Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
17-09-2024 10:39
General
-
Target
37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe
-
Size
4.9MB
-
MD5
549a897f0c0298c512c30faf8a911840
-
SHA1
77864449acf9065d7522006aec1bc67b543cb514
-
SHA256
37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dc
-
SHA512
481f73e8a9160def609cd28ec9d97398d66163c240a4d63f77686bfa2c99dddb5f7a9df0731c46309e8a1d19bed59d62e358e0ace10ec793731d3690df8bdd4e
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 39 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 32 IoCs
-
Checks whether UAC is enabled 1 TTPs 26 IoCs
-
Suspicious use of SetThreadContext 8 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 12 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 39 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Users\Admin\AppData\Local\Temp\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp9454.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9454.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9454.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9454.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9454.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9454.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NviAgREO5T.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2bbcf43-60d7-4032-bb1e-efe169609961.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6720c790-686a-458b-93ea-5543adddecc7.vbs"6⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40721322-e1eb-4c2c-a99e-76943da99e32.vbs"8⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1052365-6ae7-40ef-8986-b231d9db7f94.vbs"10⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b549c6a0-0125-43e3-9249-29cd512d1ffb.vbs"12⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\991bf7df-74cb-4f2f-a7d4-c31e99048b0d.vbs"14⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\684c3569-1177-43a8-aa38-720db34f103c.vbs"16⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\04db1fc3-7ed6-4a8b-98e4-60554d9bcdcb.vbs"18⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4f0efe9f-a580-4278-b287-bcfc877e23a5.vbs"20⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\307c1567-19a8-4b6b-abf4-2d589b930c99.vbs"22⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\59907543-1fb0-4415-b033-eb7f43b5d4b5.vbs"24⤵
-
C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe"25⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4724cec8-cc1a-4ea5-a1c1-0e406a96de17.vbs"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp33A9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp33A9.tmp.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp33A9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp33A9.tmp.exe"25⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff59f34f-de72-4a01-841c-001f94b800f0.vbs"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1870.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1870.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1870.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1870.tmp.exe"23⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cb3c69a-0104-437d-876e-ce842c7049eb.vbs"20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpFCCA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFCCA.tmp.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFCCA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFCCA.tmp.exe"21⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\10d3bff2-a134-4a2f-90ec-4a13e71e8c0e.vbs"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpCCE0.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCCE0.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCCE0.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCCE0.tmp.exe"19⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07a565eb-7701-4393-81b5-551001dfd68c.vbs"16⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd85d03d-d52e-4254-9772-5345d09d5e20.vbs"14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp9323.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9323.tmp.exe"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\926ddef8-b81d-4b5b-b4fc-3b64c0370ddd.vbs"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp60D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp60D8.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp60D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp60D8.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36010608-6320-48d5-b383-23abfac9200f.vbs"10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp312D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp312D.tmp.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp312D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp312D.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp312D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp312D.tmp.exe"12⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3117459-f9d8-4735-9d17-2b957c1cc604.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\947e5213-3b81-47c5-80fc-f52ef7237675.vbs"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF7FC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF7FC.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF7FC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF7FC.tmp.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5ae7ae9b-80d2-40fe-9760-e4c455d16d6d.vbs"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC803.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC803.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC803.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC803.tmp.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN3" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN3" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN3" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Templates\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN" /sc ONLOGON /tr "'C:\Users\All Users\Templates\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN3" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Templates\37762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dcN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Update\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Speech\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Speech\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\Speech\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files\Crashpad\reports\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files\Crashpad\reports\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5549a897f0c0298c512c30faf8a911840
SHA177864449acf9065d7522006aec1bc67b543cb514
SHA25637762a06abb892e7cb02c8f430f2bbaed874495435959acc1839ff0a040147dc
SHA512481f73e8a9160def609cd28ec9d97398d66163c240a4d63f77686bfa2c99dddb5f7a9df0731c46309e8a1d19bed59d62e358e0ace10ec793731d3690df8bdd4e
-
Filesize
1KB
MD5bbb951a34b516b66451218a3ec3b0ae1
SHA17393835a2476ae655916e0a9687eeaba3ee876e9
SHA256eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
SHA51263bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
781B
MD559990fd7b62e393cecc509c04f3d77df
SHA119212626308bd83c82fe7dd35ff4c7508fc00bb4
SHA256f81e419dc050f516e0f1d89d8258b0ad876d7ff282991b8b3e1ebd7881bc99ab
SHA5123751182bcae67626d6ef38ed6336cbf4657001ebacfbd230baa03d0995151979dbe8e485de11ff51340cd18780502adffbf5b741cd659547e24ee42aa19b3762
-
Filesize
781B
MD5476e4be457ced31164510bf7a0287cb8
SHA1557b9e64ff3e64532882fd22aa19943a53ad5832
SHA25612e26f66c595c2b8a196e515f951d0ded75adaa013315114a3e530d795863ad6
SHA512656ff9d877eb4edc1cab51f1a4c4282f5baf9435117cca591feba25bdf15ee619f0dc44c97529daf6068e1ff268174a4c13cf6500f20330d8aa048d9561e4630
-
Filesize
557B
MD5384dad22d4e2ac432aebba5ebfd5b44a
SHA168523e828ef78109eb1bef55fd7cf8f2563ab148
SHA2565e18dda74812cb5cb09359f70d03d690b31a810ecb696cf448ec6be5e878dc16
SHA512aec2ad7855fe2b1455274383f0c820241dd76269a6ffcf98fcb5e641ec8bb94c66344b42575336b4593f11c615e7eb350691ee262751e93be3e2750b289e59b6
-
Filesize
781B
MD512e737156845289f1ab48b34cae5876a
SHA1d416b0c47c4bd5d7a24ddaa231816673236c12d5
SHA256559bddbba64f6a81490cee307d7db7eba0b7ee3f9fa2f60740c340f629634ced
SHA512b4e3a6d9af75f66e05537f77b0b8006d84a485a72f024ac9d857a017e750e66b723d3228ac123bc692f0cf904a9c5efe6fc09f5ccfd36f5af969ca6f0c21808b
-
Filesize
781B
MD5ced391637cc25f3a6522bf17e1a26960
SHA18318cdda0be7f7c18818048160e8ea5b8a248aab
SHA2560d2756814a4a178e40128f0c6c4a1c01d46cc018dc17878ccd6d395a9bed2525
SHA5124c6133eb7703c3c1d309a11dbc3ac30af3492259331c0f2aebd14a8745708fd706f74ab2a74804e2863ab2a06ac6843b7eec6127dd30eb2de15bd8aa0802b448
-
Filesize
781B
MD5e82fd9f121292c57225206e91d4dedc0
SHA16e220cfe4aedc3d2084fa3ea339743dc43f174fb
SHA256ba79223a1acf55a99bc4820f3e46af58049201782e90043fc32e71a1b93e12d1
SHA5128bfe59f203e032321ff8d219ec4c910dc0d0055dbd2530497a741b50e8b1c7c285fe00efdd4d2b1ad7c401a4d4b65962354aa22ecc8cac95ecdcc69d06f84f40
-
Filesize
270B
MD51981810ee9bb43c9750bc44d7f40f313
SHA1c04f39a6a83445b29f1a794f6ab6ac691737acab
SHA256759543efb800376e96b43ca6095f932b3818a92c8a9db8f21f185394fdfa562c
SHA512f7383697141901db17adf93a48f4dedec472c33d373d1fb8c493f4d562b9181e0fd1f23e7c79ecd3f24d91c2535c0ef2ad3311c3f0dc0af50d1c0f019b4e2a62
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
781B
MD5d4fba5b6a89199820679ba178dde7c2e
SHA1d31ec43d6a7b5fb710820d8734621eebb462a19b
SHA25608770e40e178706c2a92d61eec44f268b86bcab819d9db952402af8eadf0edcb
SHA5124a52bd974867d019d2509330e4c364f143b93a829281b7b88cbf14b9b480c037c2ab072a49d066323b753600fb2ac9b48a63d11a7afb9ea391c832252ec85517
-
Filesize
781B
MD5c229f8d9ce0a38d90cc284595a642f3e
SHA1f37814ac0ec20023e559bd861aef026a57f8cb05
SHA2565704fcb4236877202bb869f16c8dfefe2724348b85702c3b30a7f1715caf5f6a
SHA5125db2a0b721cc11b59e1c42487c42b0f0a4b599a21567b834a69fc3db6b8c3582e5f7f2ab37c8fe264a214ebd3a9db673ec5df69a680af52d0ea6f78c61d24b83
-
Filesize
781B
MD552b281d32ac2f6d4025b4059dedf4832
SHA164672b377824537c11a1ee7c38dbdf34aa2a2c65
SHA25620f7c1d2fc942f6d5effeda7654f1a8c367b016f6d8170f125d859339edc2e50
SHA512c2aa9684e68a6ca2eb2778ce13a34aa5b4f6dde0a7e1d7d40c61fadc7a94530abe5db5773484aba55a8d33c80952d734393cb6dfed6e6124de24747124555193
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
5.0MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
28KB
-
Filesize
72KB
-
Filesize
72KB