaned.exe File created C:\Program Files (x86)\Windows Sidebar\1a9859f8bc2e9b agentbroker-cleaned.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\it-IT\csrss.exe agentbroker-cleaned.exe File created C:\Windows\it-IT\886983d96e3d3e agentbroker-cleaned.exe File created C:\Windows\twain_32\sppsvc.exe agentbroker-cleaned.exe File created C:\Windows\twain_32\0a1fd5f707cd16 agentbroker-cleaned.exe File created C:\Windows\ehome\ja-JP\dwm.exe agentbroker-cleaned.exe File created C:\Windows\ehome\ja-JP\6cb0b6c459d5d3 agentbroker-cleaned.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1096 schtasks.exe 1548 schtasks.exe 1364 schtasks.exe 576 schtasks.exe 1340 schtasks.exe 328 schtasks.exe 1600 schtasks.exe 1000 schtasks.exe 1044 schtasks.exe 748 schtasks.exe 1992 schtasks.exe 836 schtasks.exe 1160 schtasks.exe 1624 schtasks.exe 432 schtasks.exe 2044 schtasks.exe 1000 schtasks.exe 380 schtasks.exe 812 schtasks.exe 1880 schtasks.exe 1240 schtasks.exe 1740 schtasks.exe 2012 schtasks.exe 1588 schtasks.exe 520 schtasks.exe 1468 schtasks.exe 1464 schtasks.exe 1896 schtasks.exe 868 schtasks.exe 1528 schtasks.exe 1456 schtasks.exe 1596 schtasks.exe 748 schtasks.exe 1804 schtasks.exe 676 schtasks.exe 1580 schtasks.exe 1968 schtasks.exe 1972 schtasks.exe 1944 schtasks.exe 1704 schtasks.exe 1192 schtasks.exe 1932 schtasks.exe 1036 schtasks.exe 668 schtasks.exe 1064 schtasks.exe 1092 schtasks.exe 1544 schtasks.exe 1940 schtasks.exe 856 schtasks.exe 1076 schtasks.exe 816 schtasks.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 System.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 System.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 System.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 System.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 System.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 System.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1984 agentbroker-cleaned.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1984 agentbroker-cleaned.exe Token: SeDebugPrivilege 1472 agentbroker-cleaned.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1416 1984 agentbroker-cleaned.exe 79 PID 1984 wrote to memory of 1416 1984 agentbroker-cleaned.exe 79 PID 1984 wrote to memory of 1416 1984 agentbroker-cleaned.exe 79 PID 544 wrote to memory of 1472 544 taskeng.exe 81 PID 544 wrote to memory of 1472 544 taskeng.exe 81 PID 544 wrote to memory of 1472 544 taskeng.exe 81 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\agentbroker-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\agentbroker-cleaned.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\System.exe"C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\System.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1416
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 7 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\agentbroker-cleaned.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaned" /sc ONLOGON /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 14 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\WMIADAP.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\Chrome\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Saved Games\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\it-IT\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\agentbroker-cleaned.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaned" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\Chrome\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\DVD Maker\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files\DVD Maker\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\twain_32\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\TableTextService\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\TableTextService\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\agentbroker-cleaned.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaned" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\ehome\ja-JP\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\ehome\ja-JP\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1804
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\ehome\ja-JP\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Documents\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Documents\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Documents\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\agentbroker-cleaned.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaned" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "agentbroker-cleaneda" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\agentbroker-cleaned.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:380
-
C:\Windows\system32\taskeng.exetaskeng.exe {AD51B3F4-BA35-4F34-918C-280FE9448E4D} S-1-5-21-1914912747-3343861975-731272777-1000:TMRJMUQF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Program Files (x86)\Windows Sidebar\agentbroker-cleaned.exe"C:\Program Files (x86)\Windows Sidebar\agentbroker-cleaned.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
324KB
MD513574e140395ffcbedf91cfbe7a3cdaf
SHA1dcd4ce19754c56a5c0c65012fde8ac14c4932124
SHA2567b2a00a5aa73f0bb88c2d4751423d55a9c30d3cc665e05a9710db83723223a35
SHA51218b3e95aafaa0a55d29ac55ea54dc32b44d41f525407158c43b0cc18b2c58ed07b8db4f8cf9131a454145dbe79d35cd0197a70022c5125108176e3ff5a02ad03
-
Filesize
324KB
MD513574e140395ffcbedf91cfbe7a3cdaf
SHA1dcd4ce19754c56a5c0c65012fde8ac14c4932124
SHA2567b2a00a5aa73f0bb88c2d4751423d55a9c30d3cc665e05a9710db83723223a35
SHA51218b3e95aafaa0a55d29ac55ea54dc32b44d41f525407158c43b0cc18b2c58ed07b8db4f8cf9131a454145dbe79d35cd0197a70022c5125108176e3ff5a02ad03
-
Filesize
324KB
MD513574e140395ffcbedf91cfbe7a3cdaf
SHA1dcd4ce19754c56a5c0c65012fde8ac14c4932124
SHA2567b2a00a5aa73f0bb88c2d4751423d55a9c30d3cc665e05a9710db83723223a35
SHA51218b3e95aafaa0a55d29ac55ea54dc32b44d41f525407158c43b0cc18b2c58ed07b8db4f8cf9131a454145dbe79d35cd0197a70022c5125108176e3ff5a02ad03
-
Filesize
324KB
MD513574e140395ffcbedf91cfbe7a3cdaf
SHA1dcd4ce19754c56a5c0c65012fde8ac14c4932124
SHA2567b2a00a5aa73f0bb88c2d4751423d55a9c30d3cc665e05a9710db83723223a35
SHA51218b3e95aafaa0a55d29ac55ea54dc32b44d41f525407158c43b0cc18b2c58ed07b8db4f8cf9131a454145dbe79d35cd0197a70022c5125108176e3ff5a02ad03