Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 22:33
Behavioral task
behavioral1
Sample
1e55e82940a34f0347e2ec84674cb6c0N.exe
Resource
win7-20240704-en
General
-
Target
1e55e82940a34f0347e2ec84674cb6c0N.exe
-
Size
2.4MB
-
MD5
1e55e82940a34f0347e2ec84674cb6c0
-
SHA1
49a82cd8c8a3f020b6dbe9f9a4c409e16b0bbe33
-
SHA256
8695345472b86220ef4154c2c8f86e301569b082238c84aeff34dea0c5c204e3
-
SHA512
ce004fa9917044abf01664806301fe84c090e7ebd2e5378b95ecc92b8de37587d411384c54598c515046b93d0f6547c2030d0946b62213ad59e8c2986cb63634
-
SSDEEP
49152:+bA3xoX3ciWYFZGNtz4QG+evJ692QNMkY/ZXZqqhRfgAlWzRA:+b6CFczzmDv892QNBYRXZqqhxg5RA
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3308 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3580 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1160 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2492 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1164 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3944 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4948 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4148 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1956 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3296 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3236 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2448 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3948 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3596 4080 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 4080 schtasks.exe -
Processes:
RuntimeBroker.exechainInto.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chainInto.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" chainInto.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" chainInto.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe -
Processes:
resource yara_rule C:\containerreviewCrtMonitordll\chainInto.exe dcrat behavioral2/memory/1756-13-0x0000000000510000-0x000000000072A000-memory.dmp dcrat -
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
chainInto.exeRuntimeBroker.exe1e55e82940a34f0347e2ec84674cb6c0N.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation chainInto.exe Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 1e55e82940a34f0347e2ec84674cb6c0N.exe Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 2 IoCs
Processes:
chainInto.exeRuntimeBroker.exepid process 1756 chainInto.exe 5084 RuntimeBroker.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
chainInto.exeRuntimeBroker.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chainInto.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA chainInto.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Program Files directory 4 IoCs
Processes:
chainInto.exedescription ioc process File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\38384e6a620884 chainInto.exe File created C:\Program Files\Windows Sidebar\RuntimeBroker.exe chainInto.exe File created C:\Program Files\Windows Sidebar\9e8d7a4ca61bd9 chainInto.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe chainInto.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
Processes:
1e55e82940a34f0347e2ec84674cb6c0N.exechainInto.exeRuntimeBroker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings 1e55e82940a34f0347e2ec84674cb6c0N.exe Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings chainInto.exe Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings RuntimeBroker.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1032 schtasks.exe 1164 schtasks.exe 4948 schtasks.exe 3236 schtasks.exe 3596 schtasks.exe 3580 schtasks.exe 1956 schtasks.exe 3948 schtasks.exe 1724 schtasks.exe 2940 schtasks.exe 1160 schtasks.exe 2492 schtasks.exe 3944 schtasks.exe 2316 schtasks.exe 4148 schtasks.exe 3296 schtasks.exe 532 schtasks.exe 3308 schtasks.exe 2188 schtasks.exe 1196 schtasks.exe 2448 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chainInto.exeRuntimeBroker.exepid process 1756 chainInto.exe 1756 chainInto.exe 1756 chainInto.exe 1756 chainInto.exe 1756 chainInto.exe 1756 chainInto.exe 1756 chainInto.exe 1756 chainInto.exe 1756 chainInto.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe 5084 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
chainInto.exeRuntimeBroker.exedescription pid process Token: SeDebugPrivilege 1756 chainInto.exe Token: SeDebugPrivilege 5084 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
1e55e82940a34f0347e2ec84674cb6c0N.exeWScript.execmd.exechainInto.execmd.exeRuntimeBroker.exedescription pid process target process PID 1264 wrote to memory of 1696 1264 1e55e82940a34f0347e2ec84674cb6c0N.exe WScript.exe PID 1264 wrote to memory of 1696 1264 1e55e82940a34f0347e2ec84674cb6c0N.exe WScript.exe PID 1264 wrote to memory of 1696 1264 1e55e82940a34f0347e2ec84674cb6c0N.exe WScript.exe PID 1696 wrote to memory of 4568 1696 WScript.exe cmd.exe PID 1696 wrote to memory of 4568 1696 WScript.exe cmd.exe PID 1696 wrote to memory of 4568 1696 WScript.exe cmd.exe PID 4568 wrote to memory of 1756 4568 cmd.exe chainInto.exe PID 4568 wrote to memory of 1756 4568 cmd.exe chainInto.exe PID 1756 wrote to memory of 4728 1756 chainInto.exe cmd.exe PID 1756 wrote to memory of 4728 1756 chainInto.exe cmd.exe PID 4568 wrote to memory of 2164 4568 cmd.exe reg.exe PID 4568 wrote to memory of 2164 4568 cmd.exe reg.exe PID 4568 wrote to memory of 2164 4568 cmd.exe reg.exe PID 4728 wrote to memory of 3192 4728 cmd.exe w32tm.exe PID 4728 wrote to memory of 3192 4728 cmd.exe w32tm.exe PID 4728 wrote to memory of 5084 4728 cmd.exe RuntimeBroker.exe PID 4728 wrote to memory of 5084 4728 cmd.exe RuntimeBroker.exe PID 5084 wrote to memory of 5020 5084 RuntimeBroker.exe WScript.exe PID 5084 wrote to memory of 5020 5084 RuntimeBroker.exe WScript.exe PID 5084 wrote to memory of 4752 5084 RuntimeBroker.exe WScript.exe PID 5084 wrote to memory of 4752 5084 RuntimeBroker.exe WScript.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
chainInto.exeRuntimeBroker.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chainInto.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" chainInto.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" chainInto.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" RuntimeBroker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" RuntimeBroker.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe"C:\Users\Admin\AppData\Local\Temp\1e55e82940a34f0347e2ec84674cb6c0N.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\containerreviewCrtMonitordll\QvTRwOydF6PvsPSbsHoz.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\containerreviewCrtMonitordll\1Tl2sJLOUZoaFKUtUGyztdW5bQFfO.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\containerreviewCrtMonitordll\chainInto.exe"C:\containerreviewCrtMonitordll\chainInto.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1756 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KTdiCR95eO.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3192
-
C:\Program Files\Windows Sidebar\RuntimeBroker.exe"C:\Program Files\Windows Sidebar\RuntimeBroker.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5084 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\849733cd-f3bb-405d-b0cf-0783b4ff1a7a.vbs"7⤵PID:5020
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\737da2e8-1b26-4020-88b8-daa7507ea84c.vbs"7⤵PID:4752
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\containerreviewCrtMonitordll\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3308
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\containerreviewCrtMonitordll\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2492
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\containerreviewCrtMonitordll\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\containerreviewCrtMonitordll\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\containerreviewCrtMonitordll\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 9 /tr "'C:\containerreviewCrtMonitordll\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\containerreviewCrtMonitordll\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\containerreviewCrtMonitordll\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\containerreviewCrtMonitordll\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1188
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
502B
MD57aa1a991f29a40b8a10e02291f66ac62
SHA1e978fbe62a82392cd3e1902ed19230fd7a727f9d
SHA25693500c3e952422665868d08ad9ac99596f8e65f8a1ea78bd6d9adc4b5ac17827
SHA5121047f0e8eadbd42616c9d4c701bd63573085f0c09418726a0b90dd67a71a468ba35b938588a3afa655fa4fe266d2edbe2e32d4985858fe689547e690d817b4c2
-
Filesize
726B
MD58564f6464a4db984e793f582c2a09494
SHA14da13edcccbd7b5ca085033c204cf0fa0aa65e7c
SHA256c28fe11185242c7570bbc75355ece32f7be1a815764e8a1fbfc2cd24952a4250
SHA512395756d6e09d2ecd1190158317e5f46379ab4827f298f25b723d59f0862b1452ab30d49ffaadd98af025ba75a03d92fee842530435dbbf93c03ed10d4138b43d
-
Filesize
215B
MD5caa1cf3c296a2726a4234c250d9499a2
SHA1a3b4f75e1da358e1e315f51361318e7461a0f55a
SHA256b9ea3b0d26667e189b4c1582da66f293e94cba1af7e992fc4c687b8939c20f62
SHA51296239272a3cb4693de3a79c594a94fca327bafd2a53a911bbbc6964f5db5c42a54c05b8588390f9447c12c1a36f61b9f9a1bde6483a3bf73e7a234bc1f55f097
-
Filesize
170B
MD57039783955d4e215e90cdb16e30d51a8
SHA1a3ed136fd2a8e57e760d7f1f4412a4c6d96219d4
SHA256df9a53758d5c34e9422b418b8c28e3f7441dcf2fb48fb81d620e684e50384e84
SHA5127a7b75ea177c4a46a19ebbae5fb7f0fb18dcec0ea617bb377beace17bf3b34098527153ba58852cc4764083c5bfc86e6602340c81a61366d0da5dea3d3bcfb15
-
Filesize
245B
MD5c9cb24932937faaa045133e6803ba799
SHA12b0a00bbb55b5f13a782b4881445a6acf1658d6c
SHA2560d74b56311e7161e43106e63e697b61e5ea268a86d771d9758a181fbf9a071d4
SHA512c0607bd0c567b392e74bbdef99c3f5dfdd7e7217ac8aa5d3a9559f94096ee75e01ff686264d5508e84e3dc9a9b4bd0a159e0f4c86dc175c349563c2af3f83838
-
Filesize
2.1MB
MD553426df99660bf62cab83572cc516da2
SHA1e638b51282a10a04d60803920f6ed95b9f9db670
SHA256390711a4056290cd6dbdc327d81178f7c38ab1850aeb9bde35c1307dd8132481
SHA51258a3a3a3da60cb8e7132f444136630a1f6f2f9072b65cc24482799b8e69a872ee2d8aedef879b7c1bb248878aee0ef42d2e454a794331318b08020e2457e78f9