Analysis
-
max time kernel
6s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 08:16
Behavioral task
behavioral1
Sample
68DFE1E08B8CC7D19FF72334FDD09DB8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
68DFE1E08B8CC7D19FF72334FDD09DB8.exe
Resource
win10v2004-20240226-en
General
-
Target
68DFE1E08B8CC7D19FF72334FDD09DB8.exe
-
Size
4.1MB
-
MD5
68dfe1e08b8cc7d19ff72334fdd09db8
-
SHA1
34fb36f9b553c26b0753f540b6a8af1760bb74dc
-
SHA256
a5f4363625928d7fb64087212bd9d094972260739b274f44b53bbbd5be6d19b7
-
SHA512
035d3806dafbd5e3a6358072363267178215c74a2f66750792e839d8f24a4244338d1a59862953eb872b5a13ae675647310818a05f1f70206f1ea15157cc8686
-
SSDEEP
98304:b2iJbE5xmRwLHVZCC55YkdOsfMvBh0ND4wELWZ:yMaxAWHVkq5Y2fMkNDILWZ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 544 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4564 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 800 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3308 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1308 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3388 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1216 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2896 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5064 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3924 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4292 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 912 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5020 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1284 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4588 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3468 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2336 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1380 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2148 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4400 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4888 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4716 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4448 4164 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4996 4164 schtasks.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\ÑyberLoad.exe dcrat behavioral2/memory/4900-9-0x0000000000400000-0x0000000000828000-memory.dmp dcrat behavioral2/memory/4936-26-0x0000000000400000-0x0000000000816000-memory.dmp dcrat C:\Users\Admin\AppData\Local\Temp\CyberLoader.exe dcrat C:\msPortRefnetdhcp\componentWininto.exe dcrat behavioral2/memory/904-45-0x0000000000CC0000-0x000000000102A000-memory.dmp dcrat C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe dcrat C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe dcrat C:\Recovery\WindowsRE\TrustedInstaller.exe dcrat C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe dcrat C:\Recovery\WindowsRE\TrustedInstaller.exe dcrat C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe dcrat C:\Recovery\WindowsRE\TrustedInstaller.exe dcrat C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe dcrat C:\Recovery\WindowsRE\TrustedInstaller.exe dcrat C:\Users\Admin\AppData\Local\Temp\86ae682e6d948293292a7ef74ea52370bce4d839.exe dcrat C:\Recovery\WindowsRE\TrustedInstaller.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
68DFE1E08B8CC7D19FF72334FDD09DB8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 68DFE1E08B8CC7D19FF72334FDD09DB8.exe -
Executes dropped EXE 1 IoCs
Processes:
ÑyberLoad.exepid process 4936 ÑyberLoad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4448 schtasks.exe 636 schtasks.exe 3308 schtasks.exe 5020 schtasks.exe 3468 schtasks.exe 2184 schtasks.exe 1380 schtasks.exe 1184 schtasks.exe 1308 schtasks.exe 4588 schtasks.exe 4400 schtasks.exe 2896 schtasks.exe 4292 schtasks.exe 912 schtasks.exe 4996 schtasks.exe 544 schtasks.exe 3924 schtasks.exe 2148 schtasks.exe 5064 schtasks.exe 4888 schtasks.exe 4716 schtasks.exe 4564 schtasks.exe 800 schtasks.exe 3388 schtasks.exe 1216 schtasks.exe 1284 schtasks.exe 2336 schtasks.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
68DFE1E08B8CC7D19FF72334FDD09DB8.exedescription pid process target process PID 4900 wrote to memory of 4936 4900 68DFE1E08B8CC7D19FF72334FDD09DB8.exe ÑyberLoad.exe PID 4900 wrote to memory of 4936 4900 68DFE1E08B8CC7D19FF72334FDD09DB8.exe ÑyberLoad.exe PID 4900 wrote to memory of 4936 4900 68DFE1E08B8CC7D19FF72334FDD09DB8.exe ÑyberLoad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68DFE1E08B8CC7D19FF72334FDD09DB8.exe"C:\Users\Admin\AppData\Local\Temp\68DFE1E08B8CC7D19FF72334FDD09DB8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\ÑyberLoad.exe"C:\Users\Admin\AppData\Local\Temp\ÑyberLoad.exe"2⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\MVPLoader.exe"C:\Users\Admin\AppData\Local\Temp\MVPLoader.exe"3⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\CyberLoader.exe"C:\Users\Admin\AppData\Local\Temp\CyberLoader.exe"3⤵PID:1048
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msPortRefnetdhcp\zRMFcMzN1094wnGdurNck4fGlt.vbe"4⤵PID:2628
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\msPortRefnetdhcp\m6JlOKDKnmGOe6a.bat" "5⤵PID:2304
-
C:\msPortRefnetdhcp\componentWininto.exe"C:\msPortRefnetdhcp\componentWininto.exe"6⤵PID:904
-
C:\Recovery\WindowsRE\TrustedInstaller.exe"C:\Recovery\WindowsRE\TrustedInstaller.exe"7⤵PID:4480
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9ee0076-7ea7-4874-b88b-e9177fbb1464.vbs"8⤵PID:2160
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe9⤵PID:4060
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fbfb69bc-c075-4c3b-a4b5-0c417549f563.vbs"10⤵PID:3800
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe11⤵PID:4392
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5adc8a36-11f1-4cf8-8373-2f9bed59ff9c.vbs"12⤵PID:572
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe13⤵PID:3712
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8058d4c0-1639-4d67-93cb-918b0bf3a5ca.vbs"14⤵PID:1384
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe15⤵PID:4028
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00900bbe-a1a2-4bfb-a064-5542fb9a2403.vbs"16⤵PID:1468
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe17⤵PID:532
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\143cc8fe-2e5d-4b5b-a568-4b693b14c9d9.vbs"18⤵PID:3468
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe19⤵PID:2896
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87c52eea-b259-4f0c-b2f1-1cf26be1fbcf.vbs"20⤵PID:2208
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe21⤵PID:3444
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52532dd7-a923-42a4-b72d-e53450dda146.vbs"22⤵PID:4664
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe23⤵PID:3464
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb7fb210-c78b-4572-ad55-9423dc66b3ab.vbs"24⤵PID:2496
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe25⤵PID:1688
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c02573e6-09ae-4a84-b889-1efe7587ad0a.vbs"26⤵PID:4300
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe27⤵PID:3792
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8169a4b5-b70f-471e-8d83-da2ad75f9172.vbs"28⤵PID:4392
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe29⤵PID:1364
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ca1cb197-ab6b-4c78-a663-267a5c6535be.vbs"30⤵PID:2776
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe31⤵PID:1260
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\733e315f-f6dd-4ec8-8329-4eeb72c896ae.vbs"32⤵PID:1028
-
C:\Recovery\WindowsRE\TrustedInstaller.exeC:\Recovery\WindowsRE\TrustedInstaller.exe33⤵PID:3252
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\78ac76ec-cf59-434b-a4e5-2ed537d94220.vbs"34⤵PID:3264
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be66aa15-2b11-43b2-9b43-f2a74e009fba.vbs"34⤵PID:2148
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af617c1f-b988-430e-8f74-a0a28316bfdc.vbs"32⤵PID:1452
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a45686cc-37b1-428e-ab73-3a7d47df02aa.vbs"30⤵PID:2172
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cdf60ff5-d79e-46ee-bab2-a150e674bce8.vbs"28⤵PID:1764
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33bff42c-1d2d-4843-9595-d1611cbe04fa.vbs"26⤵PID:3648
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03d1b6bd-53e1-4389-80c8-31f4e71206d6.vbs"24⤵PID:2668
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6cb37077-7b5d-46b6-891d-1db55d15e4bb.vbs"22⤵PID:2324
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c091cf82-18bc-4311-9519-33a01c37c951.vbs"20⤵PID:2612
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4230705b-649b-431d-b16d-c0e703b8d7e8.vbs"18⤵PID:1552
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9fb7153e-6b16-439a-9847-64a506751def.vbs"16⤵PID:3396
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3d03bf1-b14b-4cb5-9704-4de97a333463.vbs"14⤵PID:4588
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc42a7d4-fcb1-4c50-a774-f41ec04f9751.vbs"12⤵PID:5028
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\53d44db7-8fbc-4ccb-b3c0-c3b7daf893e9.vbs"10⤵PID:3184
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f0b392bd-eba4-45ac-84b6-3bb46f36d701.vbs"8⤵PID:4564
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\msPortRefnetdhcp\file.vbs"4⤵PID:876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\odt\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\odt\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Default\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\Default\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstaller" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TrustedInstallerT" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\TrustedInstaller.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\msedge.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "msedgem" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Schema\msedge.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\odt\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Windows\appcompat\appraiser\Telemetry\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\appcompat\appraiser\Telemetry\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Windows\appcompat\appraiser\Telemetry\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\odt\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\odt\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3924
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:3264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD503f531ba947b5a31eb66f037ab21b36c
SHA1918b36a92d76e2976bbbd0bc4435e0618482f7fd
SHA256171b4720781b71f2bace24fd86001ca9634ea6f9501863518d1b80730fecdb44
SHA512895a76eb7f4c0834449674227675d0aaa8a43f4258af26d0544a2ccbe9fcdb155621559e4fb7b20714860d0a2e9be447e7efadaff3bdec4edff3da0cee69f90b
-
Filesize
2.6MB
MD51743e6d45b282cc31e8262f39442f1c7
SHA1e94718cce628cf02e18ffbcfe15fc3c2c64a964f
SHA2563c62a4a88e2e2c2ccea782bab5daab123e64bba01a4635c2762375f3b0ccd228
SHA512f8b18bbcabac7b266e64dd5d9d18556711e7b512fa73edd87a72506effcf0852a9af2572b950ca515e504bed367a2c601649017de08ed1a612c64a5afdbfc6aa
-
Filesize
2.1MB
MD533b38da0bc60991b971e6aa46633d9b1
SHA122076ae375764fab15809c5e10fc44bacf084cc2
SHA256783dc3338713e7cac82379b7688193e1240078051218b35aa65612c2e0bf8188
SHA51250d616dd0cb291f21795aa1483c3281a5ea06203ff8e5120e1105aad934ddabdf760510dcae2f04486275364a6665f16a03f55f9bab07b8968bce07d1161fd0b
-
Filesize
1.1MB
MD5c81d5b427b8575f1410ec0f1eb2d6b6e
SHA15d5606d0f8dfbebf8d5d8c973f8d2024e5be817f
SHA256fac2d79700f5a8f6f402e96c37d15948ab8f141e23ebfaf0b531dc4ff7664c81
SHA51224ef2116170a3e6372cbad73a81639fcf9b5d299ba5ee375e63150ddc1ff51292309ae8b566f125b40eb1ce615ad47deed502ef16d529d96535d5d84e15afa35
-
Filesize
717KB
MD5db46c3b57ab03ec305c5215a43f055fb
SHA178ff2d5e1b3e9db7048fa8077338b04eedc9e7ae
SHA256904b1afbd95f5e1a7b9701c7adb0b88f63d307af533400c96376570f34073f6e
SHA5126337c6788117a592eebca30c9faa4c9755c15c0433f48c3f9724183b4df09c0e8d8d42d450945b6d3f66df8a4b6f5074218c109407552db5c5a7417515d8b5eb
-
Filesize
639KB
MD5606881050f110878fafa4b53161e60a0
SHA14773ef78f439edf69742cc1e817df8ff3ed2831c
SHA25602ade1a7b998b910f59f5aa90230da1e7de2cb107162a8874876f485838e95de
SHA512742bf248bf310b8a6f540ceacedfb7aaaf31771d7d5c406a0d07a2753b38fb326018eb6f51d9d65b80dfadfa76a25e3c4a3a308839b4b6ed95ee571e6f5f376e
-
Filesize
1KB
MD549b64127208271d8f797256057d0b006
SHA1b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA2562a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e
-
Filesize
718B
MD5d988b8dd983b9d9222b40b489348c557
SHA19b11466a4ef854aed28264a80946d008e84b357e
SHA2567cfe07b969c4b7769c232db328c17f73ee424d1bf0e2ea098240a624531aed69
SHA512797e0e83b335a7379be696608161301c4c707ffe336ed5c85754207e7bb1d15571ddb1f72b1e27832739b1e6da848a120169206b7b614bd2dcf61f300ac862de
-
Filesize
717B
MD540d61e14f1ba2ff357cdcb92682fa6fb
SHA1698d8e5060c79cecc5343949808e6535749f7f84
SHA256e28f8d480883b1901d8231eaa73122e467034648db6ca6de4ee9960677b4a3f2
SHA512a03462fed6d2794badd6b36178d50662f86c7ad26b293ed173597d03812a97df4afcd2f04c804f756ee957cc75e14cb72872814f460922a7fea6fcebcebdbf28
-
Filesize
718B
MD5025fee54938b897c0cfa51bfad3f8667
SHA19eebd51c468d33ce1f1d4c560a525ec64cc2be47
SHA256970af32db83ce92a9b0ed2399e3eaf2f6496ff73394b62cd680076816fd2fc64
SHA5126b3939ba38c3ff32acffc3dc7eea684c6d81960ba4efdb3a965de1f668f72580d0e21fcee3ac7a7495779d768c5fb19d6930ad83eb6dfd4134f39936007367fb
-
Filesize
718B
MD50f879f18aed8734be78c36a8047942bd
SHA14c5d34ced633f4fd6285ebe184b9dd9711fa97a5
SHA25608b50d0e1205a92a65deefb63c917ef8f66663633782f727884d813a420c64e5
SHA5126e8b2dc73a2ef41606d737b24a8fc7806d684e8af30e6883e103b8bad9b93089c000a16682f40d102ee8177ce82270195e3ff5db96055d8840310f9963851280
-
Filesize
718B
MD5617f7424559b7b6ee45d3804b7b6f12f
SHA1760b1dc2dab38e7b2027470484a66ad90904bf31
SHA2568e742f42cf9110cba333410b88053d1921592bc584e4d0780eecdbdc5e693b6a
SHA512f475a18cb31a42192774855577ee2494e32ce683515a65234e3a0bb0b6fe31fbfa5347e8772d49c2f41af1e60ecf1a6e34c4a312891f5fb3fe2701c568d2804b
-
Filesize
718B
MD5733d2e553c73dbdf1fb323920e42de09
SHA18883bb9cfe9d67acd730f8a0ce042c896375bd13
SHA2564573fc874408d05264cf8ed5b95f69f36218fe76735b05308ab9ef1e527e49b5
SHA512aaab679df8117eeabf63122df22749cf6c1366f93b82297d7c3a45288b356a43619982f5f87228ce067cf0423625e29784858e4da630cee07806eed193f8ca6a
-
Filesize
718B
MD56f14742aff4d9c38e881f750d24338fe
SHA10ba031c11cf7726d397a8ffd827f03b04a51ee36
SHA25609421781f94227ab1ecc9dfb94ce0b7158c5a36a78124cca8b58938bfdad5d50
SHA512c7e78796d16ee4279ce0bb80f43c170a628efae299e2771425b8468cbfe4264f13c1c1ee9acecd5f292b972e87e2cc275630fb60622ddd564ec8d39362015dbf
-
Filesize
3.4MB
MD52409ef09b4ba0fd16cdeaca5faa04f7e
SHA149a6a8c80428ba64ff4e67eedfa7f6af4af7991e
SHA256fd61de173f4047da0c786c3cc5c1b53cb20b60aad08b15737892de17fd92e15f
SHA5124320f905a04e0ca6f4ac81485e922eb72b3b10316c01fb7817f07319026eaf9d2a23e50fdc76532beea66c04b79a2b8a255c35fce1fd4afb481c42942b8935e0
-
Filesize
2.9MB
MD5ccbe7cb11c55066736c69145a5624d11
SHA194f879751c552d4f238a448eafc7b5c97638c120
SHA25610f2494413bb5515eda3552c2ca57616ca3f3990bdb2f770507e342083ebb05e
SHA512b5c6e02de877bff1d4e7fc9455c6ac038209f99eb0d1c54fa715ee8172f67e772ce4e47b6b35f3bdf7cc4856c89beaf6bacfff6061d2c5bfba9c24d27f57b715
-
Filesize
2.6MB
MD52a4499f3a730783fea00bee850390b09
SHA1e64f913e1b30c46cc8f61ab95f829d5037b3be9d
SHA2564b5f3c6b2c9ba878ab6dab2fcf99406cc3ed02f82ed81afa94ab72265441bff4
SHA512c03d14b36916937b82224bd7d19526cee2dcb49532f47baa732bb8db2f57751694ae2df1dff63875b5608c93a043084a0c11744df157fcb6288ff3bb750dc054
-
Filesize
1.8MB
MD5a8d74fa4b14727ec19b1ddd2fa3a8e61
SHA17fc4bd53271ed555111c7fba515006f82a8d286a
SHA25647aeea09b4ff36819159cd2325e8e70f1ff7b5dc80c398ef80035b1e6c834866
SHA512e585e2606bafa1fbac0865cf8854b08fb6f9a62180c85496de1111cba16113005e2f89bc2dc7154f62be836d292e7ea6ef79cc686622022f9e0675d0eb5bd3c6
-
Filesize
1.3MB
MD5c49eff4ab89798cf3ac5d952f710a135
SHA1e40ac7e7cd329efc2bbdca2fecae5368fba68126
SHA2561c365b3676e965b706b5cf172c77d4be1ea71b00ca30d6579702f420be0caf3e
SHA512edc53e2804b5b66226c6415281bc546172239cb5ff9a65fe182f05c5e834089e72fa559546925e4b7713ae16fdd97039804999d5c2936391ad3c8c7e7b31c0df
-
Filesize
755KB
MD557efcb2a60c4761230be4068ea87d361
SHA1d0b86ba7a409c0f3fd2a64dbaed0f1c37dcc49b0
SHA256a8cca4829a05d9c55a0a8ea6774365702da8299e77ef071972abb55428c5a35d
SHA512e92be040870dcda8c5e8cb69791944345d21326b21adbdfcc3d1ab324c4e59ae941d48b5942ba60a06b9a93a9e4cce394f33529fba57cf658447a9d409799ca1
-
Filesize
718B
MD5aacf42054099a9baa9bb94e59f0b3841
SHA1a7196cf568548f9789cb7d54aecab3e7f54c5c47
SHA256c65983a3a00e0c6c9ffd293032b272c75d31218361a286aac3ab6e0dee3de4a7
SHA512b2b4889bcc53a9b6a1a289f54f8560911be6c7e6e3b19abba7c7c949998c0eb3fee824da761b1b11fb607a55cf19374666c9c098470dfb3f57d1278afdebc38d
-
Filesize
3.7MB
MD51b4cf2a40e1387cf97dfbe1303c9619a
SHA1a3f98a0ca89495958f6171f775aa6b96bdf6e0de
SHA2566e7050be5d9e4042ba632c228890329f41550608b6de25094bdf5e4ae9448833
SHA512a45b2066cc48cfab284fd61ab5413ba0368bb457af22425a8b469a83ca4ff75f3378b43dc6ce988caac98b8272333e31e590a3c2ae8a3ffd4b1fe9199f5b8400
-
Filesize
340KB
MD5f1f43cf5a79e51ba13ef602b25c63a9e
SHA1df986285c4e6f2355b0f528a13063f5d855a250c
SHA2564dff4a3558b40b19e961fc8adc45e00b2b7dbd6ebabbc219d1446bc6ca5350e8
SHA5126867d3d6d01a4a170e4d5ab9115408a97c7e5a00730632259d9afae7b688f214c455c014bdff2fc90185dd92f96c06d0c13f39ab09535e1add9fb7ea49ec5384
-
Filesize
718B
MD5777b0fb19f2f483fbecf86f7378099e8
SHA17c4ac8ffb199f8bdf8df1a10499c2e52e932dbaa
SHA2566c1ce3db617e91a79e8fae16ce4327907902f0be3873c32f3545374ab73d0405
SHA512cdf6363aac984e25de62d77e07e27cca94c7d1c2d781288d12e7ff2dbf0a6aeaedec8d61b2545d13e610b53054ee81310ed22033e396a2cf8b7f586d6d32b332
-
Filesize
718B
MD5af9f930835c5a8eca48caa4c458d4e3e
SHA11add351a56bde3c23a6e6862a303fe70abe24b8c
SHA2563b710018aa4b23fbe2a337e1ea2da049f8912644387c1c715b83a6fc9f41eb1e
SHA512b6277f5a8ece102d6266b5290e79e254b14c8c52d57fffd40b897b6e96d4f2d2fed2b921275e0c999f70021222a3a1584b8289c3b393bc5f4aa1c0f0a576917f
-
Filesize
718B
MD5531bb82eb3a4a909a736ad8f884f4b7b
SHA180422179289a15819be1b8774f445e60a35dda03
SHA256ad5bb85a45330ad380323f33558c41280104408563087de0b88824ac05a30b01
SHA51201be16af3d7364062dffccce973e0c3d6d0a96c74f07f7dc5e30b3832546fe7d5fc33dc017407f5156df93d4573839b0607d516a254cae20c48cc46500dba086
-
Filesize
494B
MD5caf32538dd0579c0f2e50468eada9f82
SHA1c99d46d1981ba0a752b76b225f99dbc88a4e0153
SHA256c6a6d03effad8b18178c579fa349387ed7ea6f820d82e11587b3a326aeb63a8c
SHA512d27d2edf39f22962e9b4a42853b31e6a120a9d6c1d444ce9a6e4d0a57432f708a6ddcfad465cd496ebabef9f5e83482398d595a383bfe6b1b989392fc976cf5f
-
Filesize
718B
MD56c9f0741c843e55fddbcc72ee653e7ca
SHA1613815370af5f009ff437f851c140dda8035c820
SHA2563cdbb436dea7b29aeeeb2b2dd477e0a05ee245296067518f4d0ed44fc37058bb
SHA5120f406ee08fd45d35b418505db968ecf49fdce972c27cc30f384ef4c52dd4a4e4dc8e9a9d5f58188b3132d3e8710e775fcfad36ed21c424d6179bdd706b75a003
-
Filesize
718B
MD556af6b73eeac874f60bb81ad01e96de1
SHA15e42dba3059956e3eca063b666b5eb0e081d452d
SHA256c82663237a854e2c04fb88eb37cb088ce9bca3ac6d7533bef9e79cc9738c5d1f
SHA5125b8b76c26ff5cfc6df6e0e292c4fb03485f517b22510e12425c5e9ad8babd63d8a293cb6e9eff428484235603d14d0cad03a60101f53193f4f15a15660652bb4
-
Filesize
4.1MB
MD5a84070968353edcc9559f54deedd8fe9
SHA127187ea020c4fcfad6783debbea35883b1125538
SHA2566b1ff20c95ab7ea0d16f441c6726f6112bbae1c620696f2e9bec01b4926dc1f4
SHA512134a25e91d0b088a9dd57ce0310a1f164f6586624dd71a02001ece26b70d3d8fd201ece35b5a9b15764f983cbf9da099b8f13b5e99584ada093f12c506a2500e
-
Filesize
3.4MB
MD553758cea18d59182a809208313d5042a
SHA10234e732dea00414c79ca2ce8a55f61843f282d2
SHA2565cae0557099a16d45a03f05f95390ec5bd5ba5a44edd73286e741fe09f93bddf
SHA5123d7900c7a6060367beaf7abde33027958d28091b001d25c395d191f0cf442216d5cacff4a123bbd1ae767f471ae3a517659f9c42798be8c772f2f7411a7b952e
-
Filesize
34B
MD5677cc4360477c72cb0ce00406a949c61
SHA1b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA256f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
SHA5127cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
-
Filesize
42B
MD5b025044714b20d9d7069a2c2f55ddf04
SHA136d7dce3f0fa6a1bd86e795bcde3c9a1b2e9a7f6
SHA256e6d9546e0e8d9b92ef203f408f33722c3b4ffcd2f400aa08bb0b49ac182b69b3
SHA5123a24c4ad9c1b298a97c5d4e994233a84dc27d4c0d612cc8d8e94cbd16e3ceaec96d66d4503a6a506644de509a3509f53ea122bf92cc09de087254f40b5a1c65c
-
Filesize
208B
MD5c7c964910bef0490e2a401349c25126b
SHA1ba3581dc5945f35f83bc216fc5a1decfbe6e47ef
SHA256d41a100832e46a8928ad06780a40e08f147e97ac014170ca48779f98f4d5b7ff
SHA512198c571a056d5896928b5a93c918e9f7407dd0d5e39893db39a1dbcad9d6ec2df63925cbe69346f8f4681bfe37c23844feee5cbd1f45bc9c48796aef1d66372f