Analysis
- max time kernel
119s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
04/09/2024, 11:56
General
- Target 2e427fad65a1acee051224babed62e00N.exe
- Size 4.9MB
- Sample240904-n33des1cld
- SHA256 6e5aad0db5a6d82f3aadef1cd9856462367d2abc7da9e23adb90e6c738b830f0
Score
10/10
Malware Config
Extracted
Family
-
colibri
Version
-
1.2.0
Botnet
-
Build1
C2
-
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
-
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
- Colibri Loader
A loader sold as MaaS first seen in August 2021.
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 39 IoCs
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 38 IoCs
- Checks whether UAC is enabled 1 TTPs 26 IoCs
- Suspicious use of SetThreadContext 12 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 13 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 39 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e427fad65a1acee051224babed62e00N.exe"C:\Users\Admin\AppData\Local\Temp\2e427fad65a1acee051224babed62e00N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmpC577.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC577.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC577.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC577.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC577.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC577.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TZnppPT7KU.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Recovery\WindowsRE\taskhostw.exe"C:\Recovery\WindowsRE\taskhostw.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\11b9e322-e108-4dd6-976c-5dc3e34740a6.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc7569b5-c71a-4d04-ad0d-181b5d473f3f.vbs"6⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d91a415c-11ae-42d8-9b68-fdeb8dc1b86b.vbs"8⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20e84794-3d45-4da9-b749-e07b506700ee.vbs"10⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4937b777-d3d9-4d04-9c44-7f322ad96971.vbs"12⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ea77e0a-1a55-431a-971a-fcd80c4942e6.vbs"14⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e109e011-18e4-41be-8179-cf44a13437ee.vbs"16⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1143586-df1e-49fa-9a73-93afdd28e7a2.vbs"18⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a80a1860-dfe0-423e-b8d3-53c9907ca47c.vbs"20⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\632b36ee-2dea-418d-9679-04e3c8dd27aa.vbs"22⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8f25a7ec-da30-47da-b9cf-c83f6c65a68d.vbs"24⤵
-
C:\Recovery\WindowsRE\taskhostw.exeC:\Recovery\WindowsRE\taskhostw.exe25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfb739cd-e473-4103-b88d-de402c43f604.vbs"26⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c6eb04e-eab1-48bb-a943-171f90c8b718.vbs"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8B6D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8B6D.tmp.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8B6D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8B6D.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8B6D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8B6D.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0acbaaf0-1411-4860-aa5a-aa1a090e56fc.vbs"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5A1C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5A1C.tmp.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5A1C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5A1C.tmp.exe"25⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee841ddf-8352-4896-be43-3c86dc5d023b.vbs"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2A71.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2A71.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2A71.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2A71.tmp.exe"23⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f52e056-4dad-4978-b106-7aa475d47371.vbs"20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF98E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF98E.tmp.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF98E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF98E.tmp.exe"21⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7daca7c9-7470-4c0a-b45e-21418b89218c.vbs"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDD99.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD99.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpDD99.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD99.tmp.exe"19⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad05999a-5980-4d1a-9ccd-caaea20fa8d7.vbs"16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC119.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC119.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpC119.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC119.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2848cca5-e6ff-40f4-b80d-6367331070b9.vbs"14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA275.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA275.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA275.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA275.tmp.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8419c9a1-9b6e-4613-9698-c1e7982af73f.vbs"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp71EF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp71EF.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp71EF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp71EF.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\232ce704-b3d4-410d-a5ca-d06306173a18.vbs"10⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c666b21-be0c-4eb8-b6db-1662fda4454b.vbs"8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp22B6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp22B6.tmp.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp22B6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp22B6.tmp.exe"9⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e87660a0-3319-4669-8567-eb55a4b41638.vbs"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6C1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6C1.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6C1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6C1.tmp.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\546c2075-5aac-47fb-879d-1c8536e02f57.vbs"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEAEC.tmp.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Windows\DiagTrack\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\DiagTrack\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\DiagTrack\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Microsoft\MF\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\MF\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Microsoft\MF\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
taskhostw.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0ea77e0a-1a55-431a-971a-fcd80c4942e6.vbs
11b9e322-e108-4dd6-976c-5dc3e34740a6.vbs
20e84794-3d45-4da9-b749-e07b506700ee.vbs
4937b777-d3d9-4d04-9c44-7f322ad96971.vbs
546c2075-5aac-47fb-879d-1c8536e02f57.vbs
TZnppPT7KU.bat
__PSScriptPolicyTest_bxpzcwq3.zvc.ps1
cc7569b5-c71a-4d04-ad0d-181b5d473f3f.vbs
d91a415c-11ae-42d8-9b68-fdeb8dc1b86b.vbs
e109e011-18e4-41be-8179-cf44a13437ee.vbs
tmpC577.tmp.exe
sppsvc.exe
memory/964-67-0x0000000000400000-0x0000000000407000-memory.dmp
memory/1692-301-0x0000000002930000-0x0000000002942000-memory.dmp
memory/1784-242-0x000000001BBE0000-0x000000001BCE2000-memory.dmp
memory/3912-78-0x00000260F4100000-0x00000260F4122000-memory.dmp
memory/4376-60-0x00007FF90CC40000-0x00007FF90D701000-memory.dmp
memory/4376-6-0x0000000001300000-0x0000000001308000-memory.dmp
memory/4376-0-0x00007FF90CC43000-0x00007FF90CC45000-memory.dmp
memory/4376-15-0x00000000029F0000-0x00000000029FE000-memory.dmp
memory/4376-16-0x000000001B740000-0x000000001B748000-memory.dmp
memory/4376-13-0x00000000029D0000-0x00000000029DA000-memory.dmp
memory/4376-12-0x000000001C2C0000-0x000000001C7E8000-memory.dmp
memory/4376-11-0x00000000029C0000-0x00000000029D2000-memory.dmp
memory/4376-10-0x00000000029B0000-0x00000000029BA000-memory.dmp
memory/4376-8-0x0000000002980000-0x0000000002996000-memory.dmp
memory/4376-9-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/4376-14-0x00000000029E0000-0x00000000029EE000-memory.dmp
memory/4376-7-0x0000000002970000-0x0000000002980000-memory.dmp
memory/4376-18-0x000000001BEA0000-0x000000001BEAC000-memory.dmp
memory/4376-5-0x000000001B5E0000-0x000000001B630000-memory.dmp
memory/4376-4-0x0000000000FE0000-0x0000000000FFC000-memory.dmp
memory/4376-3-0x000000001B760000-0x000000001B88E000-memory.dmp
memory/4376-17-0x000000001BD90000-0x000000001BD98000-memory.dmp
memory/4376-2-0x00007FF90CC40000-0x00007FF90D701000-memory.dmp
memory/4376-1-0x0000000000310000-0x0000000000804000-memory.dmp
memory/4588-396-0x000000001B760000-0x000000001B772000-memory.dmp