Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08-06-2023 09:02
Behavioral task
behavioral1
Sample
231efb7ab5b36cda91e06456480228c1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
231efb7ab5b36cda91e06456480228c1.exe
Resource
win10v2004-20230220-en
General
-
Target
231efb7ab5b36cda91e06456480228c1.exe
-
Size
1.3MB
-
MD5
231efb7ab5b36cda91e06456480228c1
-
SHA1
11edb782a254ead91bef459fb4dac0ca393ffeaf
-
SHA256
5d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d
-
SHA512
c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017
-
SSDEEP
24576:9urfikuV13mFFkwIuKOaZDIpw6P/KlBrJ/GB+8xNEJn:eiku13qF1jtpwG/KR/YxNEJ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4752 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4620 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1048 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4176 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2736 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1320 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4184 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4532 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1144 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3920 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4912 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1324 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 264 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4300 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1452 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3100 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2748 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2324 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4484 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3136 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1208 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2896 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1708 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4832 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1516 3344 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4020 3344 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/848-133-0x0000000000AD0000-0x0000000000C24000-memory.dmp dcrat C:\Users\Admin\wininit.exe dcrat C:\Windows\Performance\WinSAT\DataStore\winlogon.exe dcrat C:\Windows\Performance\WinSAT\DataStore\winlogon.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
231efb7ab5b36cda91e06456480228c1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation 231efb7ab5b36cda91e06456480228c1.exe -
Executes dropped EXE 1 IoCs
Processes:
winlogon.exepid process 752 winlogon.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 49 ipinfo.io 50 ipinfo.io -
Drops file in Program Files directory 5 IoCs
Processes:
231efb7ab5b36cda91e06456480228c1.exedescription ioc process File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe 231efb7ab5b36cda91e06456480228c1.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\5940a34987c991 231efb7ab5b36cda91e06456480228c1.exe File created C:\Program Files (x86)\Windows Defender\de-DE\taskhostw.exe 231efb7ab5b36cda91e06456480228c1.exe File created C:\Program Files (x86)\Windows Defender\de-DE\ea9f0e6c9e2dcd 231efb7ab5b36cda91e06456480228c1.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe 231efb7ab5b36cda91e06456480228c1.exe -
Drops file in Windows directory 6 IoCs
Processes:
231efb7ab5b36cda91e06456480228c1.exedescription ioc process File created C:\Windows\Performance\WinSAT\DataStore\winlogon.exe 231efb7ab5b36cda91e06456480228c1.exe File created C:\Windows\Performance\WinSAT\DataStore\cc11b995f2a76d 231efb7ab5b36cda91e06456480228c1.exe File created C:\Windows\TAPI\SppExtComObj.exe 231efb7ab5b36cda91e06456480228c1.exe File created C:\Windows\TAPI\e1ef82546f0b02 231efb7ab5b36cda91e06456480228c1.exe File created C:\Windows\PLA\Rules\ja-JP\dllhost.exe 231efb7ab5b36cda91e06456480228c1.exe File created C:\Windows\PLA\Rules\ja-JP\5940a34987c991 231efb7ab5b36cda91e06456480228c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1208 schtasks.exe 404 schtasks.exe 3920 schtasks.exe 3136 schtasks.exe 1452 schtasks.exe 1980 schtasks.exe 4484 schtasks.exe 4184 schtasks.exe 4532 schtasks.exe 1144 schtasks.exe 2896 schtasks.exe 1048 schtasks.exe 4176 schtasks.exe 1448 schtasks.exe 2692 schtasks.exe 1324 schtasks.exe 264 schtasks.exe 4300 schtasks.exe 3100 schtasks.exe 2324 schtasks.exe 2736 schtasks.exe 4020 schtasks.exe 4620 schtasks.exe 1708 schtasks.exe 4752 schtasks.exe 1320 schtasks.exe 4912 schtasks.exe 220 schtasks.exe 2748 schtasks.exe 4048 schtasks.exe 4832 schtasks.exe 1516 schtasks.exe 2924 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
231efb7ab5b36cda91e06456480228c1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings 231efb7ab5b36cda91e06456480228c1.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
231efb7ab5b36cda91e06456480228c1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exepid process 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 848 231efb7ab5b36cda91e06456480228c1.exe 3848 powershell.exe 3848 powershell.exe 4536 powershell.exe 4536 powershell.exe 4612 powershell.exe 4612 powershell.exe 2732 powershell.exe 2732 powershell.exe 3852 powershell.exe 3852 powershell.exe 4644 powershell.exe 4644 powershell.exe 2724 powershell.exe 2724 powershell.exe 4640 powershell.exe 4640 powershell.exe 2752 powershell.exe 2752 powershell.exe 5036 powershell.exe 5036 powershell.exe 4320 powershell.exe 4320 powershell.exe 2632 powershell.exe 2632 powershell.exe 4644 powershell.exe 5036 powershell.exe 3848 powershell.exe 2732 powershell.exe 3852 powershell.exe 4612 powershell.exe 4536 powershell.exe 4320 powershell.exe 4640 powershell.exe 2752 powershell.exe 2632 powershell.exe 2724 powershell.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe 752 winlogon.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
winlogon.exepid process 752 winlogon.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
231efb7ab5b36cda91e06456480228c1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinlogon.exedescription pid process Token: SeDebugPrivilege 848 231efb7ab5b36cda91e06456480228c1.exe Token: SeDebugPrivilege 3848 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4612 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 3852 powershell.exe Token: SeDebugPrivilege 4644 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeDebugPrivilege 5036 powershell.exe Token: SeDebugPrivilege 4640 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 752 winlogon.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
231efb7ab5b36cda91e06456480228c1.execmd.exedescription pid process target process PID 848 wrote to memory of 2732 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2732 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 3852 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 3852 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 3848 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 3848 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4644 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4644 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4612 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4612 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4320 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4320 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4536 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4536 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4640 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 4640 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2632 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2632 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2752 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2752 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 5036 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 5036 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2724 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2724 848 231efb7ab5b36cda91e06456480228c1.exe powershell.exe PID 848 wrote to memory of 2012 848 231efb7ab5b36cda91e06456480228c1.exe cmd.exe PID 848 wrote to memory of 2012 848 231efb7ab5b36cda91e06456480228c1.exe cmd.exe PID 2012 wrote to memory of 3968 2012 cmd.exe w32tm.exe PID 2012 wrote to memory of 3968 2012 cmd.exe w32tm.exe PID 2012 wrote to memory of 752 2012 cmd.exe winlogon.exe PID 2012 wrote to memory of 752 2012 cmd.exe winlogon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\231efb7ab5b36cda91e06456480228c1.exe"C:\Users\Admin\AppData\Local\Temp\231efb7ab5b36cda91e06456480228c1.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\231efb7ab5b36cda91e06456480228c1.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Rules\ja-JP\dllhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\SppExtComObj.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\RuntimeBroker.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\taskhostw.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\upfc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\winlogon.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\wininit.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\System.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tK5V0ixFoN.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Windows\Performance\WinSAT\DataStore\winlogon.exe"C:\Windows\Performance\WinSAT\DataStore\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\odt\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\odt\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\odt\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Windows\Performance\WinSAT\DataStore\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Libraries\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Public\Libraries\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Libraries\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\TAPI\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Rules\ja-JP\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\PLA\Rules\ja-JP\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\PLA\Rules\ja-JP\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_14mvb1s3.2am.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tK5V0ixFoN.batFilesize
217B
MD5305395a1ebfa78a7de235eb0b784cd7e
SHA168fd44d74c77b666105d5951e47be3676fa92466
SHA256bdc593defca7d54539985ed8fa899c31ba29d077988b3b091ff4cd6a67d788b2
SHA512120ba29d5d1675871ccd693ca692523de25f865cea3acda49f5a8b95d2f4acc41a90a2616847515ccbd9b2a1d4f2b614fc29c3c48282b3f4e973c9b7a9610d30
-
C:\Users\Admin\wininit.exeFilesize
1.3MB
MD5231efb7ab5b36cda91e06456480228c1
SHA111edb782a254ead91bef459fb4dac0ca393ffeaf
SHA2565d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d
SHA512c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017
-
C:\Windows\Performance\WinSAT\DataStore\winlogon.exeFilesize
1.3MB
MD5231efb7ab5b36cda91e06456480228c1
SHA111edb782a254ead91bef459fb4dac0ca393ffeaf
SHA2565d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d
SHA512c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017
-
C:\Windows\Performance\WinSAT\DataStore\winlogon.exeFilesize
1.3MB
MD5231efb7ab5b36cda91e06456480228c1
SHA111edb782a254ead91bef459fb4dac0ca393ffeaf
SHA2565d876dee883aabe22c89e9332d18d41580e7dc5c5030be843538b5a11c053a1d
SHA512c51446bf048412031b5ea5c09b55b8c1ba8d3319eaf84cda647c0048f919a9f408220200ae1d405acd54557af9626a91e03789573a556ccafea9b7bfbcec2017
-
memory/752-328-0x000000001C7A0000-0x000000001C962000-memory.dmpFilesize
1.8MB
-
memory/752-327-0x000000001B670000-0x000000001B680000-memory.dmpFilesize
64KB
-
memory/752-329-0x000000001D2E0000-0x000000001D808000-memory.dmpFilesize
5.2MB
-
memory/848-134-0x000000001B820000-0x000000001B830000-memory.dmpFilesize
64KB
-
memory/848-133-0x0000000000AD0000-0x0000000000C24000-memory.dmpFilesize
1.3MB
-
memory/848-135-0x000000001B750000-0x000000001B7A0000-memory.dmpFilesize
320KB
-
memory/2632-280-0x000001E51D7E0000-0x000001E51D7F0000-memory.dmpFilesize
64KB
-
memory/2724-261-0x0000016BEC8A0000-0x0000016BEC8B0000-memory.dmpFilesize
64KB
-
memory/2724-284-0x0000016BEC8A0000-0x0000016BEC8B0000-memory.dmpFilesize
64KB
-
memory/2724-299-0x0000016BEC8A0000-0x0000016BEC8B0000-memory.dmpFilesize
64KB
-
memory/2732-226-0x000001FAA2F00000-0x000001FAA2F10000-memory.dmpFilesize
64KB
-
memory/2732-301-0x000001FAA2F00000-0x000001FAA2F10000-memory.dmpFilesize
64KB
-
memory/2732-294-0x000001FAA2F00000-0x000001FAA2F10000-memory.dmpFilesize
64KB
-
memory/2752-298-0x0000015ECE600000-0x0000015ECE610000-memory.dmpFilesize
64KB
-
memory/2752-290-0x0000015ECE600000-0x0000015ECE610000-memory.dmpFilesize
64KB
-
memory/3848-164-0x000001FD44CC0000-0x000001FD44CD0000-memory.dmpFilesize
64KB
-
memory/3848-293-0x000001FD44CC0000-0x000001FD44CD0000-memory.dmpFilesize
64KB
-
memory/3848-176-0x000001FD44C80000-0x000001FD44CA2000-memory.dmpFilesize
136KB
-
memory/3852-295-0x00000236EB500000-0x00000236EB510000-memory.dmpFilesize
64KB
-
memory/3852-163-0x00000236EB500000-0x00000236EB510000-memory.dmpFilesize
64KB
-
memory/3852-300-0x00000236EB500000-0x00000236EB510000-memory.dmpFilesize
64KB
-
memory/3852-165-0x00000236EB500000-0x00000236EB510000-memory.dmpFilesize
64KB
-
memory/4320-185-0x00000246FCEF0000-0x00000246FCF00000-memory.dmpFilesize
64KB
-
memory/4320-302-0x00000246FCEF0000-0x00000246FCF00000-memory.dmpFilesize
64KB
-
memory/4320-202-0x00000246FCEF0000-0x00000246FCF00000-memory.dmpFilesize
64KB
-
memory/4536-296-0x000002E6340E0000-0x000002E6340F0000-memory.dmpFilesize
64KB
-
memory/4536-291-0x000002E6340E0000-0x000002E6340F0000-memory.dmpFilesize
64KB
-
memory/4536-177-0x000002E6340E0000-0x000002E6340F0000-memory.dmpFilesize
64KB
-
memory/4536-166-0x000002E6340E0000-0x000002E6340F0000-memory.dmpFilesize
64KB
-
memory/4612-236-0x000001D377C80000-0x000001D377C90000-memory.dmpFilesize
64KB
-
memory/4640-297-0x000001FFF9A70000-0x000001FFF9A80000-memory.dmpFilesize
64KB
-
memory/4640-285-0x000001FFF9A70000-0x000001FFF9A80000-memory.dmpFilesize
64KB
-
memory/4644-242-0x0000028D747C0000-0x0000028D747D0000-memory.dmpFilesize
64KB
-
memory/5036-292-0x00000231B98D0000-0x00000231B98E0000-memory.dmpFilesize
64KB
-
memory/5036-286-0x00000231B98D0000-0x00000231B98E0000-memory.dmpFilesize
64KB