Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08-09-2024 06:50
General
-
Target
e249c23fdd59a6f4cdbcd4cc7ded4300N.exe
-
Size
4.9MB
-
MD5
e249c23fdd59a6f4cdbcd4cc7ded4300
-
SHA1
649b368b943bb8b93d90b21cd7ae9e59cd07c12e
-
SHA256
85661d2d721f961564cb6de32c3f08b8108302e2d709f51aa8c03d6bbf114cc0
-
SHA512
9c4d705dbca7224baa7a2e7f5918c7c14250ad78f216ebb96652845ac7c3fa6f21cee119276b5dbf77b4ac05ba78fc47386601985bf9c85096b9c83e9fb1855f
-
SSDEEP
49152:Ll5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 33 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 31 IoCs
-
Checks whether UAC is enabled 1 TTPs 22 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Drops file in Program Files directory 28 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 11 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 33 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e249c23fdd59a6f4cdbcd4cc7ded4300N.exe"C:\Users\Admin\AppData\Local\Temp\e249c23fdd59a6f4cdbcd4cc7ded4300N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp6CD7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6CD7.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp6CD7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6CD7.tmp.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a483d4ef-f8e0-4245-ae41-864e4bbd01c1.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b207e330-2b1a-4bef-a853-1907a08f6a37.vbs"5⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dbf5a03e-f4ef-4f47-b46c-b078d2df5e33.vbs"7⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7e3b4f51-c008-4402-8340-532afcebddf9.vbs"9⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f8c60bee-7172-410c-a337-be2176284cc8.vbs"11⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3a630d36-ad47-45d4-aa18-d1c1587fec3e.vbs"13⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e021cd8a-2097-4527-8cf6-f2afca9406e3.vbs"15⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d7f3fcb-5736-4195-983a-30d8c78b7c04.vbs"17⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fd7fba7-484f-40c6-bf6e-211d3af9b1e6.vbs"19⤵
-
C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd5df8eb-0e64-4058-9a89-924baf8966e9.vbs"21⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d424a567-9073-47b4-bcc1-8b02a58ec316.vbs"21⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp2486.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2486.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2486.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2486.tmp.exe"22⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5993f02-16e4-4c60-b2d4-be50a12b644e.vbs"19⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpF4AC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF4AC.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF4AC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF4AC.tmp.exe"20⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3af2beb6-cd31-4f95-ad69-588b92093099.vbs"17⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpD740.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD740.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD740.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD740.tmp.exe"18⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8abbb6cb-a5fe-4af9-a8e1-8aebe2d5afae.vbs"15⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2703607-d788-454c-9b5b-222196d90bf5.vbs"13⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp7615.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7615.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7615.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7615.tmp.exe"14⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6c5ec42-b989-4736-9892-e6ca4fde6993.vbs"11⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp4447.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4447.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4447.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4447.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4447.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4447.tmp.exe"13⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86721f69-c9f7-44ef-858d-990d64cf9c3a.vbs"9⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp1393.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1393.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1393.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1393.tmp.exe"10⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f760d3f-f4fd-4456-9621-acc3429380e4.vbs"7⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpF77F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF77F.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF77F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF77F.tmp.exe"8⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2b99410-260d-4a9a-b40c-ee324cef7f74.vbs"5⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC709.tmp.exe"6⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99b08f52-a68c-42ae-a884-eb9869771b25.vbs"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp9366.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9366.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9366.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9366.tmp.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\SysWOW64\0409\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\SysWOW64\0409\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Windows\SysWOW64\0409\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\de-DE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Windows\Media\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\Media\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\Media\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office16\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office16\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Videos\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Documents\My Videos\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\it-IT\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\it-IT\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Users\Default\NetHood\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\NetHood\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\NetHood\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD56b458cb7c98afdda08618fd67ef846a1
SHA1c2221a3609a9bc477be97060ff9cc8d7eb3c553e
SHA2567c64ef5345b796fdf06cb141b9fcaa1536c491135bf19ffa60e9baf87407823b
SHA512e2f0bf23bbda09881bc3041f1ed957f0161756a93db7ebcaab953d2b63941bfe40e7e83898186ccbae56da348150bb822157cd6aae206436c1d35e08f0022e37
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52979eabc783eaca50de7be23dd4eafcf
SHA1d709ce5f3a06b7958a67e20870bfd95b83cad2ea
SHA256006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903
SHA51292bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
739B
MD5c1004f7605fbcfced22dc3552836c6e7
SHA1a564faed23d6f8ef2eb30178149ff1adc1c6415e
SHA256bb1601cbe82909ab72ee4035152fa7aaafa1a44e416d540e070f48032b4cffa6
SHA512cefeb08a8efa4830f3acb8b9c307d848320fe20612d5e2253f0abd419fd99ea888c3091c3bd419f49afc3e191119ad427c64e2577d4b309bf9f4317ed8ae73f9
-
Filesize
739B
MD53aa2eabdb17b4aa808336062b1c41370
SHA111400c14b6aab9f2a8954afd9c53982a89b6a639
SHA256741a3ab1bee1ac4fc4178404f854bfa2558be98bb9a982f6884b9277ca69be5e
SHA512d72178bc4bb30c93fe555b447053d29e7d88555ebb0b4258786c11c87f0df59925a3ed3a42f57aa4af767989be43ece2dfb2cddaf4d6b8dc1a34af7104637d49
-
Filesize
515B
MD5d1211e435dd17f6a987eb073b0132afa
SHA1913c9e1cbe30be3957f66728daa7556cc3528e20
SHA2560f60bcfd39385a58468f56fe1d5465f86e73c406394bc9f03e388998d544436f
SHA51284ce8f56cf5da4cd3caca3268e339ce06adeb1f6cd16facb1f859337acf18e36cef6b47e568cce47bfdfcc6b08bb9b7c92a30902ddd80661b50f868d41a02790
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
739B
MD54e6d26a22afb4c16e77433b14bac4893
SHA17f8714025a65bfa1958b077c150d776f2e3ad2a0
SHA256aa69b6dfb5d656604c20801704c8db57684fb702416ace318eb06841344a11dc
SHA5128602d7e9350d5df6ed708486fcf749a43dcdc077df2dc84dd94eb79d145012d3c24c5dc6f1f12078a2a53b9e0d73362d5ef2bdf1a594e38cdc3e3dc9085deba9
-
Filesize
739B
MD529a389193d9290e5add0a541c63fa130
SHA1a3918365d086167802e39fe65d93dc260a2c04eb
SHA256d38ee109418dbe44702290f73d7327f5003eaaa2c2991b6cd42277d0f205adbc
SHA512189d4d3b45f5adc58952932fc93b4d80c485cf7171e600f5208ced9e76d624af0dffd21f26dcd88ed70dd3bb749be7336c4c86af975e1a6349f648ec13818839
-
Filesize
739B
MD5ae62781d25b4b8f49b839fc9eb4ffac9
SHA1886b41d48089b19f9e2d911576e5431e97e1f56e
SHA256b39742a77a5427bf4b0739562d441ce51f314d136540327606e60d5269d2732d
SHA5120ac84c751477e00a5d9501ff8f76001edda9fca8baa62732cf00e035f0444f9e3efa6fd92bb806d4730e3407afeaa8ba0afd28dd9fb79832cc90df4f73f1ca1b
-
Filesize
739B
MD56cff073e92312e3b1e92f4e4de979b3e
SHA1b99ace47d85ede06312fc2412d3bc5c59cb62bcd
SHA2562c89a8b4c2072a22be27c110a669fe9973a34df45d8fcc99f5dee9a41bfedec6
SHA512482a8f510b8f405d21141dada89ea1ff3fdc60dee985a7929c3071872a36a784a675f96bc38e7142466f4daa23e2af49bfb9f2fee5cf3f18e4b942e9aaa559e3
-
Filesize
739B
MD55c694146ee0b98861781cf636a088f24
SHA1577f829b19d11605d04374ce65d5b5c2e6bfe723
SHA256640f30ee3ebab389e914d8b9a1dfcbd706e3151dc3abf7a3702919045480c43a
SHA512fbeaf3ccee0184992178517efa11e244a5ee3138cf5ed11421438b8c98af766136519759657136f6e1673bd53f6cd737b5ab552b150a8a61f462ea18d15046b5
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
4.9MB
MD5e249c23fdd59a6f4cdbcd4cc7ded4300
SHA1649b368b943bb8b93d90b21cd7ae9e59cd07c12e
SHA25685661d2d721f961564cb6de32c3f08b8108302e2d709f51aa8c03d6bbf114cc0
SHA5129c4d705dbca7224baa7a2e7f5918c7c14250ad78f216ebb96652845ac7c3fa6f21cee119276b5dbf77b4ac05ba78fc47386601985bf9c85096b9c83e9fb1855f
-
Filesize
4.9MB
MD5acc4c331c1dfa6a5f1d041d7d6d8b876
SHA13674f6652bd1471c4d075a528effb92000ac2542
SHA25637faff84ef16fb602842ff786d73b130f85135edd42cea979f740f8c77ee28fc
SHA512fdb7efd37ac228bb79477f62504c001c0ff2b78345b008d980d7394b1c3794c474d5297d97402287801d4d3c624a6718622c55e442e1d421f14f36a9794cac99
-
Filesize
136KB
-
Filesize
28KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
48KB
-
Filesize
5.2MB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
1.2MB
-
Filesize
10.8MB
-
Filesize
5.0MB
-
Filesize
72KB