Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 15:03
General
-
Target
2efc423b76e4954b7311cb80771c1d8ff34db83b8a33a31efd21ceb1ff85111eN.exe
-
Size
4.9MB
-
MD5
c352be4e4eadf26973f9bff1e60635b0
-
SHA1
a4b01b3e58aafd467e23d2eaada670116d2f7971
-
SHA256
2efc423b76e4954b7311cb80771c1d8ff34db83b8a33a31efd21ceb1ff85111e
-
SHA512
a8471c5325c5d205adaa90aa51ea9b9dd08f8622a9cf3424c490818b1a0504447f84296e5fd2615544f8e2cb90fdd5a9d50f319387049162dd88137940174c8f
-
SSDEEP
49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 39 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 36 IoCs
-
Checks whether UAC is enabled 1 TTPs 26 IoCs
-
Suspicious use of SetThreadContext 9 IoCs
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 13 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 39 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2efc423b76e4954b7311cb80771c1d8ff34db83b8a33a31efd21ceb1ff85111eN.exe"C:\Users\Admin\AppData\Local\Temp\2efc423b76e4954b7311cb80771c1d8ff34db83b8a33a31efd21ceb1ff85111eN.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmpBE62.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE62.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpBE62.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE62.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpBE62.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE62.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hmaQKU637d.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Windows\debug\Idle.exe"C:\Windows\debug\Idle.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3723b150-94e5-45a8-bdb6-d072eaf14ff6.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc212848-6ebf-4875-adaf-9c3e4b00a144.vbs"6⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f6c3313-1849-4f86-9aa4-67f9f0522457.vbs"8⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\907588b9-330a-4663-b29a-9c9f65b57ed1.vbs"10⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bd7ddd2-0a03-472d-8717-82fe438f2937.vbs"12⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41cab6af-11b2-4e60-a0b1-070e5105a736.vbs"14⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f96cf4d7-4f2c-4ba9-a461-776cf73c8c0e.vbs"16⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4b57fe3e-2efc-4089-8dcf-73a9c4817b49.vbs"18⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6261d9a2-37d4-4ef1-8e19-a803606f4c7f.vbs"20⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44910477-309d-43a6-ab96-5d389abfd8bb.vbs"22⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f4bafeb-04e9-4cb4-b708-4a0abd32dee4.vbs"24⤵
-
C:\Windows\debug\Idle.exeC:\Windows\debug\Idle.exe25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3098ca74-546e-4449-93c1-0b82de75e2c9.vbs"26⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\212b3ad9-2da9-4eb4-95e0-c81b922aa41d.vbs"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp83BD.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp83BD.tmp.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp83BD.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp83BD.tmp.exe"27⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40be6d54-01e6-4d54-ad87-df5991212a40.vbs"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5346.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5346.tmp.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5346.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5346.tmp.exe"25⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\246ad6e1-7558-4654-bb41-a336115e028f.vbs"22⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a204eda4-9587-4a41-8857-5ea8fe863d95.vbs"20⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9093cdcc-f15c-445b-813d-5857449ac9ab.vbs"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpEC8E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEC8E.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpEC8E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEC8E.tmp.exe"19⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a08aa0a8-072c-444b-91e3-1e5bb51c5766.vbs"16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD05B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD05B.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD05B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD05B.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7bbf31af-71e5-4cd6-8273-a9a5c51f2d9b.vbs"14⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3de2e864-cb64-4b75-af3a-fc1b1a6e3694.vbs"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp81FC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp81FC.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp81FC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp81FC.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dc2f86a0-f865-413d-ad07-1891acde2326.vbs"10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6433.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6433.tmp.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6433.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6433.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6433.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6433.tmp.exe"12⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5be0a657-7068-4666-83b7-cf1d900544d8.vbs"8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp466A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp466A.tmp.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp466A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp466A.tmp.exe"9⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc6e6628-0d51-428b-a1b5-160ae4b7087e.vbs"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bce50cff-1bf0-4c4d-b28c-02a1bbc45e0c.vbs"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmp.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE3D8.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\debug\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\debug\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\fr-FR\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\fr-FR\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\fr-FR\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5c352be4e4eadf26973f9bff1e60635b0
SHA1a4b01b3e58aafd467e23d2eaada670116d2f7971
SHA2562efc423b76e4954b7311cb80771c1d8ff34db83b8a33a31efd21ceb1ff85111e
SHA512a8471c5325c5d205adaa90aa51ea9b9dd08f8622a9cf3424c490818b1a0504447f84296e5fd2615544f8e2cb90fdd5a9d50f319387049162dd88137940174c8f
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
701B
MD5810a1f4d9752cb5dc8ff423e70b61e9c
SHA18f35158f77d2da20ac3ba443bb2281668d27e8bd
SHA25699e78a3f704dcfd4e283387d073cb2f16efbb571214ec51e4b9a3ae8826fe1c0
SHA5126e9f0119fe0240b36423a63c8162a50f1f921012b90879011ede0c969a5154a5dfe7a8dc556163646f41a21540136e3cda411221f95414182c4b59949985a6b9
-
Filesize
701B
MD554a5cff098667054fd459088a6220b40
SHA12fcd593d6e19dbb70a4763928bcb27b60f9daa1e
SHA2568c4508903354f39456a57030ac38ff976b7d81165f8130dadf20fa377e4f9581
SHA5129c2a753d9a8ea89dfd24352d17360e602e16628efc4dcb1d62ed1905f74bd12d1b77ccd3551c5f943b621aacc5b2055552eb17359743f4d1953618e19a695110
-
Filesize
701B
MD5ee13e5a0502f473fe9aa6beecb7d8bd0
SHA12aba518339d54ef1a9607da91c5c324c3167b692
SHA25601e4a87b4234bc59990bb79a86e42a101757d2fa086ec3911820bc666da2f5be
SHA5126da7bda23e9edb8bcd27a2dd723c9d22637f30a678ba9d00d507b02ed84a2b4a781cf0065930480b861bed9ed3e47f2e272d7cf255786200632d60a9402f84b4
-
Filesize
701B
MD54bf86b9bdfaa057ea273883e6642fd10
SHA1679a16db1b67873be0bcd37d817d318da738efa5
SHA256cafc98bc1345058967a5563eab8476c245725a955c6636897ffb34472a133b07
SHA51272852a4e78c41f1bfc8bdbb421705afa061d8aed834496411888294df5ab739a0516b46301042451b0614b19ed84fadb2c393859b44551a382b6c183888fbb7a
-
Filesize
701B
MD5ab0e9d9e79110fcc4c0f76885c1e98ec
SHA119a7eb8dc328af95f159218ec0d8b5cba0fe8356
SHA256acb6e68b05223b84492d43850ad309d057967174ddca24be80707d99a8716e1e
SHA5120068345bffd28e77053a78e2a42e5daff63435e02c45cdfac6fa6919c9d155871d0caece0a5367f3ad295409424ed6194d9feff9b777a1af8c7d3acbe2e6d8fc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
477B
MD5622808fb6a33eacc1f51f0b7ad61df6c
SHA13ad0b7d5dd7b7ed6ee323a5dba64c2ac4d10dd66
SHA256cdc8ddb49df7b19b880248a8e52cf5731cd1616aa5feb10f11c04be147c3ddde
SHA5124007229770d40f3c528083196f8b629f646c6795f98045a438e6ad0464e538b3a6aceafdd9a1c1a67d449384f84dbbefeb709209c5df667d5d0efdb0b1cc094d
-
Filesize
701B
MD521bc27ff1e81c813c14aaead8f03f904
SHA16da9471d1a40ad00b803e3fd4b5f1001968f6ad5
SHA256ab2c8278a54871b8bc6afb1d64d194a43be798a4e32ee719891762816a8a327f
SHA512c8e5e0e9cb309abdd401b01a0cd33146480ce202abe2f2224c626d475fd70dea502663e0b54c3b4c1b5aeb3479ea9d7453994055f32064a68fa88ae81c6ba39b
-
Filesize
701B
MD5b148bbbbfb1efe355f5f23777b617f3e
SHA171a809223eb0765abd182b85fb441896a008f817
SHA25635549a1ba3204586c20a7ed20c430c537b93fc641a3627a2c3176fc9ee08e52c
SHA51212efa6b5f42ec0bb29e3e035a96533b9cbb0e8e21a11089ba28c8f720a0a963ad07ad712c6f7e0213dbebc1fafa84bd50a7602e5d39d6f3e0420fc6d1ae74cdb
-
Filesize
190B
MD54a7d95a25f9a9c0aa9cfa68e32a288e2
SHA14512bbc0db86aa226d3a8c0e53b95dad0627f7ca
SHA256f28484eca7bfa3f67840011f5d9fa85175f7154b74f66f3056d468dc9660425e
SHA512f3debe619edbefc65202cd91a91b044fd4a643769c7eecabae708beae04da96ff43297ab511c4475d169fd3c64db9dae2b1584bcab645f889cbb6fa25e8e72fc
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
4.9MB
MD5ca30fce29ea4e984bc4a1f54f9a5d5e2
SHA120cfb079cf6deb6344e9140cbab2f491aec9ff68
SHA256bf446eeeffab78bdf2506f31f4eb347f0d70afbe4f2af5ef2555b5eadcdf77ce
SHA5127347d38a22f3f849e57ee2e51d04e3e945e6161d2a6eedd30c3e8a8778cc93eb54843a9281a6ce07ef2c689a0599d630cfb78913800ac2d594c10150d88aea5b
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
5.0MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
5.0MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
1.2MB
-
Filesize
28KB