Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 09:46
Behavioral task
behavioral1
Sample
a452777147dc02f5d8ccacfc0502ac7c.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a452777147dc02f5d8ccacfc0502ac7c.exe
Resource
win10v2004-20240426-en
General
-
Target
a452777147dc02f5d8ccacfc0502ac7c.exe
-
Size
828KB
-
MD5
a452777147dc02f5d8ccacfc0502ac7c
-
SHA1
da8810335c641f55872b90a6ea7f178a0875721c
-
SHA256
c1fb621cbb84ba538603cae73960db7969ec4bde877e5692241c82ea25bdf644
-
SHA512
5015d12dac1a4a6825dcd01adf04b9ea307b3654e851bf07e41087f4ebb1b744b67c397eb0af282b3452cae5849266c7e00c2e41537795d7c78e5c043012d760
-
SSDEEP
12288:jJx18sm9InH/pOz0KkYXPFSdj+ZygwBEMjdvcGtJN1adr:jBDmqnH/G0KkYXKcedvceN1ar
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\smss.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\smss.exe\", \"C:\\Program Files\\Windows Media Player\\ja-JP\\Idle.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\smss.exe\", \"C:\\Program Files\\Windows Media Player\\ja-JP\\Idle.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\fontdrvhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\smss.exe\", \"C:\\Program Files\\Windows Media Player\\ja-JP\\Idle.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\fontdrvhost.exe\", \"C:\\Windows\\PolicyDefinitions\\backgroundTaskHost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\", \"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\", \"C:\\Users\\Default User\\fontdrvhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe -
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 116 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 912 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3560 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2388 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1124 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4484 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3736 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2444 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3044 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4456 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5028 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2980 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3260 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2656 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4004 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4036 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4128 4360 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 4360 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/3200-1-0x0000000000720000-0x00000000007F6000-memory.dmp dcrat C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\smss.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation a452777147dc02f5d8ccacfc0502ac7c.exe -
Executes dropped EXE 1 IoCs
Processes:
fontdrvhost.exepid process 804 fontdrvhost.exe -
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Recovery\\WindowsRE\\backgroundTaskHost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\smss.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Media Player\\ja-JP\\Idle.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Multimedia Platform\\fontdrvhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\PolicyDefinitions\\backgroundTaskHost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\PolicyDefinitions\\backgroundTaskHost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\Windows Multimedia Platform\\fontdrvhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Windows Media Player\\ja-JP\\Idle.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dllhost.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\RemotePackages\\RemoteDesktops\\winlogon.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\smss.exe\"" a452777147dc02f5d8ccacfc0502ac7c.exe -
Drops file in Program Files directory 9 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exedescription ioc process File created C:\Program Files\Windows Media Player\ja-JP\6ccacd8608530f a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe a452777147dc02f5d8ccacfc0502ac7c.exe File opened for modification C:\Program Files (x86)\Windows Portable Devices\dllhost.exe a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\smss.exe a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Program Files\Windows Media Player\ja-JP\Idle.exe a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Program Files\Windows Multimedia Platform\5b884080fd4f94 a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Program Files (x86)\Windows Portable Devices\dllhost.exe a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Program Files (x86)\Windows Portable Devices\5940a34987c991 a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\69ddcba757bf72 a452777147dc02f5d8ccacfc0502ac7c.exe -
Drops file in Windows directory 4 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exedescription ioc process File created C:\Windows\RemotePackages\RemoteDesktops\cc11b995f2a76d a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Windows\PolicyDefinitions\backgroundTaskHost.exe a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Windows\PolicyDefinitions\eddb19405b7ce1 a452777147dc02f5d8ccacfc0502ac7c.exe File created C:\Windows\RemotePackages\RemoteDesktops\winlogon.exe a452777147dc02f5d8ccacfc0502ac7c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2624 schtasks.exe 2468 schtasks.exe 1880 schtasks.exe 3560 schtasks.exe 4484 schtasks.exe 4456 schtasks.exe 2656 schtasks.exe 4036 schtasks.exe 2872 schtasks.exe 912 schtasks.exe 1124 schtasks.exe 3260 schtasks.exe 4004 schtasks.exe 2520 schtasks.exe 3044 schtasks.exe 5028 schtasks.exe 2980 schtasks.exe 2260 schtasks.exe 4128 schtasks.exe 116 schtasks.exe 2388 schtasks.exe 3736 schtasks.exe 2444 schtasks.exe 1980 schtasks.exe -
Modifies registry class 1 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings a452777147dc02f5d8ccacfc0502ac7c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exefontdrvhost.exepid process 3200 a452777147dc02f5d8ccacfc0502ac7c.exe 804 fontdrvhost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.exefontdrvhost.exedescription pid process Token: SeDebugPrivilege 3200 a452777147dc02f5d8ccacfc0502ac7c.exe Token: SeDebugPrivilege 804 fontdrvhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a452777147dc02f5d8ccacfc0502ac7c.execmd.exedescription pid process target process PID 3200 wrote to memory of 2576 3200 a452777147dc02f5d8ccacfc0502ac7c.exe cmd.exe PID 3200 wrote to memory of 2576 3200 a452777147dc02f5d8ccacfc0502ac7c.exe cmd.exe PID 2576 wrote to memory of 2400 2576 cmd.exe w32tm.exe PID 2576 wrote to memory of 2400 2576 cmd.exe w32tm.exe PID 2576 wrote to memory of 804 2576 cmd.exe fontdrvhost.exe PID 2576 wrote to memory of 804 2576 cmd.exe fontdrvhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a452777147dc02f5d8ccacfc0502ac7c.exe"C:\Users\Admin\AppData\Local\Temp\a452777147dc02f5d8ccacfc0502ac7c.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jg9U23qGKp.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:2400
-
-
C:\Users\Default User\fontdrvhost.exe"C:\Users\Default User\fontdrvhost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Windows\RemotePackages\RemoteDesktops\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Windows\RemotePackages\RemoteDesktops\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\ja-JP\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\ja-JP\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\ja-JP\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Windows\PolicyDefinitions\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Windows\PolicyDefinitions\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2520
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
MD5a452777147dc02f5d8ccacfc0502ac7c
SHA1da8810335c641f55872b90a6ea7f178a0875721c
SHA256c1fb621cbb84ba538603cae73960db7969ec4bde877e5692241c82ea25bdf644
SHA5125015d12dac1a4a6825dcd01adf04b9ea307b3654e851bf07e41087f4ebb1b744b67c397eb0af282b3452cae5849266c7e00c2e41537795d7c78e5c043012d760
-
Filesize
202B
MD5905ae58e5990263fc9d47f39aaa4683c
SHA1e49b63d82fceb2e5a57986b0e3d7bb9d80936efb
SHA2561ac30f63e1ed0964219cdba40240b06f185cea0943ed3b1c23a1002e1b377277
SHA51276f09749436b7b302db1b75d669968db6343053a87724675262b9a67e30c9c3b71b0aa7de25ee20623730c1b30122c0ee5552cd263fabd4716b18502467fcb02