Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-04-2024 11:56
Behavioral task
behavioral1
Sample
7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe
Resource
win11-20240214-en
General
-
Target
7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe
-
Size
1.1MB
-
MD5
6e6f8bc0dbceec859f9baaff0ebe2811
-
SHA1
495b4434e34bbf6c432718ee6fac880f16be49a0
-
SHA256
7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e
-
SHA512
aab1bba5a4fc395f2d378bfc2bad098ce4efbeadacea47f650e16afd99373d518fd2cf9f8c30422cd34939d04d2e05ac9fc5ee8b48d6f5bc8f7cbb19d1bfeac7
-
SSDEEP
24576:U2G/nvxW3Ww0tkqV9bjWrJeQfBmAL6PLRr0UeJ:UbA30kqIJR/
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 42 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3876 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 908 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4904 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 652 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4816 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1796 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2324 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1492 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3544 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4772 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4000 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3908 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2340 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1180 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3152 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1464 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3140 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4856 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5112 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3088 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2856 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3688 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4716 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1700 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 892 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4680 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3496 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4960 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2600 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4032 2860 schtasks.exe 81 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 2860 schtasks.exe 81 -
resource yara_rule behavioral2/files/0x000200000002a7a4-10.dat dcrat behavioral2/memory/2708-12-0x0000000000250000-0x0000000000326000-memory.dmp dcrat -
Executes dropped EXE 2 IoCs
pid Process 2708 agentDllDhcp.exe 2116 fontdrvhost.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\66fc9ff0ee96c2 agentDllDhcp.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\StartMenuExperienceHost.exe agentDllDhcp.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\sppsvc.exe agentDllDhcp.exe File created C:\Program Files\VideoLAN\VLC\hrtfs\0a1fd5f707cd16 agentDllDhcp.exe File created C:\Program Files\Windows Media Player\Network Sharing\dllhost.exe agentDllDhcp.exe File created C:\Program Files\Windows Media Player\Network Sharing\5940a34987c991 agentDllDhcp.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe agentDllDhcp.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\apppatch\AppPatch64\csrss.exe agentDllDhcp.exe File created C:\Windows\apppatch\AppPatch64\886983d96e3d3e agentDllDhcp.exe File created C:\Windows\Panther\setup.exe\sysmon.exe agentDllDhcp.exe File created C:\Windows\Panther\setup.exe\121e5b5079f7c0 agentDllDhcp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 42 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3496 schtasks.exe 3876 schtasks.exe 4048 schtasks.exe 3544 schtasks.exe 3908 schtasks.exe 3904 schtasks.exe 3688 schtasks.exe 4904 schtasks.exe 4772 schtasks.exe 5112 schtasks.exe 3088 schtasks.exe 892 schtasks.exe 1528 schtasks.exe 2324 schtasks.exe 2856 schtasks.exe 3472 schtasks.exe 2752 schtasks.exe 4716 schtasks.exe 4816 schtasks.exe 1492 schtasks.exe 2624 schtasks.exe 1180 schtasks.exe 1464 schtasks.exe 2536 schtasks.exe 908 schtasks.exe 652 schtasks.exe 3152 schtasks.exe 4856 schtasks.exe 1512 schtasks.exe 2600 schtasks.exe 1700 schtasks.exe 4032 schtasks.exe 2340 schtasks.exe 3916 schtasks.exe 2044 schtasks.exe 4680 schtasks.exe 4960 schtasks.exe 4476 schtasks.exe 1796 schtasks.exe 4000 schtasks.exe 3140 schtasks.exe 4444 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2567984660-2719943099-2683635618-1000_Classes\Local Settings 7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2708 agentDllDhcp.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe 2116 fontdrvhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2116 fontdrvhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2708 agentDllDhcp.exe Token: SeDebugPrivilege 2116 fontdrvhost.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1172 wrote to memory of 3520 1172 7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe 77 PID 1172 wrote to memory of 3520 1172 7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe 77 PID 1172 wrote to memory of 3520 1172 7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe 77 PID 3520 wrote to memory of 3156 3520 WScript.exe 78 PID 3520 wrote to memory of 3156 3520 WScript.exe 78 PID 3520 wrote to memory of 3156 3520 WScript.exe 78 PID 3156 wrote to memory of 2708 3156 cmd.exe 80 PID 3156 wrote to memory of 2708 3156 cmd.exe 80 PID 2708 wrote to memory of 2116 2708 agentDllDhcp.exe 124 PID 2708 wrote to memory of 2116 2708 agentDllDhcp.exe 124 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe"C:\Users\Admin\AppData\Local\Temp\7574d2c9903d02681c8190816aa30a76d8874f03148539eacd6af126dc4cba8e.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\BlockComponentwebMonitordhcp\AbAw8xfGFsmxdxvuwvbKubDJeV.vbe"2⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\BlockComponentwebMonitordhcp\8H5kf2bUK2r.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe"C:\BlockComponentwebMonitordhcp\agentDllDhcp.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\BlockComponentwebMonitordhcp\fontdrvhost.exe"C:\BlockComponentwebMonitordhcp\fontdrvhost.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\odt\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\odt\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\BlockComponentwebMonitordhcp\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\BlockComponentwebMonitordhcp\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\BlockComponentwebMonitordhcp\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\BlockComponentwebMonitordhcp\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\BlockComponentwebMonitordhcp\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\BlockComponentwebMonitordhcp\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\Network Sharing\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\Network Sharing\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\apppatch\AppPatch64\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\apppatch\AppPatch64\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\apppatch\AppPatch64\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\setup.exe\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\setup.exe\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Documents\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Documents\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\odt\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\Pictures\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Pictures\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 7 /tr "'C:\odt\SearchHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\odt\SearchHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 9 /tr "'C:\odt\SearchHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD540763ae8cfc178ff43b09dbd8aeb8e24
SHA181c31ec6a3fb0ccb59bf4ef2e6653405cdc2534c
SHA2567b94af95b84b86d3b7dedd796d45f4ece48521897bfbcda1049002ceb0f27f7c
SHA512a63bc49760984ae681df2663fa0590660036bf4cddfdfa7f634bcd51147c8e94b7d973ef425716bdd58ccc812d44be6a0682636e6faab84f94756b5e97ecb359
-
Filesize
217B
MD51efe4b745c309f0d730c394a6d1bd25f
SHA18831671936036e79c4daa914d14455c8e2808081
SHA2563dca4af9d3b59a3c498492bf9ddd94961df9f95d535836caa2b8ba710aa73f7e
SHA5129c9a4292c96c6a727a7601831a6ec3f2c11968f898996c14c9bc7c1fb4ce66e9fffd2fabec13d9929ad220956263eecaf5c704833dd7f021a805a438f586ca39
-
Filesize
828KB
MD56b3e49b6d32aca957297d8c71e698737
SHA173294c085a65af8528ea636ee15132020ba38fe5
SHA256fef594135e18a708750abad999febeba51d6efe9d6d3073f02a1acb12731eed8
SHA512151ce51cbcce1ee4cb8b145b02124efc1cb93ef9320da60321cd179d8544930c7f2aa9af4cd4ddd0a71dc32ef5b0069fd8e6bb5e76359d3286d526ccf7e5510b