Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-07-2024 16:22

General

  • Target

    682f5e5eb1673b692d4009f655f51b7926031ff7e8c1d4aecfd62cfd1e1d7c2a.exe

  • Size

    1.3MB

  • MD5

    f946ceb3dfbc4802323f045e77b9fc63

  • SHA1

    04beac37360d30c5ad933f82f80bfd41ae294cc4

  • SHA256

    682f5e5eb1673b692d4009f655f51b7926031ff7e8c1d4aecfd62cfd1e1d7c2a

  • SHA512

    7ad0db10f788d63d44a85981ccd9cf7c5acaadad66d1fd4c34554eb77bd1582e49549c917eb39e0c17e7b55b2fc0e262c059e1d85c188f1a3649879368a834e3

  • SSDEEP

    24576:qwwpL4DsvfsODQY2mq7yTK32HbzpEOlM7RJFolBjvmPln0Ep9GKc6NC1t:qw8LnsvQKMzpEOlM7RJqlhgq8rC1

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
  • Process spawned unexpected child process 24 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 8 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Adds Run key to start application 2 TTPs 16 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\682f5e5eb1673b692d4009f655f51b7926031ff7e8c1d4aecfd62cfd1e1d7c2a.exe
    "C:\Users\Admin\AppData\Local\Temp\682f5e5eb1673b692d4009f655f51b7926031ff7e8c1d4aecfd62cfd1e1d7c2a.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Default\Cookies\fontdrvhost.exe
      "C:\Users\Default\Cookies\fontdrvhost.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:508
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc033611-d2d0-44b0-b277-4977adef5908.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4900
        • C:\Users\Default\Cookies\fontdrvhost.exe
          C:\Users\Default\Cookies\fontdrvhost.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4140
          • C:\Windows\System32\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\257d045d-0555-4632-9085-4363078208f3.vbs"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4300
            • C:\Users\Default\Cookies\fontdrvhost.exe
              C:\Users\Default\Cookies\fontdrvhost.exe
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3972
              • C:\Windows\System32\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32432e3c-d9de-4559-9a06-dd76fc0ea08e.vbs"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:3176
                • C:\Users\Default\Cookies\fontdrvhost.exe
                  C:\Users\Default\Cookies\fontdrvhost.exe
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:840
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\805768f0-8f3c-4087-8e66-4e6892e68392.vbs"
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:632
                    • C:\Users\Default\Cookies\fontdrvhost.exe
                      C:\Users\Default\Cookies\fontdrvhost.exe
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4384
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96c02fd5-b86e-4c79-9598-9192034dc619.vbs"
                        11⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4780
                        • C:\Users\Default\Cookies\fontdrvhost.exe
                          C:\Users\Default\Cookies\fontdrvhost.exe
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1540
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c595f92e-0a95-4670-b7ee-50be35de7acf.vbs"
                            13⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1068
                            • C:\Users\Default\Cookies\fontdrvhost.exe
                              C:\Users\Default\Cookies\fontdrvhost.exe
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3772
                              • C:\Windows\System32\WScript.exe
                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22b04a1f-b109-4d85-9d31-2c20f04d08d2.vbs"
                                15⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3028
                                • C:\Users\Default\Cookies\fontdrvhost.exe
                                  C:\Users\Default\Cookies\fontdrvhost.exe
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3928
                                  • C:\Windows\System32\WScript.exe
                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1e4d2282-b1ca-41cc-8169-e6a62efc4311.vbs"
                                    17⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:508
                                    • C:\Users\Default\Cookies\fontdrvhost.exe
                                      C:\Users\Default\Cookies\fontdrvhost.exe
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4984
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9559992-6813-4550-a111-527ef7c4c9fc.vbs"
                                        19⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:632
                                        • C:\Users\Default\Cookies\fontdrvhost.exe
                                          C:\Users\Default\Cookies\fontdrvhost.exe
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:4348
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c53620db-243b-43e1-b707-1764855e6e3a.vbs"
                                            21⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2040
                                            • C:\Users\Default\Cookies\fontdrvhost.exe
                                              C:\Users\Default\Cookies\fontdrvhost.exe
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:3696
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64e30746-60ae-4f6b-afa0-3ebd7380e65b.vbs"
                                                23⤵
                                                  PID:3036
                                                  • C:\Users\Default\Cookies\fontdrvhost.exe
                                                    C:\Users\Default\Cookies\fontdrvhost.exe
                                                    24⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1604
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\22fc14e8-43b6-4e5d-9656-d0db3ec0b447.vbs"
                                                      25⤵
                                                        PID:4372
                                                        • C:\Users\Default\Cookies\fontdrvhost.exe
                                                          C:\Users\Default\Cookies\fontdrvhost.exe
                                                          26⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2276
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a175d40d-c386-4747-aec2-15660821120c.vbs"
                                                            27⤵
                                                              PID:1584
                                                              • C:\Users\Default\Cookies\fontdrvhost.exe
                                                                C:\Users\Default\Cookies\fontdrvhost.exe
                                                                28⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1016
                                                            • C:\Windows\System32\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba08e236-ade8-4e5b-ad16-8ade9421b7f5.vbs"
                                                              27⤵
                                                                PID:1860
                                                          • C:\Windows\System32\WScript.exe
                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\284fc433-5c34-4a93-8b1f-86a66acaf077.vbs"
                                                            25⤵
                                                              PID:4000
                                                        • C:\Windows\System32\WScript.exe
                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e7779719-7631-47ca-a9af-2be4444fdb7e.vbs"
                                                          23⤵
                                                            PID:3308
                                                      • C:\Windows\System32\WScript.exe
                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8aa4de02-c1c3-4309-ac61-d177e5e01917.vbs"
                                                        21⤵
                                                          PID:3792
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab2a99af-9977-4497-a89f-07ce0d419cc1.vbs"
                                                      19⤵
                                                        PID:1960
                                                  • C:\Windows\System32\WScript.exe
                                                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7b85c961-42f2-4c17-9f0e-33d9e85f7665.vbs"
                                                    17⤵
                                                      PID:536
                                                • C:\Windows\System32\WScript.exe
                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bbd66830-6180-4f71-b5d1-682a3ed9bcf8.vbs"
                                                  15⤵
                                                    PID:1004
                                              • C:\Windows\System32\WScript.exe
                                                "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bba41d8-1d36-4709-9344-158aaae088a2.vbs"
                                                13⤵
                                                  PID:4376
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a81f9432-7531-4c29-99bc-080dea902f11.vbs"
                                              11⤵
                                                PID:1280
                                          • C:\Windows\System32\WScript.exe
                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41267a48-933d-4c81-a165-b2f1ee7cf29a.vbs"
                                            9⤵
                                              PID:4088
                                        • C:\Windows\System32\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e74a0ff-b026-4b09-8178-e322614a80d3.vbs"
                                          7⤵
                                            PID:3320
                                      • C:\Windows\System32\WScript.exe
                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17d31dc7-af5f-41d0-99c8-8d65faf5d6f4.vbs"
                                        5⤵
                                          PID:2948
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\841342f7-1e3c-4245-8dea-77c1085e84ae.vbs"
                                      3⤵
                                        PID:916
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1632
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:216
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:208
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:5056
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1856
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3432
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1340
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1768
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1468
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Music\System.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:508
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Music\System.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:628
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Music\System.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4160
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Cookies\fontdrvhost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:460
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\Cookies\fontdrvhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4108
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Cookies\fontdrvhost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1812
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\MusNotification.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4900
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\MusNotification.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4580
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Portable Devices\MusNotification.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4508
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Help\en-US\spoolsv.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3784
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Help\en-US\spoolsv.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1180
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Help\en-US\spoolsv.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3696
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\sihost.exe'" /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2644
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Documents\sihost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3632
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\sihost.exe'" /rl HIGHEST /f
                                    1⤵
                                    • Process spawned unexpected child process
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2828

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Recovery\WindowsRE\RuntimeBroker.exe

                                    Filesize

                                    1.3MB

                                    MD5

                                    60338cbf38a7e58b665f780abec2e9bc

                                    SHA1

                                    be090c261e318e87f3b723601c11272aa5ef3bbb

                                    SHA256

                                    5acaa969578ead27705c7d2f685762e82cca648fc26fef2b605f0ae1794111d0

                                    SHA512

                                    1ec2462e55bc2455f62ee700dbd004e13ce79fcbabf11c9d882bea95182a4e1ae5ce993d806190a3615a217b13a4bb5d44c5a262e4730225813feb6e84b6b983

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

                                    Filesize

                                    1KB

                                    MD5

                                    3690a1c3b695227a38625dcf27bd6dac

                                    SHA1

                                    c2ed91e98b120681182904fa2c7cd504e5c4b2f5

                                    SHA256

                                    2ca8df156dba033c5b3ae4009e3be14dcdc6b9be53588055efd0864a1ab8ff73

                                    SHA512

                                    15ebfe05c0317f844e957ac02842a60b01f00ddca981e888e547056d0e30c97829bc4a2a46ce43034b3346f7cf5406c7c41c2a830f0abc47c8d2fd2ef00cb2c1

                                  • C:\Users\Admin\AppData\Local\Temp\1e4d2282-b1ca-41cc-8169-e6a62efc4311.vbs

                                    Filesize

                                    716B

                                    MD5

                                    05b3d1d72e5b5c12e527ecc1bc361709

                                    SHA1

                                    19aa5d7314d8d0409d1ec61e96267406423d8134

                                    SHA256

                                    38defd43ed00f8cbbdf15c6d0356d1907a84f78c6970ec704cba52c897a19e2e

                                    SHA512

                                    da57db719b6f026ad1cb1cde0a7ab380140962b29895c9beaf0438ea0c1bb0f6e9cbbf1767c735849297fea55766b3f62fe902a3cb4666dfd59a3ed202360749

                                  • C:\Users\Admin\AppData\Local\Temp\22b04a1f-b109-4d85-9d31-2c20f04d08d2.vbs

                                    Filesize

                                    716B

                                    MD5

                                    7e6af3f646ce1673eab4434d9c5176dd

                                    SHA1

                                    8d2a463d5b0a41a7e36716fed124b5511430c88a

                                    SHA256

                                    10dba4aad255b4e4e94d4daf5e32b447f696827873702e082bf66e10d4eeb9df

                                    SHA512

                                    6330a5fd3086178a4c56add1793f7dffa65c3ffdcbc09460c82b04d220cf3f3cd7df91895aa396befff567342a04cad4e2b4c6b34a219e8a1fb74edfe65cac70

                                  • C:\Users\Admin\AppData\Local\Temp\22fc14e8-43b6-4e5d-9656-d0db3ec0b447.vbs

                                    Filesize

                                    716B

                                    MD5

                                    28ce6b80660408701ecd8fc4abbbca05

                                    SHA1

                                    3546a868d19f7347a63726e1384f079ad71f16a2

                                    SHA256

                                    70d3434ae15e0e7a1f143e33f4500ec375d85edfdf6d4df1adeb50bccce6d883

                                    SHA512

                                    96cc573e6c779a2c3d7b92ceb5493969daaf94ea7415e50df2443d08fd0ccf1d3ec2e9d46c03c45acafbdbf46685eeb4a978fca0a91d8983f9befa292b55c025

                                  • C:\Users\Admin\AppData\Local\Temp\257d045d-0555-4632-9085-4363078208f3.vbs

                                    Filesize

                                    716B

                                    MD5

                                    6098e28a95b722b1da721add41b664f1

                                    SHA1

                                    b2d478107e84537d2c185772253c379ae64b4293

                                    SHA256

                                    8d5b251b1a70156e5b3848cb5cfa707e0f4581952e41713ea6edbf71b0c0f201

                                    SHA512

                                    edfdc31d57e1061f0ffe0b0aaa6b516e7dcb60cf24122bfd2a39c4854d1bc56e4ffbf39a01080fc41fb6ef5aa6b0b6b9b54de8a8b31f54e18f1e7b13f11ecf3c

                                  • C:\Users\Admin\AppData\Local\Temp\32432e3c-d9de-4559-9a06-dd76fc0ea08e.vbs

                                    Filesize

                                    716B

                                    MD5

                                    0a99863aa278a8e07c08d6635e9f6425

                                    SHA1

                                    db76021dc9b8bd8ddd102c51394230b8e90b3913

                                    SHA256

                                    9e5cdcb80c3791da6a54baa208717f98cc5fca8a8ce08fa8bb09317b0e23d58b

                                    SHA512

                                    dd1877b717504b8a24675a657489352eb4b872a329ad7425a149920e8c623e14463664864c7c0e59a9184274ba5f99519316abaa17058c53c7b5e80cc01c7fc3

                                  • C:\Users\Admin\AppData\Local\Temp\64e30746-60ae-4f6b-afa0-3ebd7380e65b.vbs

                                    Filesize

                                    716B

                                    MD5

                                    1b1e1c4a25ac763b643b0feac74210a2

                                    SHA1

                                    239517baff076433cfbec070da9fd2f021d56149

                                    SHA256

                                    8926ae11288f28c2c24a9c7cd83914e955e5cafcd1a171a70c67768d8c7ba1d8

                                    SHA512

                                    8c481601209dcfeba62f89dab85f271467d7510ce98da614d6e467a266d507ec427bdc8216e6531351b379c218827631f8d2dec374d973add9a6d7de003308c5

                                  • C:\Users\Admin\AppData\Local\Temp\805768f0-8f3c-4087-8e66-4e6892e68392.vbs

                                    Filesize

                                    715B

                                    MD5

                                    aa73f347643c7fad7d907ad46689dc0e

                                    SHA1

                                    087fa6317232db070d1a755ee8b81b38843a5a22

                                    SHA256

                                    73c35d66633e2ea81e9b033dbd7ece867700eb010be42cc64005ce4a7577a9e7

                                    SHA512

                                    c9271b55b470247de122a1284050dd8b2d19526f5669ec7bf783acfd055980950e7431798a272e30f3b641cbb777cbba25c059582642bd5a99b4148d4be9750e

                                  • C:\Users\Admin\AppData\Local\Temp\841342f7-1e3c-4245-8dea-77c1085e84ae.vbs

                                    Filesize

                                    492B

                                    MD5

                                    763d21f582a2d96386da5202554a40fe

                                    SHA1

                                    45b9dd0577e85078cc31f6d5770f7f8ae6cd32a2

                                    SHA256

                                    38491c350c464362e75193f5ef3538d20d21d71cd1a337c37abea1f1adbb0632

                                    SHA512

                                    ebc2e8c4f53ac0144ba99831dd40718a02aa9505c766806245355f17b995ccf6657364d0369c867c4402ba9ded35e36cc838bc61194f29e65a499fb9cf956f3b

                                  • C:\Users\Admin\AppData\Local\Temp\96c02fd5-b86e-4c79-9598-9192034dc619.vbs

                                    Filesize

                                    716B

                                    MD5

                                    98fd91b458e18a7e8041e5a3fac36602

                                    SHA1

                                    96f62cdd6878f433ce2d660ad95ddac0380d8708

                                    SHA256

                                    85cc8ce8b35fdc5252ba86afd4f11e4b5032db72674c11d7905a7db658d6c57b

                                    SHA512

                                    343eb1b623f51dcaf7e2bdfff73379ad54ba6a1ba30ce9f1b37ff421b121b615a8c2b2aa9fb925d36a617c308594af32eb5adce4d639b3c259494fdbd3b70243

                                  • C:\Users\Admin\AppData\Local\Temp\a175d40d-c386-4747-aec2-15660821120c.vbs

                                    Filesize

                                    716B

                                    MD5

                                    42a425d3b92b0d8a9d15135ea86b0d86

                                    SHA1

                                    5388ca0e0d5d5a6f04ab72caf29c6ef6dc018d01

                                    SHA256

                                    c60e4865723fe39ae861b6aefe9d8cea9cfe0ad178734a778b17b98758eb80f5

                                    SHA512

                                    e43e9149b051111e14f8d58e8d782146814b3482d6729745aaa8e4bb76a598f7fe549d0cd59511ca5b7be9149f352de2824c861ba38aad3d139f2831e76f49d4

                                  • C:\Users\Admin\AppData\Local\Temp\a9559992-6813-4550-a111-527ef7c4c9fc.vbs

                                    Filesize

                                    716B

                                    MD5

                                    00a371d774ab7edc032d3a8e270db59b

                                    SHA1

                                    aea041ff8faf53ebef1e193d0e5eff16e555f1b4

                                    SHA256

                                    b7783a3b6ebef5a18b873fd80b9bc604f7232b4e436c96545bfc666ec63389b2

                                    SHA512

                                    67c3753c0f12c83efa6bd6b01bc978de6d90b9c49e58b0c5f046c40692100622a7b9ef5c8aab9aaf9f7b4e5f09e83a69aca6520f1648504e0edf4d3742d514df

                                  • C:\Users\Admin\AppData\Local\Temp\bc033611-d2d0-44b0-b277-4977adef5908.vbs

                                    Filesize

                                    715B

                                    MD5

                                    b90b5ae3bb696d09d075a250c5865b36

                                    SHA1

                                    1a6149e118039d086b4bb2f48202fd6be7c25372

                                    SHA256

                                    4c52e5b7d28d0064801772941cecde903dfbc0ccb545737dc0cd76e0792a16c6

                                    SHA512

                                    154d75c17e2766d55d8bedeaa3b372aacfa25676399874e3170425a872a78d2a1f1d31cd4e6e2e85a881b62afde3dd9c6a4ac33fd28515e781617b8a6d29ace7

                                  • C:\Users\Admin\AppData\Local\Temp\c53620db-243b-43e1-b707-1764855e6e3a.vbs

                                    Filesize

                                    716B

                                    MD5

                                    bd68254c3b10e1fc8e7b0347360a4827

                                    SHA1

                                    80e0434c4fa9e960c1e6a63d74c0f6805aa56afe

                                    SHA256

                                    5989d68b5192c76872058b4c1bb17f139fb4a23c04964c3cfaac735f97860e6f

                                    SHA512

                                    483fdd0f18448b6b3a8c6a5a135e806994bdd3fa52bec55204d5dc3795d063f91d8877d5505a2df07422b69b5d7237d1af8400ceda5af6c114f9cb229419a8b3

                                  • C:\Users\Admin\AppData\Local\Temp\c595f92e-0a95-4670-b7ee-50be35de7acf.vbs

                                    Filesize

                                    716B

                                    MD5

                                    7622906c193f3650e4d0b45d2373f100

                                    SHA1

                                    0ef5055229d6261f888d935ff6cd116cbb1c4d7b

                                    SHA256

                                    02f75b37398095078230a2290bd1bded8f7138d5b6514c37f47203267f47f1e5

                                    SHA512

                                    c24be76fa591a3f122c3541d201f7b56a0386dfefd98fa590d58b3e466f61bc6ab39667be66e022916150200fc7145353b8d9a8fbaafd61e750b3e2ca14bdf8c

                                  • C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\fontdrvhost.exe

                                    Filesize

                                    1.3MB

                                    MD5

                                    f946ceb3dfbc4802323f045e77b9fc63

                                    SHA1

                                    04beac37360d30c5ad933f82f80bfd41ae294cc4

                                    SHA256

                                    682f5e5eb1673b692d4009f655f51b7926031ff7e8c1d4aecfd62cfd1e1d7c2a

                                    SHA512

                                    7ad0db10f788d63d44a85981ccd9cf7c5acaadad66d1fd4c34554eb77bd1582e49549c917eb39e0c17e7b55b2fc0e262c059e1d85c188f1a3649879368a834e3

                                  • C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\fontdrvhost.exe

                                    Filesize

                                    1.3MB

                                    MD5

                                    0b2fc822e27e875977ff84253f5397e1

                                    SHA1

                                    983a016981ff412c4082e4468adc5346b1c4aaf5

                                    SHA256

                                    5f4f3e07aa2706a7a68cea1fd334361a3f22578ded2791280ed7d5a34018f288

                                    SHA512

                                    7f4cbdacd05fe2a3273e50d839dd594e7238a4fe4238444d8a7ae547623447f3359687dbfe276c903489e4af5ac5d724ebdb49abcabf1b52e74d1fb7a6b7cfcf

                                  • C:\Users\Default\Documents\sihost.exe

                                    Filesize

                                    1.3MB

                                    MD5

                                    7621f394b1365c3a25fd23187b1e1791

                                    SHA1

                                    da195d0d481389dba8889ebba775335197f22b3d

                                    SHA256

                                    c3a123719de477e4485a91d3ce8230a8338461b44a961b68fdf2adbee45b619a

                                    SHA512

                                    a6567c99ffc612862b52907199852af27b4e37b4a8eec60490a6b7204c2c2d80d661f5eb439e62247b285f8a26a91438f799a72e96411b0da835cac231446a27

                                  • C:\Users\Public\Music\System.exe

                                    Filesize

                                    1.3MB

                                    MD5

                                    fe0ee60141ab3b866ef0958fd44c076b

                                    SHA1

                                    4de0415625ac4fe690e7bfc2a70c5971b1c2a027

                                    SHA256

                                    8c0da9e94f6f5393857cc94f667fbfebb9aade66c9544cc902675b4a5db12d8b

                                    SHA512

                                    252e67b459eb1c0ca01cab45bd2888fa1a33106487edc039bb0b592d4e0c75288d0cde6ea276094acacb6096cab153a9f7246d61fe6051e2c85fa3fb9bdd7db6

                                  • C:\Windows\Help\en-US\spoolsv.exe

                                    Filesize

                                    1.3MB

                                    MD5

                                    92e5bf98b2c2ad695dc2e6941a74c54f

                                    SHA1

                                    4f9b53511b75bdf096ae95e597e46fd3c5364097

                                    SHA256

                                    74ac0989d2567257f03d7f8fa3ed73db6b74b420626fd77ca54a163a3dabec26

                                    SHA512

                                    59c7a25a59ec56008b0eb4e0822642bc6774a395e3ceae92762a7714b63408aa2c8fd1b4fadab4299572350dfd4083fa360b97e18187b35504d858cdeb120d5d

                                  • memory/508-186-0x0000000000320000-0x000000000047A000-memory.dmp

                                    Filesize

                                    1.4MB

                                  • memory/4548-9-0x000000001BA70000-0x000000001BA7E000-memory.dmp

                                    Filesize

                                    56KB

                                  • memory/4548-0-0x00007FF9F6443000-0x00007FF9F6445000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/4548-8-0x000000001BA60000-0x000000001BA6A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/4548-185-0x00007FF9F6440000-0x00007FF9F6F01000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4548-10-0x000000001BA80000-0x000000001BA88000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/4548-7-0x000000001BA50000-0x000000001BA58000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/4548-6-0x000000001BA30000-0x000000001BA46000-memory.dmp

                                    Filesize

                                    88KB

                                  • memory/4548-3-0x0000000003020000-0x000000000303C000-memory.dmp

                                    Filesize

                                    112KB

                                  • memory/4548-4-0x000000001BBA0000-0x000000001BBF0000-memory.dmp

                                    Filesize

                                    320KB

                                  • memory/4548-5-0x000000001BA20000-0x000000001BA30000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4548-2-0x00007FF9F6440000-0x00007FF9F6F01000-memory.dmp

                                    Filesize

                                    10.8MB

                                  • memory/4548-1-0x0000000000CB0000-0x0000000000E0A000-memory.dmp

                                    Filesize

                                    1.4MB