Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2024 15:06
Behavioral task
behavioral1
Sample
6e4e01af6b88116f0c7331bba5e7b782.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6e4e01af6b88116f0c7331bba5e7b782.exe
Resource
win10v2004-20240709-en
General
-
Target
6e4e01af6b88116f0c7331bba5e7b782.exe
-
Size
2.0MB
-
MD5
6e4e01af6b88116f0c7331bba5e7b782
-
SHA1
756c0a5ea8aac86f41d118166452a011a608043c
-
SHA256
5a335f4ea90b29144cf268dccdc8f8e1757e57cccc941cc7334b8f4bd7999147
-
SHA512
f49b6146f313624606a9eb80287c23c68aaefcf7ffafacba83a87b333b4388dd38a423a179b7bcb0e1d555873681b405c781faf68e2d7169fa7bcefe4a73874b
-
SSDEEP
24576:jYe7C5QSBzoU/n15NuQtG+7IwzwT2wLqq12OBOa2WYO3QFSBztYSqEEU5oZUSzTO:jYemPM0tvmwGBF223ZztBqEqx9v
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 7 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\services.exe\", \"C:\\Users\\All Users\\Start Menu\\SearchApp.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\services.exe\", \"C:\\Users\\All Users\\Start Menu\\SearchApp.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\\pris\\smss.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\services.exe\", \"C:\\Users\\All Users\\Start Menu\\SearchApp.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\\pris\\smss.exe\", \"C:\\Windows\\SysWOW64\\Dism\\es-ES\\fontdrvhost.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\services.exe\", \"C:\\Users\\All Users\\Start Menu\\SearchApp.exe\", \"C:\\Windows\\SystemApps\\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\\pris\\smss.exe\", \"C:\\Windows\\SysWOW64\\Dism\\es-ES\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\spoolsv.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe -
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2896 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4952 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 228 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1624 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3948 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3612 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3316 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3220 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1844 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2664 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2968 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5112 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1132 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3212 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 628 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 428 948 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 948 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/2336-1-0x00000000002F0000-0x00000000004FE000-memory.dmp dcrat C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\pris\smss.exe dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation 6e4e01af6b88116f0c7331bba5e7b782.exe -
Executes dropped EXE 1 IoCs
Processes:
backgroundTaskHost.exepid process 5100 backgroundTaskHost.exe -
Adds Run key to start application 2 TTPs 14 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\SysWOW64\\Dism\\es-ES\\fontdrvhost.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\Start Menu\\SearchApp.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\All Users\\Start Menu\\SearchApp.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Users\\All Users\\Documents\\backgroundTaskHost.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\\pris\\smss.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\SysWOW64\\Dism\\es-ES\\fontdrvhost.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\SystemApps\\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\\pris\\smss.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Admin\\AppData\\Local\\explorer.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe Set value (str) \REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\services.exe\"" 6e4e01af6b88116f0c7331bba5e7b782.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ip-api.com -
Drops file in System32 directory 2 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process File created C:\Windows\SysWOW64\Dism\es-ES\fontdrvhost.exe 6e4e01af6b88116f0c7331bba5e7b782.exe File created C:\Windows\SysWOW64\Dism\es-ES\5b884080fd4f94 6e4e01af6b88116f0c7331bba5e7b782.exe -
Drops file in Program Files directory 2 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\services.exe 6e4e01af6b88116f0c7331bba5e7b782.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\c5b4cb5e9653cc 6e4e01af6b88116f0c7331bba5e7b782.exe -
Drops file in Windows directory 2 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription ioc process File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\pris\smss.exe 6e4e01af6b88116f0c7331bba5e7b782.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\pris\69ddcba757bf72 6e4e01af6b88116f0c7331bba5e7b782.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1624 schtasks.exe 3316 schtasks.exe 5112 schtasks.exe 4008 schtasks.exe 2896 schtasks.exe 4372 schtasks.exe 2664 schtasks.exe 3212 schtasks.exe 628 schtasks.exe 2056 schtasks.exe 4952 schtasks.exe 228 schtasks.exe 3220 schtasks.exe 1844 schtasks.exe 2968 schtasks.exe 1132 schtasks.exe 3948 schtasks.exe 3612 schtasks.exe 2932 schtasks.exe 3600 schtasks.exe 428 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exebackgroundTaskHost.exepid process 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 2336 6e4e01af6b88116f0c7331bba5e7b782.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe 5100 backgroundTaskHost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exebackgroundTaskHost.exedescription pid process Token: SeDebugPrivilege 2336 6e4e01af6b88116f0c7331bba5e7b782.exe Token: SeDebugPrivilege 5100 backgroundTaskHost.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
6e4e01af6b88116f0c7331bba5e7b782.exedescription pid process target process PID 2336 wrote to memory of 5100 2336 6e4e01af6b88116f0c7331bba5e7b782.exe backgroundTaskHost.exe PID 2336 wrote to memory of 5100 2336 6e4e01af6b88116f0c7331bba5e7b782.exe backgroundTaskHost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e4e01af6b88116f0c7331bba5e7b782.exe"C:\Users\Admin\AppData\Local\Temp\6e4e01af6b88116f0c7331bba5e7b782.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\All Users\Documents\backgroundTaskHost.exe"C:\Users\All Users\Documents\backgroundTaskHost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Documents\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\All Users\Documents\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\AppData\Local\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Start Menu\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Start Menu\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\pris\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\pris\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\pris\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\SysWOW64\Dism\es-ES\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\SysWOW64\Dism\es-ES\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\SysWOW64\Dism\es-ES\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD56e4e01af6b88116f0c7331bba5e7b782
SHA1756c0a5ea8aac86f41d118166452a011a608043c
SHA2565a335f4ea90b29144cf268dccdc8f8e1757e57cccc941cc7334b8f4bd7999147
SHA512f49b6146f313624606a9eb80287c23c68aaefcf7ffafacba83a87b333b4388dd38a423a179b7bcb0e1d555873681b405c781faf68e2d7169fa7bcefe4a73874b