Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
52e0c294963f6cd10e3104901c936a3e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52e0c294963f6cd10e3104901c936a3e.exe
Resource
win10v2004-20231215-en
General
-
Target
52e0c294963f6cd10e3104901c936a3e.exe
-
Size
2.0MB
-
MD5
52e0c294963f6cd10e3104901c936a3e
-
SHA1
fa78c9a910b904cfc412cef1b422934243f6f0ff
-
SHA256
77d8062a27308c826de456d4e430ebcfb9315f87ae792bb23d8f21365c8b4fe7
-
SHA512
972bb0dbd66f984c41b64c09ff84fef138714929b13db0f03ca2e5257d92664dcf4fcf6d7e6fc99894b664bb9acbbbe5598787a2d10bf4e8d074dfd0487c5f3b
-
SSDEEP
49152:n0Le0UIxHI38h4kbJA9GOErel2MaHBKljpsREsSSUOmLY5sVQQ:ChJsIJAIMnaHBKcRoOusQ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 20 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1036 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3184 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4912 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2756 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2100 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2512 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4780 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3760 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3236 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 928 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4952 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 116 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3232 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 2700 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4508 2700 schtasks.exe 92 -
resource yara_rule behavioral2/memory/2308-3-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/2308-4-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/2308-26-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/392-31-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/392-29-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/392-45-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/1016-49-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/1016-48-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/1016-73-0x0000000000EC0000-0x0000000001312000-memory.dmp dcrat behavioral2/memory/3780-81-0x0000000000920000-0x0000000000D72000-memory.dmp dcrat behavioral2/memory/3780-79-0x0000000000920000-0x0000000000D72000-memory.dmp dcrat behavioral2/memory/3780-85-0x0000000000920000-0x0000000000D72000-memory.dmp dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 52e0c294963f6cd10e3104901c936a3e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 52e0c294963f6cd10e3104901c936a3e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 52e0c294963f6cd10e3104901c936a3e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorer.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 52e0c294963f6cd10e3104901c936a3e.exe -
Executes dropped EXE 1 IoCs
pid Process 3780 explorer.exe -
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Wine explorer.exe Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Wine 52e0c294963f6cd10e3104901c936a3e.exe Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Wine 52e0c294963f6cd10e3104901c936a3e.exe Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Wine 52e0c294963f6cd10e3104901c936a3e.exe -
Adds Run key to start application 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\System32\\RADCUI\\sihost.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Public\\Videos\\explorer.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\ttdplm\\fontdrvhost.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\System32\\KBDLA\\taskhostw.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\conhost.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\IdentityCRL\\production\\winlogon.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\PerfLogs\\RuntimeBroker.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Prefetch\\ReadyBoot\\fontdrvhost.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Recovery\\WindowsRE\\TextInputHost.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Admin\\3D Objects\\smss.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\WindowsRE\\services.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\AppExtension\\dwm.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Windows\\System32\\wbem\\wbemcntl\\WmiPrvSE.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\msafd\\lsass.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\ntshrui\\fontdrvhost.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Documents and Settings\\csrss.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Public\\Libraries\\explorer.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\52e0c294963f6cd10e3104901c936a3e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome_installer\\52e0c294963f6cd10e3104901c936a3e.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe -
Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\KBDLA\taskhostw.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\RADCUI\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\AppExtension\dwm.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\msafd\lsass.exe 52e0c294963f6cd10e3104901c936a3e.exe File opened for modification C:\Windows\SysWOW64\msafd\lsass.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\msafd\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\KBDLA\ea9f0e6c9e2dcd4dfacdaf29ba21541fb815a988 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\ntshrui\fontdrvhost.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\ttdplm\5b884080fd4f94e2695da25c503f9e33b9605b83 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\AppExtension\6cb0b6c459d5d3455a3da700e713f2e2529862ff 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\wbem\wbemcntl\24dbde2999530ef5fd907494bc374d663924116c 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\ntshrui\5b884080fd4f94e2695da25c503f9e33b9605b83 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\RADCUI\sihost.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\ttdplm\fontdrvhost.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\wbem\wbemcntl\WmiPrvSE.exe 52e0c294963f6cd10e3104901c936a3e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2308 52e0c294963f6cd10e3104901c936a3e.exe 392 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 3780 explorer.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Portable Devices\conhost.exe 52e0c294963f6cd10e3104901c936a3e.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\conhost.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Program Files (x86)\Windows Portable Devices\088424020bedd6b28ac7fd22ee35dcd7322895ce 52e0c294963f6cd10e3104901c936a3e.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\IdentityCRL\production\cc11b995f2a76da408ea6a601e682e64743153ad 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\Prefetch\ReadyBoot\5b884080fd4f94e2695da25c503f9e33b9605b83 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\IdentityCRL\production\winlogon.exe 52e0c294963f6cd10e3104901c936a3e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 20 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1036 schtasks.exe 4912 schtasks.exe 2040 schtasks.exe 2512 schtasks.exe 3436 schtasks.exe 3760 schtasks.exe 928 schtasks.exe 2756 schtasks.exe 1796 schtasks.exe 1504 schtasks.exe 4952 schtasks.exe 4508 schtasks.exe 3236 schtasks.exe 116 schtasks.exe 3232 schtasks.exe 3184 schtasks.exe 5092 schtasks.exe 2100 schtasks.exe 2732 schtasks.exe 4780 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings 52e0c294963f6cd10e3104901c936a3e.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2308 52e0c294963f6cd10e3104901c936a3e.exe 2308 52e0c294963f6cd10e3104901c936a3e.exe 2308 52e0c294963f6cd10e3104901c936a3e.exe 392 52e0c294963f6cd10e3104901c936a3e.exe 392 52e0c294963f6cd10e3104901c936a3e.exe 392 52e0c294963f6cd10e3104901c936a3e.exe 392 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 1016 52e0c294963f6cd10e3104901c936a3e.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe 3780 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2308 52e0c294963f6cd10e3104901c936a3e.exe Token: SeDebugPrivilege 392 52e0c294963f6cd10e3104901c936a3e.exe Token: SeDebugPrivilege 1016 52e0c294963f6cd10e3104901c936a3e.exe Token: SeDebugPrivilege 3780 explorer.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2308 wrote to memory of 392 2308 52e0c294963f6cd10e3104901c936a3e.exe 96 PID 2308 wrote to memory of 392 2308 52e0c294963f6cd10e3104901c936a3e.exe 96 PID 2308 wrote to memory of 392 2308 52e0c294963f6cd10e3104901c936a3e.exe 96 PID 392 wrote to memory of 1016 392 52e0c294963f6cd10e3104901c936a3e.exe 105 PID 392 wrote to memory of 1016 392 52e0c294963f6cd10e3104901c936a3e.exe 105 PID 392 wrote to memory of 1016 392 52e0c294963f6cd10e3104901c936a3e.exe 105 PID 1016 wrote to memory of 2756 1016 52e0c294963f6cd10e3104901c936a3e.exe 117 PID 1016 wrote to memory of 2756 1016 52e0c294963f6cd10e3104901c936a3e.exe 117 PID 1016 wrote to memory of 2756 1016 52e0c294963f6cd10e3104901c936a3e.exe 117 PID 2756 wrote to memory of 884 2756 cmd.exe 116 PID 2756 wrote to memory of 884 2756 cmd.exe 116 PID 2756 wrote to memory of 884 2756 cmd.exe 116 PID 2756 wrote to memory of 1480 2756 cmd.exe 115 PID 2756 wrote to memory of 1480 2756 cmd.exe 115 PID 2756 wrote to memory of 1480 2756 cmd.exe 115 PID 1480 wrote to memory of 4676 1480 w32tm.exe 114 PID 1480 wrote to memory of 4676 1480 w32tm.exe 114 PID 2756 wrote to memory of 3780 2756 cmd.exe 126 PID 2756 wrote to memory of 3780 2756 cmd.exe 126 PID 2756 wrote to memory of 3780 2756 cmd.exe 126 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SlE2NiNjRg.bat"4⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Public\Libraries\explorer.exe"C:\Users\Public\Libraries\explorer.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\System32\RADCUI\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\ntshrui\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\System32\KBDLA\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2756 -
C:\Windows\SysWOW64\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:22⤵
- Suspicious use of WriteProcessMemory
PID:1480
-
-
C:\Windows\SysWOW64\chcp.comchcp 650012⤵PID:884
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "52e0c294963f6cd10e3104901c936a3e" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\chrome_installer\52e0c294963f6cd10e3104901c936a3e.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\msafd\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\ttdplm\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\3D Objects\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Videos\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\PerfLogs\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:928
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:21⤵PID:4676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\System32\wbem\wbemcntl\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\AppExtension\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Public\Libraries\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4508
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD528ce31ec8914f27613403c4243797333
SHA17aecf31733f5da4b4f8f2d6b92effa245c20b58f
SHA25620091169559621418fd07e5a15dd7a8c1e942fc8c592a7eeb86696f859d5f2a5
SHA51276178a8670c576ae6e9a6bb89a761181f3b469d497229cd932082cc927a5644382148523071348a0d6f26f7483058678ae1420602fe28a934efa40ba24418afa