Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-05-2023 05:41
Behavioral task
behavioral1
Sample
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe
Resource
win10v2004-20230220-en
General
-
Target
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe
-
Size
1.3MB
-
MD5
6f6a61090a9add724eebbec1c558826b
-
SHA1
566ea8db4bcea2d078fb71be08bc8e7003e36119
-
SHA256
c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
-
SHA512
47d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
SSDEEP
24576:4LS70OsASkYS827M+8NFNzmJd+eVjW2LGLrk2WKiT:gS70OfRhxW1c2vi
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1716 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1732 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1312 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 748 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1772 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1216 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1068 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1568 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 872 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 836 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1832 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1884 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1388 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1120 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1992 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 364 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 944 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1732 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1912 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1900 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1440 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1544 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1168 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1132 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1768 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1832 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1068 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1012 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 240 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1428 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 284 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1948 580 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1824 580 schtasks.exe -
Processes:
resource yara_rule behavioral1/memory/1292-54-0x0000000001290000-0x00000000013E2000-memory.dmp dcrat C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\taskhost.exe dcrat C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe dcrat C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe dcrat behavioral1/memory/288-97-0x00000000008B0000-0x0000000000A02000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
lsm.exepid process 288 lsm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 12 IoCs
Processes:
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exedescription ioc process File created C:\Program Files (x86)\MSBuild\lsm.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files (x86)\MSBuild\101b941d020240 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\b75386f1303e64 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\winlogon.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files\Mozilla Firefox\fonts\69ddcba757bf72 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\cc11b995f2a76d C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\taskhost.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files (x86)\Windows NT\TableTextService\spoolsv.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files (x86)\Windows NT\TableTextService\f3b6ecef712a24 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files\Uninstall Information\spoolsv.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files\Uninstall Information\f3b6ecef712a24 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Program Files\Mozilla Firefox\fonts\smss.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe -
Drops file in Windows directory 6 IoCs
Processes:
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exedescription ioc process File created C:\Windows\Help\System.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Windows\Help\27d1bcfc3c54e0 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Windows\ja-JP\lsass.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Windows\ja-JP\6203df4a6bafc7 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Windows\Performance\WinSAT\DataStore\smss.exe C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe File created C:\Windows\Performance\WinSAT\DataStore\69ddcba757bf72 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1772 schtasks.exe 1088 schtasks.exe 1588 schtasks.exe 1992 schtasks.exe 1600 schtasks.exe 1832 schtasks.exe 1312 schtasks.exe 1528 schtasks.exe 748 schtasks.exe 1120 schtasks.exe 944 schtasks.exe 1544 schtasks.exe 284 schtasks.exe 1900 schtasks.exe 1168 schtasks.exe 1216 schtasks.exe 1568 schtasks.exe 1884 schtasks.exe 1388 schtasks.exe 1448 schtasks.exe 1912 schtasks.exe 1068 schtasks.exe 1012 schtasks.exe 1948 schtasks.exe 872 schtasks.exe 936 schtasks.exe 240 schtasks.exe 1728 schtasks.exe 1768 schtasks.exe 1832 schtasks.exe 1684 schtasks.exe 1768 schtasks.exe 1428 schtasks.exe 1716 schtasks.exe 1732 schtasks.exe 1836 schtasks.exe 836 schtasks.exe 1132 schtasks.exe 1824 schtasks.exe 1196 schtasks.exe 1068 schtasks.exe 364 schtasks.exe 1184 schtasks.exe 1732 schtasks.exe 1440 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exelsm.exepid process 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe 288 lsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exelsm.exedescription pid process Token: SeDebugPrivilege 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe Token: SeDebugPrivilege 288 lsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
lsm.exepid process 288 lsm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exedescription pid process target process PID 1292 wrote to memory of 288 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe lsm.exe PID 1292 wrote to memory of 288 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe lsm.exe PID 1292 wrote to memory of 288 1292 C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe lsm.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe"C:\Users\Admin\AppData\Local\Temp\C6244C8E4E4CDECD641017D52D344B1DB6A23D05FD6A8.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\Help\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Help\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\ja-JP\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ja-JP\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\ja-JP\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\f8d1ec42-b1b7-11ed-bba7-be56d16f7d95\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\WinSAT\DataStore\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\fonts\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\fonts\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\fonts\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Common Files\SpeechEngines\Microsoft\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exeFilesize
1.3MB
MD56f6a61090a9add724eebbec1c558826b
SHA1566ea8db4bcea2d078fb71be08bc8e7003e36119
SHA256c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
SHA51247d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\lsm.exeFilesize
1.3MB
MD56f6a61090a9add724eebbec1c558826b
SHA1566ea8db4bcea2d078fb71be08bc8e7003e36119
SHA256c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
SHA51247d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\taskhost.exeFilesize
1.3MB
MD56f6a61090a9add724eebbec1c558826b
SHA1566ea8db4bcea2d078fb71be08bc8e7003e36119
SHA256c6244c8e4e4cdecd641017d52d344b1db6a23d05fd6a8ad338c8f4f77481f483
SHA51247d88347a9082186b9667fcf3994d2fe212f09a5665cc82017d48f8833e8a67823b6b66bf3a5dbda5369dd6d1585248389e213a4b3556e8b0b0b66c137eb8aa8
-
memory/288-99-0x000000001B390000-0x000000001B410000-memory.dmpFilesize
512KB
-
memory/288-108-0x000000001B390000-0x000000001B410000-memory.dmpFilesize
512KB
-
memory/288-133-0x000000001B390000-0x000000001B410000-memory.dmpFilesize
512KB
-
memory/288-132-0x000000001B390000-0x000000001B410000-memory.dmpFilesize
512KB
-
memory/288-131-0x000000001B390000-0x000000001B410000-memory.dmpFilesize
512KB
-
memory/288-109-0x000000001B390000-0x000000001B410000-memory.dmpFilesize
512KB
-
memory/288-98-0x0000000000410000-0x0000000000422000-memory.dmpFilesize
72KB
-
memory/288-97-0x00000000008B0000-0x0000000000A02000-memory.dmpFilesize
1.3MB
-
memory/1292-55-0x000000001B1B0000-0x000000001B230000-memory.dmpFilesize
512KB
-
memory/1292-54-0x0000000001290000-0x00000000013E2000-memory.dmpFilesize
1.3MB
-
memory/1292-57-0x0000000000470000-0x0000000000486000-memory.dmpFilesize
88KB
-
memory/1292-56-0x00000000002C0000-0x00000000002DC000-memory.dmpFilesize
112KB
-
memory/1292-58-0x00000000002E0000-0x00000000002F2000-memory.dmpFilesize
72KB
-
memory/1292-60-0x0000000000640000-0x0000000000648000-memory.dmpFilesize
32KB
-
memory/1292-59-0x0000000000630000-0x000000000063E000-memory.dmpFilesize
56KB