Analysis
- max time kernel
96s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
10/03/2024, 10:51
Behavioral task
behavioral1
Sample
09eef44272d050d8054cf913ed7bbf48.exe
Resource
win7-20240221-en
windows7-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
09eef44272d050d8054cf913ed7bbf48.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 09eef44272d050d8054cf913ed7bbf48.exe
- Size 3.2MB
- Sample240310-mxtnnabb81
- SHA256 87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac
- MD5 09eef44272d050d8054cf913ed7bbf48
- SHA1 b4cd2add18e8445529b107d5ee847b89c70db333
- SHA512 867189c8cde505c22c377d4b68665c235e019b7127b3dbfdf4babdf8cd67985753898945d767c99122b3fe348b768e1e11bf3c340feedc0182c4c584a20ecf30
- SSDEEP 98304:Cc8eC24luyRsHatJTnXk8AkY9/7x0go6/e6BJ4:9kuyRsHSXk777oq3U
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- DcRat 52 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
description ioc pid Process 836 schtasks.exe 3976 schtasks.exe 628 schtasks.exe 2824 schtasks.exe 1128 schtasks.exe 2072 schtasks.exe 1928 schtasks.exe 2576 schtasks.exe 1612 schtasks.exe 4868 schtasks.exe 3312 schtasks.exe 1908 schtasks.exe 3024 schtasks.exe 60 schtasks.exe 4788 schtasks.exe 3040 schtasks.exe 1480 schtasks.exe 3792 schtasks.exe 1328 schtasks.exe 4444 schtasks.exe 4684 schtasks.exe 2208 schtasks.exe 4864 schtasks.exe 2956 schtasks.exe 4092 schtasks.exe 3308 schtasks.exe 2728 schtasks.exe 1536 schtasks.exe 2372 schtasks.exe 3008 schtasks.exe 1704 schtasks.exe 228 schtasks.exe 1504 schtasks.exe 5084 schtasks.exe 1156 schtasks.exe 4352 schtasks.exe 2628 schtasks.exe 3508 schtasks.exe 2432 schtasks.exe 1172 schtasks.exe 3980 schtasks.exe 1468 schtasks.exe 3668 schtasks.exe 4328 schtasks.exe 3552 schtasks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 09eef44272d050d8054cf913ed7bbf48.exe 1220 schtasks.exe 4636 schtasks.exe 1344 schtasks.exe 5108 schtasks.exe 5064 schtasks.exe 4940 schtasks.exe - Modifies WinLogon for persistence 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\", \"C:\\Windows\\Speech\\Engines\\Registry.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\", \"C:\\Windows\\Speech\\Engines\\Registry.exe\", \"C:\\odt\\csrss.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\", \"C:\\Windows\\Speech\\Engines\\Registry.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\csrss.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\", \"C:\\Windows\\Speech\\Engines\\Registry.exe\", \"C:\\odt\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Defender\\it-IT\\csrss.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\odt\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default\\spoolsv.exe\", \"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\", \"C:\\Windows\\ShellComponents\\System.exe\", \"C:\\odt\\unsecapp.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\", \"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\", \"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\", \"C:\\Windows\\Speech\\Engines\\Registry.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe - Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3508 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4788 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4328 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 60 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3980 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4868 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4092 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1156 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 836 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3792 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1128 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1344 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2072 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3040 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3024 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4940 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2824 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3308 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3976 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1928 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1908 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3552 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2372 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3008 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3668 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4684 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2576 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2208 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5084 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4864 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2728 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1328 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1172 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1220 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2956 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4352 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5064 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3312 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2628 1692 schtasks.exe 92 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4636 1692 schtasks.exe 92 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fontdrvhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fontdrvhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" fontdrvhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 09eef44272d050d8054cf913ed7bbf48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 09eef44272d050d8054cf913ed7bbf48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 09eef44272d050d8054cf913ed7bbf48.exe -
resource yara_rule behavioral2/memory/1204-0-0x00000000002F0000-0x000000000061E000-memory.dmp dcrat behavioral2/files/0x0007000000023212-43.dat dcrat behavioral2/files/0x000700000002322a-287.dat dcrat behavioral2/files/0x0007000000023236-289.dat dcrat behavioral2/files/0x000700000002320b-307.dat dcrat behavioral2/files/0x0007000000023230-309.dat dcrat - Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\Diskdump.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\ufx01000.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\rfxvmt.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\IddCx.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\mouhid.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\PosCx.dll fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\SensorsCx.dll fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\amdppm.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\EhStorClass.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\vmbkmcl.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\netio.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\WdmCompanionFilter.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\mshidkmdf.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\NdisVirtualBus.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\netbt.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\afunix.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\BthA2dp.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\netbios.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\hidclass.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\usbd.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\ndisuio.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\rasl2tp.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\rspndr.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\hidbth.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\mouclass.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\USBXHCI.SYS.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\raspppoe.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\rmcast.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\vdrvroot.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\tdi.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\SensorsHid.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\ndistapi.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\ndisuio.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\pdc.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\fsdepends.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\cmimcext.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\hvservice.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\beep.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\bthport.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\dmvsc.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\afd.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\afd.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\SDFLauncher.dll fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\sermouse.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\kbdclass.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\Dumpata.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\iorate.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\npfs.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\sdbus.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\dam.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\SerCx.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\en-US\IPMIDRV.sys.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\wcnfs.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\UcmCx.dll fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\WUDFUsbccidDriver.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\ClipSp.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\cmimcext.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\sdbus.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\UcmUcsiAcpiClient.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\acpitime.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\storufs.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\tdx.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\pacer.sys fontdrvhost.exe File opened for modification C:\Windows\System32\drivers\PktMon.sys fontdrvhost.exe - Manipulates Digital Signatures 1 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\System32\wintrust.dll fontdrvhost.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 09eef44272d050d8054cf913ed7bbf48.exe Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation fontdrvhost.exe - Deletes itself 1 IoCs
pid Process 5452 fontdrvhost.exe - Executes dropped EXE 1 IoCs
pid Process 5452 fontdrvhost.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 34 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\09eef44272d050d8054cf913ed7bbf48 = "\"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Speech\\Engines\\Registry.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\odt\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\ShellComponents\\System.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\odt\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\csrss.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\unsecapp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\odt\\unsecapp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\odt\\unsecapp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Windows\\ShellComponents\\System.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default\\spoolsv.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\lsass.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\odt\\csrss.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\Speech\\Engines\\Registry.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Users\\Default\\spoolsv.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files (x86)\\Windows Media Player\\es-ES\\TextInputHost.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Program Files\\Windows Multimedia Platform\\SearchApp.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\09eef44272d050d8054cf913ed7bbf48 = "\"C:\\Users\\Default User\\09eef44272d050d8054cf913ed7bbf48.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Windows Defender\\it-IT\\csrss.exe\"" 09eef44272d050d8054cf913ed7bbf48.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 09eef44272d050d8054cf913ed7bbf48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 09eef44272d050d8054cf913ed7bbf48.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fontdrvhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fontdrvhost.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 40 ipinfo.io 41 ipinfo.io - Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf fontdrvhost.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\avrt.dll fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\ieunatt.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\es-ES\acppage.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\edgehtml.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\en-US\lltdio.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\fdc.inf_amd64_7534987814b257b2\fdc.sys fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\input.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\TSTheme.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\ipsecsnp.dll fontdrvhost.exe File opened for modification C:\Windows\System32\ntlanui2.dll fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\chkntfs.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\sessenv.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\net1yx64.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\SHCore.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\Dism\OSProvider.dll fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\mdmcxpv6.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\UcmUcsiAcpiClient.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\msdv.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\devenum.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\FileAppxStreamingDataSource.dll fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_swdevice.inf_amd64_12050f4158021fcb\c_swdevice.inf fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\iastorv.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\mbsmsapi.dll fontdrvhost.exe File opened for modification C:\Windows\System32\Windows.Networking.NetworkOperators.HotspotAuthentication.dll fontdrvhost.exe File opened for modification C:\Windows\System32\EmailApis.dll fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\en-US\hidvhf.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\msrahc.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\setupcl.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\KernelBase.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\computenetwork.dll fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\runas.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\iedkcs32.dll fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\audiodg.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\DisplaySwitch.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\Windows.Devices.Custom.dll fontdrvhost.exe File opened for modification C:\Windows\System32\Windows.UI.Internal.Input.ExpressiveInput.Resource.dll fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\ipmidrv.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\k57nd60a.sys fontdrvhost.exe File opened for modification C:\Windows\System32\winjson.dll fontdrvhost.exe File opened for modification C:\Windows\System32\WSDScanProxy.dll fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\socialapis.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\en-US\pcmcia.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\mdmirmdm.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\ResetEngine.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\onexui.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\sysmain.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\wsqmcons.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\dnsrslvr.dll fontdrvhost.exe File opened for modification C:\Windows\System32\mobsync.exe fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmbtmdm.inf_amd64_9e5602638617558e\bthmodem.sys fontdrvhost.exe File opened for modification C:\Windows\System32\en-US\mstsc.exe.mui fontdrvhost.exe File opened for modification C:\Windows\System32\SettingsHandlers_WorkAccess.dll fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\dc21x4vm.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_NFA364xp_ssku_RV_0519.bin fontdrvhost.exe File opened for modification C:\Windows\System32\FXSRESM.dll fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\Amd64\unishare3d-pipelineconfig.xml fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\en-US\spaceport.inf_loc fontdrvhost.exe File opened for modification C:\Windows\System32\dxpps.dll fontdrvhost.exe File opened for modification C:\Windows\System32\mmgaserver.exe fontdrvhost.exe File opened for modification C:\Windows\System32\SettingsHandlers_Notifications.dll fontdrvhost.exe File opened for modification C:\Windows\System32\spnet.dll fontdrvhost.exe File opened for modification C:\Windows\System32\de-DE\MSVidCtl.dll.mui fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_NFA344a_highTX.bin fontdrvhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\netvsc.sys fontdrvhost.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll fontdrvhost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-80_altform-unplated.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-200_contrast-white.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-100.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-400.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-150.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\BadgeLogo.scale-100_contrast-white.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Pyramid.Medium.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.ViewElements.winmd fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.VideoTk.dll fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-100.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\WinMetadata\Microsoft.UI.Xaml.winmd fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-high.png fontdrvhost.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\eml.scale-16.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_altform-lightunplated.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-white.png fontdrvhost.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Retail\NinjaCatOnDragon.scale-125.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-lightunplated_devicefamily-colorfulunplated.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-150.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-100_contrast-white.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Shield.targetsize-44_contrast-black.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-200.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-white_scale-200.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-100.png fontdrvhost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileMediumSquare.scale-200.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ExtendedSplashScreen.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-400.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-150_contrast-black.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-unplated_contrast-white.png fontdrvhost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-200.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\LargeTile.scale-100.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_32x32x32.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-white_scale-200.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-100.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-150.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\WideTile.scale-125.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.ViewModel.dll fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreLargeTile.scale-200.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlCone.png fontdrvhost.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\skchui.dll fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-32.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\el-GR\View3d\3DViewerProductDescription-universal.xml fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\VungleSDK.winmd fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png fontdrvhost.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll fontdrvhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledb32r.dll fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-200_contrast-black.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\AchievementUnlocked.mp3 fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-100.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-lightunplated.png fontdrvhost.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated.png fontdrvhost.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\wmlaunch.exe.mui fontdrvhost.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Boot\EFI\kd_07_1415.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Web.DynamicData.resources.dll fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\HyperV-Compute-Host-Containers-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-DirectPlay-OC-Opt-Package~31bf3856ad364e35~amd64~es-ES~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-OneDrive-Setup-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Printing-PrintToPDF-Opt-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Multimedia-MFCore-WCOSHeadless-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\diagnostics\system\Device\es-ES\DiagPackage.dll.mui fontdrvhost.exe File opened for modification C:\Windows\INF\netmyk64.inf fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\aspnet_regbrowsers.resources.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1033\vbc7ui.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.dll fontdrvhost.exe File opened for modification C:\Windows\PolicyDefinitions\AutoPlay.admx fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\HyperV-VmChipset-Package~31bf3856ad364e35~amd64~~10.0.19041.1266.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package02~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\Media\GoBack_48000Hz.raw fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Data.Services.Client.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Data.DataSetExtensions.resources.dll fontdrvhost.exe File opened for modification C:\Windows\INF\mdmzyxlg.inf fontdrvhost.exe File opened for modification C:\Windows\INF\ts_generic.inf fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\vbc.rsp fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Xml.dll fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\HyperV-VmUiDevices-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\pt-PT_BitLockerToGo.exe.mui fontdrvhost.exe File opened for modification C:\Windows\Boot\PCAT\ru-RU\memtest.exe.mui fontdrvhost.exe File opened for modification C:\Windows\INF\mdmnis5t.inf fontdrvhost.exe File opened for modification C:\Windows\Speech_OneCore\Engines\TTS\en-US\M1033Mark.BEP fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Web.Abstractions.resources.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll fontdrvhost.exe File opened for modification C:\Windows\PolicyDefinitions\Explorer.admx fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~it-IT~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Client-Features-Package0214~31bf3856ad364e35~amd64~~10.0.19041.1266.cat fontdrvhost.exe File opened for modification C:\Windows\INF\ts_wpdmtp.inf fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\System.Configuration.Install.Resources.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Runtime.Serialization.Formatters.Soap.resources.dll fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Dedup-ChunkLibrary-Package~31bf3856ad364e35~amd64~fr-FR~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-NetFx-Shared-Perfcounters-Client~31bf3856ad364e35~amd64~~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\System.DirectoryServices.Resources.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Dynamic.resources.dll fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\HyperV-DynamicMemory-VirtualDevice-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Holographic-Desktop-Merged-merged-Package~31bf3856ad364e35~amd64~de-DE~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\diagnostics\system\Device\TS_InformCustomer.ps1 fontdrvhost.exe File opened for modification C:\Windows\Media\Windows Minimize.wav fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\System.Design.Resources.dll fontdrvhost.exe File opened for modification C:\Windows\INF\MSDTC\0409\msdtcprf.ini fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-ConfigCI-Onecore-Package~31bf3856ad364e35~amd64~en-US~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~es-ES~11.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\System.Management.resources.dll fontdrvhost.exe File opened for modification C:\Windows\rescache\_merged\4106146490\3934940475.pri fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Embedded-UnifiedWriteFilter-Package~31bf3856ad364e35~amd64~~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\PolicyDefinitions\StorageHealth.admx fontdrvhost.exe File opened for modification C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.TextToSpeech~sl-si~1.0.mum fontdrvhost.exe File opened for modification C:\Windows\Cursors\aero_person_xl.cur fontdrvhost.exe File opened for modification C:\Windows\diagnostics\system\IEBrowseWeb\VF_IEDefectiveAddon.ps1 fontdrvhost.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Summary.xml fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.NonGeneric.dll fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-WebcamExperience-Package~31bf3856ad364e35~amd64~ja-JP~10.0.19041.1.cat fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\1041\vbc7ui.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ja\System.Drawing.resources.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\System.Configuration.Install.resources.dll fontdrvhost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\mscorrc.dll fontdrvhost.exe File opened for modification C:\Windows\PolicyDefinitions\MSAPolicy.admx fontdrvhost.exe File opened for modification C:\Windows\servicing\InboxFodMetadataCache\metadata\Language.Handwriting~nb-no~1.0.mum fontdrvhost.exe File opened for modification C:\Windows\servicing\Packages\HyperV-VmUiDevices-Package~31bf3856ad364e35~amd64~uk-UA~10.0.19041.1.cat fontdrvhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4092 schtasks.exe 5108 schtasks.exe 4444 schtasks.exe 836 schtasks.exe 3792 schtasks.exe 4684 schtasks.exe 1172 schtasks.exe 228 schtasks.exe 4636 schtasks.exe 3976 schtasks.exe 3552 schtasks.exe 3668 schtasks.exe 1328 schtasks.exe 60 schtasks.exe 1536 schtasks.exe 3980 schtasks.exe 2576 schtasks.exe 4352 schtasks.exe 3308 schtasks.exe 4864 schtasks.exe 1220 schtasks.exe 1612 schtasks.exe 4788 schtasks.exe 4868 schtasks.exe 2824 schtasks.exe 1704 schtasks.exe 1480 schtasks.exe 3008 schtasks.exe 2432 schtasks.exe 3312 schtasks.exe 1468 schtasks.exe 3040 schtasks.exe 2372 schtasks.exe 3508 schtasks.exe 1928 schtasks.exe 2208 schtasks.exe 1344 schtasks.exe 3024 schtasks.exe 1908 schtasks.exe 1504 schtasks.exe 1128 schtasks.exe 2728 schtasks.exe 628 schtasks.exe 5064 schtasks.exe 4328 schtasks.exe 2072 schtasks.exe 4940 schtasks.exe 2628 schtasks.exe 1156 schtasks.exe 5084 schtasks.exe 2956 schtasks.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings 09eef44272d050d8054cf913ed7bbf48.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings fontdrvhost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 3752 powershell.exe 3752 powershell.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 1204 09eef44272d050d8054cf913ed7bbf48.exe 3268 powershell.exe 3268 powershell.exe 904 powershell.exe 904 powershell.exe 2680 powershell.exe 2680 powershell.exe 5000 powershell.exe 5000 powershell.exe 588 powershell.exe 588 powershell.exe 1436 powershell.exe 1436 powershell.exe 2500 powershell.exe 2500 powershell.exe 3120 powershell.exe 3120 powershell.exe 4020 powershell.exe 4020 powershell.exe 1108 powershell.exe 1108 powershell.exe 1436 powershell.exe 2716 powershell.exe 2716 powershell.exe 2716 powershell.exe 3752 powershell.exe 588 powershell.exe 5000 powershell.exe 3268 powershell.exe 2680 powershell.exe 904 powershell.exe 2500 powershell.exe 1108 powershell.exe 4020 powershell.exe 3120 powershell.exe 5452 fontdrvhost.exe 5452 fontdrvhost.exe 5452 fontdrvhost.exe 5452 fontdrvhost.exe 5452 fontdrvhost.exe 5452 fontdrvhost.exe 5452 fontdrvhost.exe 5452 fontdrvhost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5452 fontdrvhost.exe - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1204 09eef44272d050d8054cf913ed7bbf48.exe Token: SeDebugPrivilege 3752 powershell.exe Token: SeDebugPrivilege 588 powershell.exe Token: SeDebugPrivilege 3268 powershell.exe Token: SeDebugPrivilege 904 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 5000 powershell.exe Token: SeDebugPrivilege 1436 powershell.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 3120 powershell.exe Token: SeDebugPrivilege 4020 powershell.exe Token: SeDebugPrivilege 1108 powershell.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 5452 fontdrvhost.exe Token: SeBackupPrivilege 6136 vssvc.exe Token: SeRestorePrivilege 6136 vssvc.exe Token: SeAuditPrivilege 6136 vssvc.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2716 1204 09eef44272d050d8054cf913ed7bbf48.exe 144 PID 1204 wrote to memory of 2716 1204 09eef44272d050d8054cf913ed7bbf48.exe 144 PID 1204 wrote to memory of 3752 1204 09eef44272d050d8054cf913ed7bbf48.exe 145 PID 1204 wrote to memory of 3752 1204 09eef44272d050d8054cf913ed7bbf48.exe 145 PID 1204 wrote to memory of 588 1204 09eef44272d050d8054cf913ed7bbf48.exe 146 PID 1204 wrote to memory of 588 1204 09eef44272d050d8054cf913ed7bbf48.exe 146 PID 1204 wrote to memory of 4020 1204 09eef44272d050d8054cf913ed7bbf48.exe 147 PID 1204 wrote to memory of 4020 1204 09eef44272d050d8054cf913ed7bbf48.exe 147 PID 1204 wrote to memory of 3268 1204 09eef44272d050d8054cf913ed7bbf48.exe 148 PID 1204 wrote to memory of 3268 1204 09eef44272d050d8054cf913ed7bbf48.exe 148 PID 1204 wrote to memory of 5000 1204 09eef44272d050d8054cf913ed7bbf48.exe 149 PID 1204 wrote to memory of 5000 1204 09eef44272d050d8054cf913ed7bbf48.exe 149 PID 1204 wrote to memory of 3120 1204 09eef44272d050d8054cf913ed7bbf48.exe 150 PID 1204 wrote to memory of 3120 1204 09eef44272d050d8054cf913ed7bbf48.exe 150 PID 1204 wrote to memory of 904 1204 09eef44272d050d8054cf913ed7bbf48.exe 151 PID 1204 wrote to memory of 904 1204 09eef44272d050d8054cf913ed7bbf48.exe 151 PID 1204 wrote to memory of 1108 1204 09eef44272d050d8054cf913ed7bbf48.exe 152 PID 1204 wrote to memory of 1108 1204 09eef44272d050d8054cf913ed7bbf48.exe 152 PID 1204 wrote to memory of 2680 1204 09eef44272d050d8054cf913ed7bbf48.exe 153 PID 1204 wrote to memory of 2680 1204 09eef44272d050d8054cf913ed7bbf48.exe 153 PID 1204 wrote to memory of 2500 1204 09eef44272d050d8054cf913ed7bbf48.exe 154 PID 1204 wrote to memory of 2500 1204 09eef44272d050d8054cf913ed7bbf48.exe 154 PID 1204 wrote to memory of 1436 1204 09eef44272d050d8054cf913ed7bbf48.exe 155 PID 1204 wrote to memory of 1436 1204 09eef44272d050d8054cf913ed7bbf48.exe 155 PID 1204 wrote to memory of 1944 1204 09eef44272d050d8054cf913ed7bbf48.exe 167 PID 1204 wrote to memory of 1944 1204 09eef44272d050d8054cf913ed7bbf48.exe 167 PID 1944 wrote to memory of 3216 1944 cmd.exe 170 PID 1944 wrote to memory of 3216 1944 cmd.exe 170 PID 1944 wrote to memory of 5452 1944 cmd.exe 173 PID 1944 wrote to memory of 5452 1944 cmd.exe 173 PID 5452 wrote to memory of 5752 5452 fontdrvhost.exe 176 PID 5452 wrote to memory of 5752 5452 fontdrvhost.exe 176 PID 5452 wrote to memory of 5796 5452 fontdrvhost.exe 177 PID 5452 wrote to memory of 5796 5452 fontdrvhost.exe 177 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 09eef44272d050d8054cf913ed7bbf48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 09eef44272d050d8054cf913ed7bbf48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 09eef44272d050d8054cf913ed7bbf48.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" fontdrvhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" fontdrvhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" fontdrvhost.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\09eef44272d050d8054cf913ed7bbf48.exe"C:\Users\Admin\AppData\Local\Temp\09eef44272d050d8054cf913ed7bbf48.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1204 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1436
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Moxb3cLai8.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:3216
-
-
C:\Recovery\WindowsRE\fontdrvhost.exe"C:\Recovery\WindowsRE\fontdrvhost.exe"3⤵
- UAC bypass
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5452 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9dfd0d34-e3c5-4b2f-8771-adc843f4d9ba.vbs"4⤵PID:5752
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d66cc842-f118-400a-b6c0-ad89b90677a6.vbs"4⤵PID:5796
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Default\spoolsv.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\spoolsv.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Users\Default\AppData\Roaming\Microsoft\Windows\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default\AppData\Roaming\Microsoft\Windows\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Users\Default\AppData\Roaming\Microsoft\Windows\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\ShellComponents\System.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ShellComponents\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellComponents\System.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\odt\unsecapp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\TextInputHost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\TextInputHost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\lsass.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Gadgets\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "09eef44272d050d8054cf913ed7bbf480" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\09eef44272d050d8054cf913ed7bbf48.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "09eef44272d050d8054cf913ed7bbf48" /sc ONLOGON /tr "'C:\Users\Default User\09eef44272d050d8054cf913ed7bbf48.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "09eef44272d050d8054cf913ed7bbf480" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\09eef44272d050d8054cf913ed7bbf48.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\odt\Registry.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Multimedia Platform\SearchApp.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\Speech\Engines\Registry.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Speech\Engines\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Windows\Speech\Engines\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\odt\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\csrss.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\it-IT\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\odt\fontdrvhost.exe'" /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\odt\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6136
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:4620
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:5220
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:4620
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy1⤵PID:3984
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft.NET\5b884080fd4f94
- Size 497B
- SHA256 c86d3b98d532c032c17d2a800b2c383375b9d7e30f89ca471440d533d209ca9a
- MD5 9c1ee0bcb484697ee90ebaa08b2ff20b
- SHA1 358b282272afecf847a586a6332d9b439fd513d5
- SHA512 7bb7c8f84e572664ded5188ca616b074b7d69f3330ed8cf8c89bf4a8f62eceb2819b6a85076fb1a0c07a73f70d332988f8e05fc1420023086181c4256340e4f2
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft.NET\fontdrvhost.exe
- Size 3.1MB
- SHA256 ec7c616c29cf7e69536a0fd8e4a1a7ff27a43d38c03f933e43eb00b8458c0b0d
- MD5 927e4a19dd179028bb5b38e8f0f96f1e
- SHA1 c0d6f3f8e7a9bb2ae7ab6dac898844976568c7ae
- SHA512 ad93b08642a7b63196524e9e164a9701df7a626e70200e95632b5bf3e17f8a752413a56cdcd7285850a85387f8de20afcb93e114a2f0b842b3e81381d0f19c0e
- SSDEEP 98304:Cc8eC24luyRsHatJTnXk8AkY9/7x0go6/e6BJL:9kuyRsHSXk777oq3f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Windows Defender\it-IT\886983d96e3d3e
- Size 699B
- SHA256 fe329b0eef80c6914e0e5b3876256574d7de84808704d9f1b96ff9ce31dfc873
- MD5 faeb969b107628348129a8e26e284844
- SHA1 1b3ef41f8d9f368dd5a795038f28d178d76cbb1c
- SHA512 76755871a0b5acb5d546aede5d187201d294f5a83f9d56f42ee9f9d38b7a5f3841396b49873b094830a193e1325a0a0c7ff1618f839c61378c90e415214a7366
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Windows Defender\it-IT\csrss.exe
- Size 64KB
- SHA256 cec0827dacd605ab270d3a280a94f82f05adf438e4659f0c3b5e71ed2b097b31
- MD5 0296f24dfc2bff7d8e3f039db2f62301
- SHA1 39588735a29fcbf63ab5092d34c02434d3b7a701
- SHA512 4d92b55385b3426b5af52494f59f941993b259b8c4c7908d0a4f52a62453d9300315d609760eee61eaa397a25a5e6d4b3c0587ccebe0c789c96a325d7cb37239
- SSDEEP 1536:LaMpFhstvtJHwsGQGvTxrMqzXhL98aSNh8:LBFhKtK3xgYp9bSNu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Windows Media Player\es-ES\22eafd247d37c3
- Size 287B
- SHA256 1a4dfb6c75ff1623bd43bba169f322944c4242f3fe1258d529e069af1a9560bb
- MD5 e6739c121310c646dd7d23b4d59276e2
- SHA1 8f4c018774f6f1ae13fcb38bf47ef69ed00902b0
- SHA512 018c8feeab69ec8c253fd164037e1cde0fc1e46bfc23683bd36c0aa491c433f7cc126fe9539eb8db8047e97bb8f456ef25f65318a7a13b41659f7ed6d364611e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\5b884080fd4f94
- Size 529B
- SHA256 c7568148bee854d1eac5fb092f90e1027ac1d3f79aba43beaf5485012deeeeb3
- MD5 9b94da109e2a3ce5e1d527b9b53d0bf6
- SHA1 bc60386009523e7a825ea43b1dab86ecc469f42f
- SHA512 ec0b9122f2c568ef2cd1985437dff07468c6efdb0b2aa05ed74c27d69a39f9ee98d684a29915ff79a377f49911f8a55c1627f10b3f88d2f7f667c19085be5669
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Multimedia Platform\38384e6a620884
- Size 493B
- SHA256 056ef29cba8354b9469affbac1dbd0caa3c3d2b88154e44311f5adff4a075bb1
- MD5 48113a50908de07495996b72cf2a7515
- SHA1 595501ee05a112d3b5974e722555185df171c3ce
- SHA512 4c7d1e39c54ba00e41b01680dfd46e7fd79edb48337c7619231ac9deef097818547e1b341c08a92620340b24f348c0fd099836fbcc79c38149d2c9c50721ba36
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Sidebar\Gadgets\6203df4a6bafc7
- Size 454B
- SHA256 2396206e93631799f63847203402760e10d59594fc46f430edd10e0820a66124
- MD5 cc56350edafe5ca57b57c5b78286f902
- SHA1 f116301f67863c837819470e102a6345373d1b49
- SHA512 2628c4b28c81f379cfcff1cc2a6519878b3000c1f8413b35b9af1fd8fdfba4d4012b2edef3298eede9297783aeff42230d575e7eb3fefaa9af9475fcc7a99675
- MD5 SHA1 SHA512
- Path C:\Recovery\WindowsRE\5b884080fd4f94
- Size 710B
- SHA256 2e1635d5f11e760a347bfa50f6998e1d3411e180a20a84ec93f1573fa4074972
- MD5 073bdc705351434dc8cb085f3970fdfd
- SHA1 5aaa5313beffa42f9cc295faaf67db5700e6ecf9
- SHA512 1836a61455c2abbf8bd50905d31cbbf75316ca826f4d36ceeebc72ad4447bb87e7a0f51c294d2065e0bef54641627e195b661d9190091e9117837180875920fa
- MD5 SHA1 SHA512
- Path C:\Recovery\WindowsRE\9e8d7a4ca61bd9
- Size 81B
- SHA256 7fa43030f1c5cbdb7c383b0dab151eb4a9495bc964b71e63f94a4e2657860bc0
- MD5 7eb8abff51df7357b691ff0b752c1847
- SHA1 4701cb8baae51103524a11078385835fdaf805ac
- SHA512 c5001cd327264de7a3442d2be99a00042910ac6888067058550500067a916a5be89b2d182710e1416ffb6ba853551b7105fbddf04448a0048f0a0e054b5f202b
- MD5 SHA1 SHA512
- Path C:\Recovery\WindowsRE\RuntimeBroker.exe
- Size 3.2MB
- SHA256 87f220dad3bbeec6f39ed3e74eaa5b63f91924104b238fd33b4c5d49cc88f1ac
- MD5 09eef44272d050d8054cf913ed7bbf48
- SHA1 b4cd2add18e8445529b107d5ee847b89c70db333
- SHA512 867189c8cde505c22c377d4b68665c235e019b7127b3dbfdf4babdf8cd67985753898945d767c99122b3fe348b768e1e11bf3c340feedc0182c4c584a20ecf30
- SSDEEP 98304:Cc8eC24luyRsHatJTnXk8AkY9/7x0go6/e6BJ4:9kuyRsHSXk777oq3U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\09eef44272d050d8054cf913ed7bbf48.exe.log
- Size 1KB
- SHA256 2b1ffeab025cc7c61c50e3e2e4c9253046d9174cf00181a8c1de733a4c0daa14
- MD5 655010c15ea0ca05a6e5ddcd84986b98
- SHA1 120bf7e516aeed462c07625fbfcdab5124ad05d3
- SHA512 e52c26718d7d1e979837b5ac626dde26920fe7413b8aa7be6f1be566a1b0f035582f4d313400e3ad6b92552abb1dfaf186b60b875fb955a2a94fd839fe841437
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
- MD5 bd5940f08d0be56e65e5f2aaf47c538e
- SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
- SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
- MD5 cadef9abd087803c630df65264a6c81c
- SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
- SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d
- MD5 61e06aa7c42c7b2a752516bcbb242cc1
- SHA1 02c54f8b171ef48cad21819c20b360448418a068
- SHA512 03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 020e5d769893724f075e10b01c59bf2424214cefe6aafbab6f44bc700f525c40
- MD5 22fbec4acba323d04079a263526cef3c
- SHA1 eb8dd0042c6a3f20087a7d2391eaf48121f98740
- SHA512 fb61d737de8cbed6b7d8b5a35911c46ef26a2927a52ed7add9d594cf19dcab1b9978b61912c6f3fe4f29228f4454fb022fb2e167788c727dc6503c1fcd42159e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
- MD5 e243a38635ff9a06c87c2a61a2200656
- SHA1 ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
- SHA512 4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
- MD5 e448fe0d240184c6597a31d3be2ced58
- SHA1 372b8d8c19246d3e38cd3ba123cc0f56070f03cd
- SHA512 0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\9dfd0d34-e3c5-4b2f-8771-adc843f4d9ba.vbs
- Size 713B
- SHA256 336f3b5d73500476f8360d9c60ae55f172e8b255777d69bf4753ea345806f754
- MD5 386218ef55b25c0701c36536fd5d8a7e
- SHA1 c4c3de7f117c2edb58ca54e70505021266d37f3c
- SHA512 08f9914bb7ce96674c78a4ed3bd33ee1ea241194f80242f6902b334ce48db0ea645eeebd9dd9d0297f42ce29a3d121fe55ab9d437024dafbdbe8e62172821269
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Moxb3cLai8.bat
- Size 202B
- SHA256 342c172a53275e8fb04c14562802526f810de34d37c678608c512a0ca536d03f
- MD5 511879b53eaac2de44c6b0dee0f763e3
- SHA1 ecc4f6f8bf769fd607354b5252716de2ccef454d
- SHA512 6f784522188c6457c358ef39e2035ec43dbe99914ebdc23c3adbf7cdb780ecc971cac0dcb5c50cc78a8f3b72522c1562f1217a7dda387d92e6b3f24937e3de0b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5iukv2ef.caf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\d66cc842-f118-400a-b6c0-ad89b90677a6.vbs
- Size 489B
- SHA256 1c4ae6f07fd5ae714678b89e08b40404fca64612143fa512bae4a594fb89b708
- MD5 f01f303ffaacbccf11aaa8d58d365b91
- SHA1 cffc182abf7ea8f382e4bec85967caacea4c5bea
- SHA512 81ea1b5e66ed94f25fae7317dc47fd24af81048601868d1cc9a411ecc3477276bc17c0d0b227979fb75eeb2f812d0c555a0724e1b70a13d96202dabab47f531a
- MD5 SHA1 SHA512
- Path C:\Users\Default\1fc9380993ae1e
- Size 237B
- SHA256 936633473d44deff9e36be0db0d6af38908ebb0c30dcb308024e3b8925c4732f
- MD5 362bd2e600429ba5fbd5be2129da3104
- SHA1 ab8a9d57821ddcbaebd35671dbd5048b5533e943
- SHA512 dcbc9efc5c960630901c939c5989185cc850943e3a32ab30a68cf6421745744f333873153fbd18dfe2e0ba21efb50bdfd8a5d6939f857e28bbdc61ff605a8b79
- MD5 SHA1 SHA512
- Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\29c1c3cc0f7685
- Size 24B
- SHA256 531de3c588b589cf71263ad5df54609c1ea9bd8c946c166f96f77d75c34e00d4
- MD5 3a102686cc5dd24d4f5f48bd3c88efad
- SHA1 407a16c35c5099b55c40a0f86dce093cc480bfe9
- SHA512 0998a41f31a9988f7d17cb515001e3426e92126470747fc1dce81e1f26a3f0e9c005062540354c04dbcd6a919d5f96b4a5c8f5eabcef67584937290d283b1902
- MD5 SHA1 SHA512
- Path C:\Users\Default\f3b6ecef712a24
- Size 858B
- SHA256 ba3828f43357e28a82378cccc3d95d7d1dcad09e6b8174c815cacde3b288d9e9
- MD5 9b5b4006375616a227682cdf7b8d0a36
- SHA1 f3da528baff8d541f2e70100a0ad814d912cdabb
- SHA512 a977c5c64c541aa0457bd0436322d5b5d4df28f5f6ad1a65a9ea221f32444502b4da7db38af55879d5f89795873f4a6d6a895ca803594193f6df640e3fffb2c7
- MD5 SHA1 SHA512
- Path C:\Windows\ShellComponents\27d1bcfc3c54e0
- Size 506B
- SHA256 92d7c3b4edea631fb9f2271176c184b4b4afc7b67c643de2e1b0aa228da712c4
- MD5 c2dab0dddc5ed1f4c75144d8e8f34aa7
- SHA1 5360af2138fdf20f89d9b0085d88c9cc33b00a4f
- SHA512 1eb3751192990e0d480ddb7f6647611b17820a2dec2622383b185a189f10c8c9719e859f4832d93121762a0c7ae2252ba96d0585b4c5ff9f7c84aee50e8d0db4
- MD5 SHA1 SHA512
- Path C:\Windows\ShellComponents\System.exe
- Size 1.6MB
- SHA256 541e466f81fb8dfe739b776c2978053a4cd6cbbeb0e0a52df2c75294efb23de3
- MD5 b6af0a0fa8d17fbb8708c6d265e01084
- SHA1 7afd05b47e63223062cfc3f4d350e4489b665862
- SHA512 d09f9e506fdf9940dc0ff4bc5490c28c9409522d8b187232bea10546d61fd58991cf896df09a6c162a505248686a81257d312ed43776cfd1be207259a0d7b946
- SSDEEP 24576:U3gHHPExc8Srj/0r7BKcqz303ZGNNq16c8tiZmDCRPa5FIopatJYzqKv1F6e7X:SKOc8e0r74cqzkJlut1+Ri5HatJCUS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Speech\Engines\Registry.exe
- Size 1.3MB
- SHA256 18559a6e4ec51129ae47bb804d7287d7eba48e6e2bcd2d7a28ee79648d1f710c
- MD5 09093ea49d857ea7515531b0dd9cab17
- SHA1 4014d763460764e39f23e8f514ca4ddca5cc1564
- SHA512 9f6a9a60db3abe7b53168d2057e8df44e49d8de6a4a6174b682af622bd8a0b5c3087675704d730955e21424e2c51db434f81a91e118368b0ece97683787d49b0
- SSDEEP 24576:U3gHHPExc8Srj/0r7BKcqz303ZGNNq16c8tiZmDCRPa5FIopaD:SKOc8e0r74cqzkJlut1+Ri5HaD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Speech\Engines\ee2ad38f3d4382
- Size 117B
- SHA256 44983aadccd829844dc1ddfef13c55749247b8bd1284489a693a3f75cf56c432
- MD5 ee939700d5ea1929869b2d962e7016a0
- SHA1 f1c822316a142292588dfa77ab9ae82032b051ed
- SHA512 708bf7627d6a70a6027a1f7a7c2dc244b7087b45fa9dcfb8223b65a046f8add88f6ca1e0d445664ac556a96687a5c5a4e8a9ab3c2b08dbd9898502faa040c9cb
- MD5 SHA1 SHA512
- Path C:\odt\29c1c3cc0f7685
- Size 564B
- SHA256 19c770f628ee5b38b16f9eef7ad289bdc1795f199f5647b64ce9a386fb59c99c
- MD5 149bc496a3f68010042361a2629d5b81
- SHA1 388b37c8ab446364c3f54c4fae0c5bf0eb3d9a50
- SHA512 2d9a31366dec2f476a591408e9a5ca5e63caf6b40bb56fd23d224c5ff7fca34be2a911bb8b4f1ef87dfb0f8ee9231e38fdf24e05680dd3d624e0791b8af797e1
- MD5 SHA1 SHA512
- Path C:\odt\5b884080fd4f94
- Size 387B
- SHA256 4ac61fc162ee782856725a7f0d576c6e630d2328d89eaa6bd0852cfc10bcb778
- MD5 ff3a79f9102d0311bb303c35e43a728c
- SHA1 bfdcff4f541f7d81a204b9c09e8a6c26c62d3134
- SHA512 7e5d9e85a90f047a55f44c5bd5388ce15a2ef04aa7609e5a778934765a34a43bc353aaf0c5cf0e3b8f7491289372ca257d45b27c34c04f40cf1e4c65168c3b64
- MD5 SHA1 SHA512
- Path C:\odt\886983d96e3d3e
- Size 335B
- SHA256 397b89f8a7fb142cae3ed46bc952dd682f6f0f4026058cc11e43571352a8c3a6
- MD5 cc6998b55d5a0330e9622b5abe946f73
- SHA1 dd23b83d4da3d1f30742d9c4e99032d330c67383
- SHA512 9d6b24be48979fd1cea9aac55456373f41719c511c7db500a975b20c40b4dd50e36481d925e019c1bd9fcc367db95b2638220999c113aabdbf43bc4c6463eaf1
- MD5 SHA1 SHA512
- Path C:\odt\ee2ad38f3d4382
- Size 891B
- SHA256 0018fd5fcf9b34f384e97731c9c6482a684f3c08868cc5983ea155dbf878146c
- MD5 e46dfba4a905913649b0090ad3a607d5
- SHA1 1e35d62faf7baf9aebc1653afe40209767843fd4
- SHA512 99844a079ae5ff61ed04ef315ff2e83d38855ec83df8e366224bd51feca2d66aadf297367eb1b30a23e3c99f9a6d2a3e77e18054ac8f8028af4ec6723af95c19
- MD5 SHA1 SHA512