Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 20:20
Behavioral task
behavioral1
Sample
installer.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
installer.exe
Resource
win10v2004-20240508-en
General
-
Target
installer.exe
-
Size
12.6MB
-
MD5
1d7779cf1eb8b628fb7b51632ff0b1ef
-
SHA1
8517b912bf43920019974502e845c46008153c81
-
SHA256
eaf369efb906f72afea8f894b6867ef70bc87acafcc04f28c6fedb2bf512c0ba
-
SHA512
d27224331c80334a35d4b6089db009a03edb7d80cca12c2483517617d4cbea618fc10a6599ca869de6a2a52022d71f9c07ea8fa328fb341f01506133bb71c42b
-
SSDEEP
98304:qN8TuGLcT86GaEk4xK+NAwmRtaudDN8TuGLcT86GaEk4xK+NAwmRtaud0bJzREdj:V4crE5Gud24crE5Gud0lkoxw
Malware Config
Extracted
44caliber
https://discord.com/api/webhooks/1239246319751528579/IYIQqMQxDmDpiYnpeLyqY8m4ky9T5uSTQX5CVjPoiRejTrVzBHNdk_JlDhnNu15EaRmp
Extracted
xworm
lesbian-organ.gl.at.ply.gg:38343
-
Install_directory
%LocalAppData%
-
install_file
javaw.exe Java(TM) Platform SE binary.exe
-
telegram
https://api.telegram.org/bot7026469441:AAEt3_GfOceSfMaQnCWR3hwEjHcRpqL852Q/sendMessage?chat_id=1434801883
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Xworm Payload 2 IoCs
resource yara_rule behavioral2/files/0x00070000000233bb-20.dat family_xworm behavioral2/memory/2568-40-0x0000000000320000-0x0000000000336000-memory.dmp family_xworm -
Modifies WinLogon for persistence 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\", \"C:\\bridgeHyperCrt\\dwm.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\", \"C:\\bridgeHyperCrt\\dwm.exe\", \"C:\\Users\\Public\\sysmon.exe\", \"C:\\Users\\Default\\Downloads\\csrss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\", \"C:\\bridgeHyperCrt\\dwm.exe\", \"C:\\Users\\Public\\sysmon.exe\", \"C:\\Users\\Default\\Downloads\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\", \"C:\\bridgeHyperCrt\\dwm.exe\", \"C:\\Users\\Public\\sysmon.exe\", \"C:\\Users\\Default\\Downloads\\csrss.exe\", \"C:\\Users\\Admin\\Start Menu\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\", \"C:\\bridgeHyperCrt\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\sppsvc.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\", \"C:\\bridgeHyperCrt\\dwm.exe\", \"C:\\Users\\Public\\sysmon.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\System.exe\", \"C:\\bridgeHyperCrt\\cmd.exe\", \"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\", \"C:\\Users\\Default\\Saved Games\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\"" Realtek HD Audio Universal Service.exe -
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1460 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3192 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4028 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1304 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3004 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1420 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4208 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1568 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1520 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1120 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4404 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4788 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3640 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1072 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1952 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3892 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4184 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3408 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3932 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1316 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4484 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 720 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3812 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1852 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2268 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3868 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4748 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4196 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3876 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4596 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2824 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 64 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3648 728 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3304 728 schtasks.exe 89 -
resource yara_rule behavioral2/files/0x0006000000023270-4.dat dcrat behavioral2/memory/2924-6-0x0000000000400000-0x00000000010AD000-memory.dmp dcrat behavioral2/files/0x00070000000233b9-13.dat dcrat behavioral2/memory/1532-39-0x0000000000400000-0x0000000000BC8000-memory.dmp dcrat behavioral2/files/0x00070000000233d9-167.dat dcrat behavioral2/memory/3976-169-0x00000000008F0000-0x0000000000B34000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2608 powershell.exe 1296 powershell.exe 2020 powershell.exe 4076 powershell.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation installer.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation installer1.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Realtek HD Audio Universal Service.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation javaw.exe Java(TM) Platform SE binary.exe Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation Realtek HD Audio Universal Service.exe -
Executes dropped EXE 6 IoCs
pid Process 1532 installer1.exe 1332 Realtek HD Audio Universal Service.exe 2568 javaw.exe Java(TM) Platform SE binary.exe 2848 Updata.exe 3976 Realtek HD Audio Universal Service.exe 2880 backgroundTaskHost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 35 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\Saved Games\\wininit.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\bridgeHyperCrt\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Downloads\\csrss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default\\Downloads\\csrss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Start Menu\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\WindowsRE\\System.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\bridgeHyperCrt\\dwm.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Public\\sysmon.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaw.exe Java(TM) Platform SE binary = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\bridgeHyperCrt\\cmd.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\bridgeHyperCrt\\cmd.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Default\\Saved Games\\wininit.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\WindowsRE\\sppsvc.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaw.exe Java(TM) Platform SE binary = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\92.0.902.67\\javaw.exe Java(TM) Platform SE binary.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaw.exe Java(TM) Platform SE binary = "C:\\Users\\Admin\\AppData\\Local\\javaw.exe Java(TM) Platform SE binary.exe" javaw.exe Java(TM) Platform SE binary.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\backgroundTaskHost.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\bridgeHyperCrt\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\bridgeHyperCrt\\dwm.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\dotnet\\host\\fontdrvhost.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\All Users\\Documents\\SppExtComObj.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Users\\Public\\sysmon.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\Start Menu\\RuntimeBroker.exe\"" Realtek HD Audio Universal Service.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 freegeoip.app 7 freegeoip.app 19 ip-api.com -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe Realtek HD Audio Universal Service.exe File created C:\Program Files\dotnet\host\fontdrvhost.exe Realtek HD Audio Universal Service.exe File created C:\Program Files\dotnet\host\5b884080fd4f94 Realtek HD Audio Universal Service.exe File created C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe Realtek HD Audio Universal Service.exe File created C:\Program Files (x86)\Windows Multimedia Platform\eddb19405b7ce1 Realtek HD Audio Universal Service.exe File created C:\Program Files (x86)\Windows Photo Viewer\fr-FR\9e8d7a4ca61bd9 Realtek HD Audio Universal Service.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\javaw.exe Java(TM) Platform SE binary.exe Realtek HD Audio Universal Service.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\b48fb2592db131 Realtek HD Audio Universal Service.exe File created C:\Program Files\ModifiableWindowsApps\fontdrvhost.exe Realtek HD Audio Universal Service.exe File created C:\Program Files\ModifiableWindowsApps\powershell.exe Realtek HD Audio Universal Service.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\OCR\en-us\SearchApp.exe Realtek HD Audio Universal Service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2584 schtasks.exe 1120 schtasks.exe 3640 schtasks.exe 3304 schtasks.exe 4404 schtasks.exe 1072 schtasks.exe 3812 schtasks.exe 1304 schtasks.exe 3868 schtasks.exe 4748 schtasks.exe 4208 schtasks.exe 2356 schtasks.exe 2164 schtasks.exe 4652 schtasks.exe 4028 schtasks.exe 4660 schtasks.exe 4196 schtasks.exe 1568 schtasks.exe 720 schtasks.exe 1504 schtasks.exe 4788 schtasks.exe 3892 schtasks.exe 1528 schtasks.exe 3004 schtasks.exe 3916 schtasks.exe 1460 schtasks.exe 1520 schtasks.exe 3408 schtasks.exe 4484 schtasks.exe 3876 schtasks.exe 2520 schtasks.exe 2864 schtasks.exe 4988 schtasks.exe 2268 schtasks.exe 2252 schtasks.exe 1576 schtasks.exe 2708 schtasks.exe 1952 schtasks.exe 3932 schtasks.exe 5012 schtasks.exe 1852 schtasks.exe 1420 schtasks.exe 4596 schtasks.exe 2456 schtasks.exe 2824 schtasks.exe 64 schtasks.exe 3648 schtasks.exe 2960 schtasks.exe 3192 schtasks.exe 4184 schtasks.exe 1316 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings Realtek HD Audio Universal Service.exe Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings Realtek HD Audio Universal Service.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 2848 Updata.exe 2848 Updata.exe 2848 Updata.exe 2848 Updata.exe 3976 Realtek HD Audio Universal Service.exe 2608 powershell.exe 2608 powershell.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 1296 powershell.exe 1296 powershell.exe 2020 powershell.exe 2020 powershell.exe 4076 powershell.exe 4076 powershell.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 3976 Realtek HD Audio Universal Service.exe 2568 javaw.exe Java(TM) Platform SE binary.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe 2880 backgroundTaskHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2880 backgroundTaskHost.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2848 Updata.exe Token: SeDebugPrivilege 2568 javaw.exe Java(TM) Platform SE binary.exe Token: SeDebugPrivilege 3976 Realtek HD Audio Universal Service.exe Token: SeDebugPrivilege 2608 powershell.exe Token: SeDebugPrivilege 1296 powershell.exe Token: SeDebugPrivilege 2020 powershell.exe Token: SeDebugPrivilege 4076 powershell.exe Token: SeDebugPrivilege 2568 javaw.exe Java(TM) Platform SE binary.exe Token: SeDebugPrivilege 2880 backgroundTaskHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2568 javaw.exe Java(TM) Platform SE binary.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2924 wrote to memory of 1532 2924 installer.exe 81 PID 2924 wrote to memory of 1532 2924 installer.exe 81 PID 2924 wrote to memory of 1532 2924 installer.exe 81 PID 1532 wrote to memory of 1332 1532 installer1.exe 82 PID 1532 wrote to memory of 1332 1532 installer1.exe 82 PID 1532 wrote to memory of 1332 1532 installer1.exe 82 PID 1532 wrote to memory of 2568 1532 installer1.exe 83 PID 1532 wrote to memory of 2568 1532 installer1.exe 83 PID 1532 wrote to memory of 2848 1532 installer1.exe 84 PID 1532 wrote to memory of 2848 1532 installer1.exe 84 PID 1332 wrote to memory of 3840 1332 Realtek HD Audio Universal Service.exe 88 PID 1332 wrote to memory of 3840 1332 Realtek HD Audio Universal Service.exe 88 PID 1332 wrote to memory of 3840 1332 Realtek HD Audio Universal Service.exe 88 PID 3840 wrote to memory of 4692 3840 WScript.exe 90 PID 3840 wrote to memory of 4692 3840 WScript.exe 90 PID 3840 wrote to memory of 4692 3840 WScript.exe 90 PID 4692 wrote to memory of 3976 4692 cmd.exe 92 PID 4692 wrote to memory of 3976 4692 cmd.exe 92 PID 2568 wrote to memory of 2608 2568 javaw.exe Java(TM) Platform SE binary.exe 93 PID 2568 wrote to memory of 2608 2568 javaw.exe Java(TM) Platform SE binary.exe 93 PID 2568 wrote to memory of 1296 2568 javaw.exe Java(TM) Platform SE binary.exe 103 PID 2568 wrote to memory of 1296 2568 javaw.exe Java(TM) Platform SE binary.exe 103 PID 2568 wrote to memory of 2020 2568 javaw.exe Java(TM) Platform SE binary.exe 115 PID 2568 wrote to memory of 2020 2568 javaw.exe Java(TM) Platform SE binary.exe 115 PID 2568 wrote to memory of 4076 2568 javaw.exe Java(TM) Platform SE binary.exe 124 PID 2568 wrote to memory of 4076 2568 javaw.exe Java(TM) Platform SE binary.exe 124 PID 3976 wrote to memory of 1016 3976 Realtek HD Audio Universal Service.exe 152 PID 3976 wrote to memory of 1016 3976 Realtek HD Audio Universal Service.exe 152 PID 1016 wrote to memory of 736 1016 cmd.exe 156 PID 1016 wrote to memory of 736 1016 cmd.exe 156 PID 1016 wrote to memory of 2880 1016 cmd.exe 159 PID 1016 wrote to memory of 2880 1016 cmd.exe 159 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\installer1.exe"C:\Users\Admin\AppData\Local\Temp\installer1.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"C:\Users\Admin\AppData\Local\Temp\Realtek HD Audio Universal Service.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\bridgeHyperCrt\FOAEdrh1BxsF.vbe"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\bridgeHyperCrt\OI0pwrYEs8WKMbQhaocS5DTAkNJim.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\bridgeHyperCrt\Realtek HD Audio Universal Service.exe"C:\bridgeHyperCrt\Realtek HD Audio Universal Service.exe"6⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bDJ3HLMgpe.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:736
-
-
C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe"C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\javaw.exe Java(TM) Platform SE binary.exe"C:\Users\Admin\AppData\Local\Temp\javaw.exe Java(TM) Platform SE binary.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\javaw.exe Java(TM) Platform SE binary.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'javaw.exe Java(TM) Platform SE binary.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\javaw.exe Java(TM) Platform SE binary.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'javaw.exe Java(TM) Platform SE binary.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Updata.exe"C:\Users\Admin\AppData\Local\Temp\Updata.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\bridgeHyperCrt\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\bridgeHyperCrt\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\bridgeHyperCrt\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Documents\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\Documents\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Documents\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Saved Games\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\bridgeHyperCrt\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\bridgeHyperCrt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\bridgeHyperCrt\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\host\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\dotnet\host\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files\dotnet\host\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "javaw.exe Java(TM) Platform SE binaryj" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\javaw.exe Java(TM) Platform SE binary.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "javaw.exe Java(TM) Platform SE binary" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\javaw.exe Java(TM) Platform SE binary.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "javaw.exe Java(TM) Platform SE binaryj" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\javaw.exe Java(TM) Platform SE binary.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\bridgeHyperCrt\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\bridgeHyperCrt\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\bridgeHyperCrt\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\Public\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Users\Public\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Downloads\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Downloads\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Start Menu\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2824
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:64
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3304
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d53ffe54a1f3684c4c2f50077052b83b
SHA10ed591b1f02e3a3571d6723b5fd7ff722a02b1e5
SHA256a398913fa3254e700e5e2995a489309894a7f9ce9e14617382d76d77982ab7d2
SHA512963e6dc7d1d158cffe2da763d905b6bbac94e9a216b245c30ab68e78814d4c1071b3fe2c9f98b17b88fb334232fb5269060e1d68ae65e4b781d8c44dd6dcf304
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5eb1ad317bd25b55b2bbdce8a28a74a94
SHA198a3978be4d10d62e7411946474579ee5bdc5ea6
SHA2569e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
SHA512d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
-
Filesize
2.5MB
MD53389fc2b0cbe478b8ff249b7fedc75ed
SHA1949a474ba3ad5913504b999516e0e7aac6d1854c
SHA2567e4efd43ace17028eacb97352fe2ea46d44b96aca3068130b0cdec4dbba081b1
SHA512707f7bcf0d86212654d1f69f2dd8e753dc8a67a1bc9d5a5132e60c852ba6d4b30063656e0e6f87104ec7825404add94e8bfff5ec1757df7add4c1b604cd30313
-
Filesize
303KB
MD5fa8baa8b5f5e19777e1b20104defff51
SHA1a17922c107c303693489530dbfa3bb20afc24e59
SHA25642538f0378843cc317f37ff9731b8c917f6763d811c0fde29bac25b759402f47
SHA5124e2478795dacfe440860f03c8b0e318f238b2d2e09e278c995b49a90415ff275c87645f3d22cbff6102e5db683d4d98f0ef13abb6002eb19c647f86ec8d69d62
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
238B
MD5621da80180c0d5f3df26bf7796ca16c7
SHA197fc91ec8bb9de89bd405f3f65a1d0280335bde6
SHA2569dc908e2d4b0cb81ea5940f0435723eda4e24ac2bb9fbc09f502bfdc7651cd43
SHA512a78d4a9bea0de48059d0e0bfd2a317c9020fc14fbdf6a1062e49249d6e3f4565bfca794ac45b408f3562d599128ca51ea5441064d6aa8a0097f545eba523308a
-
Filesize
7.8MB
MD5f3d4a56f1ec903519f4c37129423bd73
SHA172f0835888eea6e63e142d208b3997a708d7331b
SHA256eb346407fcdb18f374cd2c9e309f8d8e986e8679d370c1f530723d0a0c8c3579
SHA5121847df8f65d254a270722bf968b5e14230c3b9cb13b8bd0886aadb7c1da11d8ad43f56483be634b5010919843bbf4997cf5ada31a6a3e81671e173b0994630ac
-
Filesize
66KB
MD552409e4dbf9ed75c7fd6fbb4e7b1593c
SHA1b2124798396292059c64fcb5e3d40a742ea66f0b
SHA2568c63a9bbb49745a61fbf450e78485966222810403844af067f43046092b02112
SHA512b72e769ced2813f5c93731e9c96bdafeb7359c9aa2b23fe9cb8bea675e1c2fcb2a7208b21bf0fc73d8255ee73bb732aea58ff7ff3a14c7727425947fa3f5c1a7
-
Filesize
231B
MD591dfc7252bcd06d82af9f64190b08c7e
SHA14eea175d57c3631c0dab65cff1c325d59b5d34a8
SHA256fdee20a4260f6ba25d38608473eb51910fd1780e104edc51b7feea672f23858b
SHA512b56eea94d6f4660f1022464c82d0595c8ddf18fdd5977c6bc9dd7baae2c8090d188b418c1b6d2556e3b630823d526b27640d06fe8a5f6fffc776caa4907b2d30
-
Filesize
69B
MD5ae3ca8c85d0b24e4a5d8665f7cb83466
SHA1cea7807241d92dca00ed5d9283e21142ffbbb14c
SHA256afddd637f38e2c904b3c6c717d6277fe9f9566e29f2940e371289ab259f4e869
SHA512e3379655f409bd348fbcf61be7cba93627b0a3fb30cadc47f036e3fe03a69d2e9631d7339984ae426cbd5145db1c22a9aec5c98f5806ef0caf1bf69a412c1c99
-
Filesize
2.2MB
MD58b8ad5d190af5992165ab74f2c4d2539
SHA14c7dcd839b39b6da31c575e6c0078b948c486ca0
SHA256fa7c73b719b35f3ed6e23c1c1f216f9c344a3a95a46d9779ddb90cacbde81624
SHA512eb957611286cc642dac606a2cd65ae49a67c15832f5383983dc65075d48ab7c4c74873a30cbf9ff024b29d0282b2e1e6e731365a78f23c912fbd5a799568aa0c