Overview
overview
10Static
static
700b9b6cf27...f7.exe
windows11-21h2-x64
105500734fe...81.exe
windows11-21h2-x64
0b75e2fadf...c5.exe
windows11-21h2-x64
80d5fa75218...64.exe
windows11-21h2-x64
101760c5727e...9c.exe
windows11-21h2-x64
71fe99fb7c5...81.exe
windows11-21h2-x64
72336173567...98.exe
windows11-21h2-x64
72522b83852...03.exe
windows11-21h2-x64
72af6bc16f2...b2.exe
windows11-21h2-x64
73d9f9c162e...64.exe
windows11-21h2-x64
73db846a796...e5.exe
windows11-21h2-x64
7493813116f...dc.exe
windows11-21h2-x64
74d61a61265...08.exe
windows11-21h2-x64
7510827ce68...c5.exe
windows11-21h2-x64
75642f8bd3b...2a.exe
windows11-21h2-x64
76c37d14d5a...4c.exe
windows11-21h2-x64
76c3c9af653...c3.exe
windows11-21h2-x64
777186e57b2...20.exe
windows11-21h2-x64
77bca70a81c...61.exe
windows11-21h2-x64
78e934dcd46...88.exe
windows11-21h2-x64
79a75c8e353...60.exe
windows11-21h2-x64
79e067453f0...f3.exe
windows11-21h2-x64
7a9a89ed0d1...0f.exe
windows11-21h2-x64
7b4ab8f5c8b...95.exe
windows11-21h2-x64
7c034313090...ef.exe
windows11-21h2-x64
8c45a330cf8...24.exe
windows11-21h2-x64
7d42fc4dabd...06.exe
windows11-21h2-x64
7d66f6565e9...91.exe
windows11-21h2-x64
7e16d377c12...36.exe
windows11-21h2-x64
7e302f733d4...02.exe
windows11-21h2-x64
7fe3b2cf08a...d5.exe
windows11-21h2-x64
7fff0ccf5fe...51.exe
windows11-21h2-x64
7Resubmissions
21-08-2024 19:30
240821-x76q3sweqg 1021-08-2024 17:42
240821-v92h2avgpj 1012-06-2024 16:01
240612-tgps4a1bqh 10Analysis
-
max time kernel
60s -
max time network
67s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-06-2024 16:01
Behavioral task
behavioral1
Sample
00b9b6cf27deeda8de99d1719ef724808afa92080026df8dd17159be8ea420f7.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
05500734fe07ac2b5bc89aa12b090203c4b74851cb0d62bd388f27ec6d6caa81.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
0b75e2fadffc45dff940e58f5b6f8d99832426bb880f432f98d853308b29c9c5.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
1fe99fb7c527a90826896e695f23e712375358df3c7aa9163af6b96d872a9f81.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
23361735678f37d77510b22306c727a987f84c87143bb0062f3d76413c36fc98.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
2522b83852588bc0f7f620f9b4fe3a9337b9608be335d3958d190275f333df03.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
2af6bc16f25822d6d2f1429bc15f3d47f6c0bcb026ba387249d173fc753919b2.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
3d9f9c162e130c197301adb5a4e141f2e1ae8a19c85b457c429e8410a5c91464.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
3db846a796caa001666df8f7cae709fff02f984711b0e70e0e79c457d631b4e5.exe
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
493813116f32ad6f455676cd54e32a2167ece845038202614cbb49e126f5afdc.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
4d61a61265cdd942cff973609170529eaf19579b5d17e64deccbd6f6f1fdfa08.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
5642f8bd3bc151349ded1a3c160c037c26194c9da2b7ace5d8ca11cddb57612a.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
6c37d14d5ad674e4c0fa8df0a999be6b27399936c9ff16f7fb30b802addb7b4c.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
6c3c9af653a28977257ce971ed701b1b893cdf67d5c57baa44a9d76c28675dc3.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
77186e57b2eeb3ed4b56cfe280d5eeea3155d9502217cda824600bc93d365320.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
7bca70a81cc9e1067e99e313802a4cc095f79bbc3a1aa86b7b3b9eabf3748e61.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
8e934dcd46eb57d42712d097deab6ce00ef1ce2db87d03f8d3d8e8c10da7e088.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
9a75c8e353df060ec927ada5990402b57764275f2a860d9cf500a661ec3de060.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
9e067453f09c5cbfa4c5a74fe3e70d7d8e66a25057e6c35240dce5a40ec31bf3.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
a9a89ed0d139fbc436794f5d3a8e58c547247039d8c86767b1e2f2bce40e390f.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
b4ab8f5c8b97307b328ba30fdefdbe4341c4e2c576729fdb5c7329d5b07bb695.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
c03431309015563257e5e118656d07ce136f151339054b9f66894ecf9dde9aef.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
c45a330cf80c33977658649596d4867301e928381c5fc37ec3edabfad2251324.exe
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
d42fc4dabd9a9e74156d1a856cb542ed2e0796d2d7c6b976c0ac5421a87f9806.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
d66f6565e97f43030ff6fba9c9550894aad05affb66efaf561ec229d80b0a691.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
e16d377c12b63acb694601b4bde36d61839054409e7fae1661fb051892d2ed36.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
e302f733d4a31342a0c908055a6e59b3fd8f1ed3ce98750d00251e4f0efe6c02.exe
Resource
win11-20240611-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
fe3b2cf08a6224a04194a6555b4593b0a7428cb1fe057c08776d09568fc58cd5.exe
Resource
win11-20240419-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151.exe
Resource
win11-20240611-en
windows11-21h2-x64
General
-
Target
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe
-
Size
9.4MB
-
MD5
813b749967045532f86e6442447bcd8b
-
SHA1
8d0615e7f7ba672a3fc94c05a9451f9d08797af7
-
SHA256
0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
-
SHA512
47c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877
-
SSDEEP
24576:GYx7SFGwWG8/Ad5kybgeK8uQY2ZqR7NlaDbTxnVhv2MMLdGIhJ:IFFbK8q2ZhDbTNv2MuV
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
resource yara_rule behavioral4/memory/4588-6-0x0000000000400000-0x0000000000538000-memory.dmp dcrat -
Executes dropped EXE 3 IoCs
pid Process 2140 spoolsv.exe 2508 spoolsv.exe 2904 spoolsv.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
pid Process 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1020 set thread context of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 2140 set thread context of 2904 2140 spoolsv.exe 117 -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\e6c9b481da804f07baff8eff543b0a1441069b5d 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File created C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1792 1020 WerFault.exe 79 3280 2140 WerFault.exe 106 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2936 schtasks.exe 900 schtasks.exe 2568 schtasks.exe 4828 schtasks.exe 3920 schtasks.exe 4116 schtasks.exe -
Delays execution with timeout.exe 6 IoCs
pid Process 940 timeout.exe 4852 timeout.exe 5052 timeout.exe 5112 timeout.exe 3196 timeout.exe 2452 timeout.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2140 spoolsv.exe 2904 spoolsv.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe Token: SeDebugPrivilege 2140 spoolsv.exe Token: SeDebugPrivilege 2904 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1020 wrote to memory of 3376 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 80 PID 1020 wrote to memory of 3376 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 80 PID 1020 wrote to memory of 3376 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 80 PID 3376 wrote to memory of 5052 3376 cmd.exe 82 PID 3376 wrote to memory of 5052 3376 cmd.exe 82 PID 3376 wrote to memory of 5052 3376 cmd.exe 82 PID 1020 wrote to memory of 3948 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 83 PID 1020 wrote to memory of 3948 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 83 PID 1020 wrote to memory of 3948 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 83 PID 3948 wrote to memory of 5112 3948 cmd.exe 85 PID 3948 wrote to memory of 5112 3948 cmd.exe 85 PID 3948 wrote to memory of 5112 3948 cmd.exe 85 PID 1020 wrote to memory of 1620 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 86 PID 1020 wrote to memory of 1620 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 86 PID 1020 wrote to memory of 1620 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 86 PID 1620 wrote to memory of 3196 1620 cmd.exe 88 PID 1620 wrote to memory of 3196 1620 cmd.exe 88 PID 1620 wrote to memory of 3196 1620 cmd.exe 88 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 1020 wrote to memory of 4588 1020 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 89 PID 4588 wrote to memory of 2936 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 4588 wrote to memory of 2936 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 4588 wrote to memory of 2936 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 94 PID 4588 wrote to memory of 900 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 96 PID 4588 wrote to memory of 900 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 96 PID 4588 wrote to memory of 900 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 96 PID 4588 wrote to memory of 2568 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 98 PID 4588 wrote to memory of 2568 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 98 PID 4588 wrote to memory of 2568 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 98 PID 4588 wrote to memory of 4828 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 100 PID 4588 wrote to memory of 4828 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 100 PID 4588 wrote to memory of 4828 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 100 PID 4588 wrote to memory of 3920 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 102 PID 4588 wrote to memory of 3920 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 102 PID 4588 wrote to memory of 3920 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 102 PID 4588 wrote to memory of 4116 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 104 PID 4588 wrote to memory of 4116 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 104 PID 4588 wrote to memory of 4116 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 104 PID 4588 wrote to memory of 2140 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 106 PID 4588 wrote to memory of 2140 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 106 PID 4588 wrote to memory of 2140 4588 0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe 106 PID 2140 wrote to memory of 1960 2140 spoolsv.exe 107 PID 2140 wrote to memory of 1960 2140 spoolsv.exe 107 PID 2140 wrote to memory of 1960 2140 spoolsv.exe 107 PID 1960 wrote to memory of 2452 1960 cmd.exe 109 PID 1960 wrote to memory of 2452 1960 cmd.exe 109 PID 1960 wrote to memory of 2452 1960 cmd.exe 109 PID 2140 wrote to memory of 4596 2140 spoolsv.exe 110 PID 2140 wrote to memory of 4596 2140 spoolsv.exe 110 PID 2140 wrote to memory of 4596 2140 spoolsv.exe 110 PID 4596 wrote to memory of 940 4596 cmd.exe 112 PID 4596 wrote to memory of 940 4596 cmd.exe 112 PID 4596 wrote to memory of 940 4596 cmd.exe 112 PID 2140 wrote to memory of 3392 2140 spoolsv.exe 113 PID 2140 wrote to memory of 3392 2140 spoolsv.exe 113 PID 2140 wrote to memory of 3392 2140 spoolsv.exe 113 PID 3392 wrote to memory of 4852 3392 cmd.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5052
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:3196
-
-
-
C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"C:\Users\Admin\AppData\Local\Temp\0d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\RuntimeBroker.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "explorer" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\explorer.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:900
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\OfficeClickToRun.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2568
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\RuntimeBroker.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4828
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Searches\spoolsv.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:3920
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4116
-
-
C:\Recovery\WindowsRE\spoolsv.exe"C:\Recovery\WindowsRE\spoolsv.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:2452
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:940
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 14⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
PID:4852
-
-
-
C:\Recovery\WindowsRE\spoolsv.exe"C:\Recovery\WindowsRE\spoolsv.exe"4⤵
- Executes dropped EXE
PID:2508
-
-
C:\Recovery\WindowsRE\spoolsv.exe"C:\Recovery\WindowsRE\spoolsv.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 9124⤵
- Program crash
PID:3280
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 9042⤵
- Program crash
PID:1792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1020 -ip 10201⤵PID:2244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2140 -ip 21401⤵PID:2280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.4MB
MD5813b749967045532f86e6442447bcd8b
SHA18d0615e7f7ba672a3fc94c05a9451f9d08797af7
SHA2560d5fa75218e5eb97fccbcf36d3bbd9cd77247260977f69c50deb29399ee0e464
SHA51247c16f403ab33ebb9e59c7c3a053dc29d0d654174d2be9153966ad9fc873e641f34ab44c7e38fb4c6fd376b384d4e1da0dacafb384e9abb1c7eb92cb32533877