Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06-09-2024 01:05
General
-
Target
f675c9590aa70b92af054bbd4e63bb70N.exe
-
Size
4.9MB
-
MD5
f675c9590aa70b92af054bbd4e63bb70
-
SHA1
61b97bb45293faf091855b8c4dc623dc1d6c0068
-
SHA256
3e7c17750f02bfba0b1870edaace58265a28d8f15d620393453d9274d7003e3e
-
SHA512
5ff6e8f4b7090bdb784ecae861dd9e0ebb98eac3bdc539de78230be7285d912c49eab30c8b1d956c80004192e028a3505dbe951877c792deb03bc130c72bf5c9
-
SSDEEP
49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Score
10/10
Malware Config
Extracted
Family
colibri
Version
1.2.0
Botnet
Build1
C2
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 42 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 44 IoCs
-
Checks whether UAC is enabled 1 TTPs 28 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 14 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 42 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f675c9590aa70b92af054bbd4e63bb70N.exe"C:\Users\Admin\AppData\Local\Temp\f675c9590aa70b92af054bbd4e63bb70N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp83CA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp83CA.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp83CA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp83CA.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp83CA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp83CA.tmp.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Recovery\WindowsRE\dwm.exe"C:\Recovery\WindowsRE\dwm.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fce4c13e-533c-42cd-8600-036933b6ccd9.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f856198d-5a3e-4539-ac93-a52fb06fc4b0.vbs"5⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e989574-4d9f-4fd6-b7a6-731f6ad167d7.vbs"7⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a587cd42-45f8-4663-ace7-8e0d572a948d.vbs"9⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a50bb34c-785c-4e5c-b826-2c61ebabab95.vbs"11⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\872cd8b4-3c68-4363-bbea-34e26ac310b3.vbs"13⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3863e664-fe16-4823-a41c-a0c32225aefd.vbs"15⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8914f5fd-a87c-4a25-84a8-769974530731.vbs"17⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15b7324a-0f57-4b9c-9883-0380a376ec56.vbs"19⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48569865-e9eb-4465-86c2-c8413c607bc0.vbs"21⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00d4c93a-f551-4e39-9677-6947accdf7cb.vbs"23⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d86be82d-49e1-4d45-acf7-dbe8e6a5a79f.vbs"25⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7f6f8651-03e1-4853-832a-6f042c7032d2.vbs"27⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2fae75d-b901-4b26-8bd1-aef9ac2511d3.vbs"27⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp478E.tmp.exe"30⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0356835-01c9-4dba-ab3d-de048c5d2f9e.vbs"25⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp2B7B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2B7B.tmp.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2B7B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2B7B.tmp.exe"26⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\240ad4a7-b72e-4475-813b-d44f9c37f017.vbs"23⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c28a11b-d91a-4111-bd05-848648e97511.vbs"21⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF41F.tmp.exe"22⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59b35ea4-4a08-4ecf-a609-5505ee014697.vbs"19⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7929790-ca12-484f-b961-a53702a699e5.vbs"17⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb90c19a-d4ca-4cd8-8bf2-4f3d51ad3180.vbs"15⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp8C2E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8C2E.tmp.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8C2E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8C2E.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8C2E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8C2E.tmp.exe"17⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b039e24-dafd-4baf-8733-bc764e474798.vbs"13⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp6F9D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6F9D.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6F9D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6F9D.tmp.exe"14⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5346dd8-9157-4b17-a103-e1c93d375fbe.vbs"11⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp3DCF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3DCF.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3DCF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3DCF.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3DCF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3DCF.tmp.exe"13⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\291440e4-e5bc-4123-a584-1d257dbe7506.vbs"9⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpC01.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC01.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpC01.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC01.tmp.exe"10⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8b42535d-02e2-4b1d-8ceb-85106ea830d5.vbs"7⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDA81.tmp.exe"10⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5e64298b-8c7e-42bc-9441-8c1df54f3dc0.vbs"5⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE7D.tmp.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9f3ee447-b9dd-4e8e-9624-5a8cabce784e.vbs"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9E92.tmp.exe"5⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Templates\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Templates\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Templates\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\Temp\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Temp\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Google\Temp\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5f675c9590aa70b92af054bbd4e63bb70
SHA161b97bb45293faf091855b8c4dc623dc1d6c0068
SHA2563e7c17750f02bfba0b1870edaace58265a28d8f15d620393453d9274d7003e3e
SHA5125ff6e8f4b7090bdb784ecae861dd9e0ebb98eac3bdc539de78230be7285d912c49eab30c8b1d956c80004192e028a3505dbe951877c792deb03bc130c72bf5c9
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56c47b3f4e68eebd47e9332eebfd2dd4e
SHA167f0b143336d7db7b281ed3de5e877fa87261834
SHA2568c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA5120acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
705B
MD5c2d3d64258b892352d19d58725816b01
SHA15c8a939dcb5014f40d251a480de03dc247e0127a
SHA256659a020f4762160d67522a84d1844d25dedc0ffef1245bc2a8cf929822cc8fa9
SHA5121e10a7869b1c5977faab814c8b90790964bc0fbe6e88a6676e102a557dd93f223bd49c04f86acd15bf9678969b09a492ac36bb4fd090e3216d0de56b8726f02c
-
Filesize
705B
MD58fd77db0d09607a3d012055fc7080eb8
SHA11eba4667f4807581b0973b1e6b147aaddeb1e4c4
SHA256c01a015fcb57cba98528c0cee9fb6b6d4e7d99b78a61c4732da525ddd55ce090
SHA51208113dea593e7970321b50ed404ce8a60d50e22dc7d01fccac546b7427e57963f56e8ae809611e3a8f49d539d51aa6d174acc517cc3f9c25d726e5093d1ef884
-
Filesize
481B
MD53d93b9da8eb51159a68605526ddff8a7
SHA13fdd8ecbdde436ab4efca7b884c95ddb797a9fad
SHA25641c6c116c902b38f591f366a4c46772afb5ded10f9d879b20c52a1ed6eaab2f7
SHA5128bb71a36ac1fcd427c9b0aecc02f2decbee9f1a1c9c8820f1d61727df485e69adafb8f52029dbcf2078f414a98b1c30c432ff60b50a6903bf9a0d2b6f80e0ba1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
705B
MD5b2f6023a4ca7d5b4ae898be4a4756738
SHA16d4be76a6b4cda3c6fbed402b8dfc5d6ae031996
SHA256f4779eecb8507e2173b5a55acee63042f185d2d8f0385c3f4ab9550cbea6a946
SHA5126d9865c6c9595543145fe1e0f5a54c4af91ba4145149e1b15dd53d9f8220ed5c7055756bdb2661cab5fefb172c511d195bacd4bfe714b0a1a617751624ec88a3
-
Filesize
705B
MD52ef81557a94d9c3dd5baec321629a16c
SHA14f263d1559e35fe219366d432aa6fcf07406e22f
SHA2565b57621c0a8ac5c0fc47e2a299a095eb7544aa957b86680d2a6b5b452325beba
SHA512cdd3e3206abb5e2ed2283f8d0e6eb7b8fac6cd56fe0fa1ce6ab9fc3a07c82c42a4761c2f84c0f6f56c96ad95675efd75bf7b33c7e9e6ced61188d3fd21ff79bb
-
Filesize
705B
MD5d1a9a494b097d8ffe9afeae6959370b0
SHA10656aaf4e5368b6ac83863eb3d727b8143120f4a
SHA25661b772e9d90a6eb38c9bdf1a6a8d99680211f8e1b525dca88aaf4d2cb8a14a98
SHA5127c5288c307ee6a4e234fec5a8295b79deee87b0c03c725089d4d90c12c5ba1164fac34d8c739a638dbedf73e05e204f0200dd2390b89422e285163dfe6a8127a
-
Filesize
705B
MD526fc24afd63b7f946db0223f97a16f99
SHA10e4db9fb47e9d4eb51be2668c2a2b2103ba0f2c2
SHA256c7e603154b04138bfea34f1653a6ceddad0fe6b5ebdacebc83f79d3da4fc53f9
SHA512446f057bc40c863e613deb26620eaacc93b71a51e0e5788ab3df131f0407b59e9675031a54c8028f0c67c715eeac6ed059a23fd20b2be34800d4f1d10965a165
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
28KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
5.2MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
5.0MB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
72KB