Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-10-2024 02:20
General
-
Target
83a34c1fbc5d1248fe120740638198c3c592b48d50d4bcacdcab4602f88e8976N.exe
-
Size
4.9MB
-
MD5
8aff4335f52832ee8d75951d435db4b0
-
SHA1
c9fec65023831bd4d1494803b3ef5e1a40037ac2
-
SHA256
83a34c1fbc5d1248fe120740638198c3c592b48d50d4bcacdcab4602f88e8976
-
SHA512
4c4129e355c0f4268b725a401b11add0bd4b86268ddf8154f488324b22029ee78a8d2b673d01573c6a98e683d8af3047c64964b6e0c56632967b4f11b47b3405
-
SSDEEP
49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 24 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 39 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 39 IoCs
-
Checks whether UAC is enabled 1 TTPs 26 IoCs
-
Suspicious use of SetThreadContext 12 IoCs
-
Drops file in Program Files directory 20 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 13 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 39 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\83a34c1fbc5d1248fe120740638198c3c592b48d50d4bcacdcab4602f88e8976N.exe"C:\Users\Admin\AppData\Local\Temp\83a34c1fbc5d1248fe120740638198c3c592b48d50d4bcacdcab4602f88e8976N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp8CA4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8CA4.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp8CA4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8CA4.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vkHZstJXcW.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Recovery\WindowsRE\Idle.exe"C:\Recovery\WindowsRE\Idle.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cafa64c1-55b9-4172-8ba7-f29937c40754.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\89f3a654-cca9-4a8d-bbc6-9a519a723ad3.vbs"6⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4b492fb-abbe-4513-8072-fbd948c40010.vbs"8⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff068761-0fd8-4d8b-b2a6-b89ae324b235.vbs"10⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5b9383a-ffca-4172-a51e-6d51a7a31f48.vbs"12⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9c56f1f2-a745-428c-b947-7879270a8180.vbs"14⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\feaf89de-5382-48e0-b5ca-1d77670c964f.vbs"16⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c960071-6e26-4151-85eb-076e83ee44ab.vbs"18⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\51f3b9bb-211c-4048-9590-f99db05769ca.vbs"20⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7310882a-8bd4-4b40-bb19-a5ee988e46f0.vbs"22⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6c07e3b-2af0-446a-bd03-07b468d16058.vbs"24⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd0c4563-3bf8-4dd9-9631-9c7672887ab5.vbs"26⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e11e9234-3a80-41c7-918a-1b1081e693cc.vbs"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4339.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4339.tmp.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4339.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4339.tmp.exe"27⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a6279197-652a-4b98-8baa-614cfb184553.vbs"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp27F1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp27F1.tmp.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp27F1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp27F1.tmp.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp27F1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp27F1.tmp.exe"26⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e171cc3c-6c33-4863-ab9a-7d423dc66f57.vbs"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC4B.tmp.exe"23⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\284d36dc-087b-4994-9a9b-9ed57e861837.vbs"20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF056.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF056.tmp.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF056.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF056.tmp.exe"21⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57c386fb-3785-45c8-aae2-d3e8aa932154.vbs"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD452.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD452.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD452.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD452.tmp.exe"19⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28b23a0b-d36c-431b-90b6-bd54e843866a.vbs"16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA41B.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7dd586f-35c6-471d-bcfe-0edbfeda891d.vbs"14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp87F8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87F8.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp87F8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp87F8.tmp.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\523bc4bc-86b2-404c-bb95-3f36f153a4f4.vbs"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6B48.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6B48.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6B48.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6B48.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ca719a8-26f9-4c09-b189-e0c52e4a5b7d.vbs"10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3A55.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\914e6c34-d7d8-4f10-bb1b-d77941e4b7ae.vbs"8⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27ad4fb7-86bb-4a6c-9373-0a3932df8c67.vbs"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpEEC5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEEC5.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpEEC5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEEC5.tmp.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6deb5817-c5b0-4e71-a878-11fc97f357d4.vbs"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpBDB2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBDB2.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpBDB2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBDB2.tmp.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Mozilla Firefox\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files\VideoLAN\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD54ed6633487b2e0ab71cf8475b70016ce
SHA1f050bf546cfa178c9eaef6fc02cd3addfed82739
SHA2568e1ab057bc98e338964e34d5dbe0864f8fc850232288ae668b098903f1e8d1b9
SHA51295da46c6c0bbde66878bb5bcfb70e1692cbd104cd8435f5798940d54c271cd6ae76b1d396f37fbeb592bdd55ed284a8443bc1ae4c6e0ba91a0256cc39a540020
-
Filesize
4.9MB
MD58aff4335f52832ee8d75951d435db4b0
SHA1c9fec65023831bd4d1494803b3ef5e1a40037ac2
SHA25683a34c1fbc5d1248fe120740638198c3c592b48d50d4bcacdcab4602f88e8976
SHA5124c4129e355c0f4268b725a401b11add0bd4b86268ddf8154f488324b22029ee78a8d2b673d01573c6a98e683d8af3047c64964b6e0c56632967b4f11b47b3405
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
482B
MD5dd36eb722d54f1893488b2ebbdbd7370
SHA14f0512c0c2c0f0a2b01f033197590d5f4191606b
SHA25663cb0d753a056bd229f368419d6ccebe2a58e14d24980a21853bd73712ed269e
SHA512de05862743ca29c1feab4298aa2ab476a994579b531dd6e47c2d295a1e44631fbef8e3abbe62eb0722713e66d081de11bb82aeb9e2b46e1e33c6afa2256a824b
-
Filesize
706B
MD55ae97245df7283136ffaa7c5e62696c6
SHA1967db751fa1ac8de54230cf8537477f252b81bd4
SHA25620f9ebf9c70c87d360546bd4d31fea5069f1cdde1b3b88e606e6369772fe4219
SHA512ebc502575d26a1130180335266044ea508493085253f7ad1033c48666e09311d806fb0f494123fe180495eb0bc06eab4dbcecbf0be3f76a0e90fc18b5a72e9d8
-
Filesize
706B
MD5c9f55657663319afcd00c5f7285d48bc
SHA1b140d70a27d9a48239aa8fb9d478e6f3a089b2b8
SHA256ef031e44a29c3cf93149d927bba9698ad3f49faa3084428ff8fa8a78f59fbd0c
SHA51268ab1ac5f7d07f9fecc98bd4f7b7185e4504ce59c3c622a2a7ccc22fa292d6974f913c4ec82aaf469432dba39dba1eb9ebef3220999a78e223eab74cca761c14
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
706B
MD537d30c750fd5077c88680f432018bd77
SHA13424d760b84dfea42e336a3700b2276e377c9ee8
SHA2566f5d856192966f144ec4ea308ad295e6998108c21a7b61b58c19593ceb7faf91
SHA51227793496c4c119ecb47f39b89a6720e05bc386d05f219230ff0362540b5695fea3b53de08958a446be187a3c3ba64e53a88133c2bfcd43b0dc3b82917c4ef82d
-
Filesize
706B
MD50bf6132fdaf1ef3958cbc890170e2b28
SHA1c9c41d345a777207ecb9a6476b1117dfbf95f059
SHA2566c0fcce157725bd53a5c0e4d8eecb01b7695bb06f999a50babeff35ee44c25c5
SHA512519ec98e8c8754d2c8ddfa5cfda827ffdbcd00a4b0c99880596adb448fce57328e309fce3d626c491f9c6bf97b4efa47db961ee0092b750bdbe9c36d562b7a05
-
Filesize
706B
MD528c15acef3d71a96797c0e62a6b8b62c
SHA18f3be491960138a5e48bb9ea482e3a80fdc070b7
SHA2562d2c4071a42dabcee18a9c443ca6ed6b9369ee9ca2772d97f6240af6e15725a7
SHA51274431844958fd091bcf12f68977399fc40fde14d2bccb5cc94f5ed0be919e396a341ff2e26f3ea93290cbb3e98cd400fafbd3a7a39df6864c7577255fdad0237
-
Filesize
706B
MD5fa683d9e8e11ede4cbf1e1e71a98e05b
SHA1ac4adacf7dbf13d744f4a6b1c4e153550b3df314
SHA2568c566208df5f3efafe71fc9022df167a753716065628c4c60fd95cd46c8ae791
SHA5125d07fe98772cf39c117ecefe3a5c9e79838a2a4db0f24ed47fb601853fead30f4ef0187386d38b5c01324e95fc4625e6507117ec7effd22b4ad3e93a3327a91c
-
Filesize
706B
MD58ba6e6a1e00c3140ac08ca69c7638e3a
SHA143c8e75a70efa7592830aff335edc04e2575ae60
SHA25668f66416d4f6396bf2423dd8315150d50743ef65003e7493064a351256383fe3
SHA5129aec2013e0121eb258e38c6069d6594c949236fa7e596ff75afc4be4596a644504f22fa4b5bbc85c294665f1611ad85d2c021157169d17aed8b6671c5e6f8d1c
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
195B
MD5fe546a2304afb1b7882850c782c76a43
SHA16bc8b7fc171bc256c378771d58e387b7053f17d1
SHA2562f825a7f232013a62a2b6d17f6c9dcece6506feef415831bb2af74fba720d6f5
SHA5124aedfe227317ae5e8fa5412eec3d92744aebe19688968a90c43b07d3053397485dab75574aabaa9e3f24ed2a8ccb4ae106517fd8e19f6cf9102bae0bc4f22a20
-
Filesize
40KB
-
Filesize
88KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
5.2MB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
1.2MB
-
Filesize
5.0MB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
28KB
-
Filesize
5.0MB
-
Filesize
72KB
-
Filesize
136KB