Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe
Resource
win10v2004-20240426-en
General
-
Target
7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe
-
Size
2.0MB
-
MD5
20d1a291ba22e0d37ba1c9ef7c4f2a8e
-
SHA1
977deb9b18a8599aac68cfd86fd95219a54fc8c4
-
SHA256
7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a
-
SHA512
662369dcf70c1abe0142a139f950df672d62b3dbda910a804b6ef6a76280fa543aba4d1a9e52bea1584cdc0c674110b7a11fb0948be82e27c77e92b465f16d42
-
SSDEEP
24576:2y2KxiKAGfq78Qh7zCIU1D6hynUlAqFzATZAguEkVm2nc6DKcPGsiSbBydwBFrUm:2K1WlU1D6hk8RFzAZ5+m21Kc+sPbVT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppPatch\\fr-FR\\csrss.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\Idle.exe\", \"C:\\Users\\Default User\\csrss.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppPatch\\fr-FR\\csrss.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\Idle.exe\", \"C:\\Users\\Default User\\csrss.exe\", \"C:\\Program Files\\Microsoft Office\\Office14\\1033\\explorer.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppPatch\\fr-FR\\csrss.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppPatch\\fr-FR\\csrss.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\spoolsv.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\AppPatch\\fr-FR\\csrss.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\Idle.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe -
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2792 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2948 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2512 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2496 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2000 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2784 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2820 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 2612 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1520 2612 schtasks.exe 28 -
Executes dropped EXE 1 IoCs
pid Process 808 Idle.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\Idle.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\explorer.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\AppPatch\\fr-FR\\csrss.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\spoolsv.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\spoolsv.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Microsoft Office\\Office14\\1033\\explorer.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\AppPatch\\fr-FR\\csrss.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\Idle.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\Default User\\csrss.exe\"" 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created \??\c:\Windows\System32\hccjfr.exe csc.exe File created \??\c:\Windows\System32\CSCC5A5918A6661467091E1B034B188881D.TMP csc.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\Office14\1033\explorer.exe 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe File created C:\Program Files\Microsoft Office\Office14\1033\7a0fd90576e088 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\AppPatch\fr-FR\csrss.exe 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe File created C:\Windows\AppPatch\fr-FR\886983d96e3d3e 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe File created C:\Windows\AppPatch\fr-FR\csrss.exe 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2948 schtasks.exe 2512 schtasks.exe 2672 schtasks.exe 2000 schtasks.exe 2568 schtasks.exe 1528 schtasks.exe 2784 schtasks.exe 2808 schtasks.exe 2820 schtasks.exe 1620 schtasks.exe 2792 schtasks.exe 1584 schtasks.exe 2496 schtasks.exe 1684 schtasks.exe 1520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 808 Idle.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe Token: SeDebugPrivilege 808 Idle.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 808 Idle.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2620 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 32 PID 1244 wrote to memory of 2620 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 32 PID 1244 wrote to memory of 2620 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 32 PID 2620 wrote to memory of 2592 2620 csc.exe 34 PID 2620 wrote to memory of 2592 2620 csc.exe 34 PID 2620 wrote to memory of 2592 2620 csc.exe 34 PID 1244 wrote to memory of 2348 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 47 PID 1244 wrote to memory of 2348 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 47 PID 1244 wrote to memory of 2348 1244 7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe 47 PID 2348 wrote to memory of 2764 2348 cmd.exe 49 PID 2348 wrote to memory of 2764 2348 cmd.exe 49 PID 2348 wrote to memory of 2764 2348 cmd.exe 49 PID 2348 wrote to memory of 2756 2348 cmd.exe 50 PID 2348 wrote to memory of 2756 2348 cmd.exe 50 PID 2348 wrote to memory of 2756 2348 cmd.exe 50 PID 2348 wrote to memory of 808 2348 cmd.exe 51 PID 2348 wrote to memory of 808 2348 cmd.exe 51 PID 2348 wrote to memory of 808 2348 cmd.exe 51 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe"C:\Users\Admin\AppData\Local\Temp\7e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bxgxxmbu\bxgxxmbu.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES251D.tmp" "c:\Windows\System32\CSCC5A5918A6661467091E1B034B188881D.TMP"3⤵PID:2592
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\S2jOVRNz9g.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:2764
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:2756
-
-
C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\Idle.exe"C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\Idle.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:808
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\AppPatch\fr-FR\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\AppPatch\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\AppPatch\fr-FR\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\Office14\1033\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Office14\1033\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1520
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD520d1a291ba22e0d37ba1c9ef7c4f2a8e
SHA1977deb9b18a8599aac68cfd86fd95219a54fc8c4
SHA2567e052903db8c20022280f156834b9af172c7877b7253104562f77d61f8c3de6a
SHA512662369dcf70c1abe0142a139f950df672d62b3dbda910a804b6ef6a76280fa543aba4d1a9e52bea1584cdc0c674110b7a11fb0948be82e27c77e92b465f16d42
-
Filesize
1KB
MD53a156091a0ffc2281285ccdc06bbcf34
SHA1a209b338825a99ea460cb45837181081f7242351
SHA2568d9db717316096aaa67a834ebcf54c69f3a271252e1b884dd4fb68ccdac2aa81
SHA5129e340653996193ca0356bbec25200a16aede5660c2f49f5fa1ea76394772bf200c0004d46838393fa013d42e5e39db7af805480030f96f7182920f720ce1155a
-
Filesize
233B
MD5baf407747e823a53d559b9615e73593d
SHA1c497fd07b8b613d7b94d9332dc8c4169b617a095
SHA256c25bf4efe912930e004c0d0fa4bef9b81bb5627efdf23b30a6c33a066c9dec94
SHA5129c1c4dd5967411e6f3b111d65bc889675c40c9b6c26f71eaea2570008988e8876a84fb1f78285d5baec3b881a2f15289a63cc8dd6e77c96ed0608764d0ff1750
-
Filesize
367B
MD5b9f4990c2e8d3609b2f2df9ff81d7b09
SHA1d83a54fe9369e4057b15907bf0ca60d4079807b9
SHA2562011d42e0eedfd93cbb929fc221231e63620df7de1c77367d1d751fa640daac2
SHA51293915f49e17dc1f5f66c9ecb485846b61ab14cefc279d1540117c5dbe503a55923d78fcc003b5779bc79f5559b5138bf1fa5de9fe5f31b485660092257904cf8
-
Filesize
235B
MD5c6b800b26f107488b8d146acb065fb19
SHA1d51c40e021dc035487da89306745f764c85d2839
SHA25655283da17fde8558e5e45a4703a336e3b56b6a1b471cd1105f00fcfb204d849e
SHA512f583dc41239f6a5aad2630cc9ab3295a343d2a977bf6f3c528d54a0baf990d8e4ee839de617b68268a265ac428f63e0b8b57843303d3dd9fcbe37e423afd14e6
-
Filesize
1KB
MD5707f3ae17d1443518c14e3d57f6b0fa5
SHA178ac15700b932222fa2ce60142966a1716c90838
SHA2561fafc870513c7e90d1f2569dd473478821fb4798e8eb51e1f8a1620b3bf29aea
SHA512ac3805f209da253c7eb6758d472a7c6a084392594a4dd7389dc926181933f9333fa0a74d7f749bc7ecb0b901afa5cad91d64d62989122acd3f4b583c3a4e2c9f