Analysis
-
max time kernel
119s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 18:23
General
-
Target
5f86384891b455ddb5d94b659c947ad67b76b282fcb268f12a31a2f3005b19a3N.exe
-
Size
4.9MB
-
MD5
1ee8e7191df743349bbc4bcd6e3570a0
-
SHA1
aafd7860457e3a7ff9b53457e9c30451785fba60
-
SHA256
5f86384891b455ddb5d94b659c947ad67b76b282fcb268f12a31a2f3005b19a3
-
SHA512
fc08546b960bd11a31f76628a5eacaf4c811d312ccca0121f7a18f01f578360b07ff38193e55f46ccb8429ee73d224532cfcab3511831be4722072d13e73e10d
-
SSDEEP
49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 39 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 37 IoCs
-
Checks whether UAC is enabled 1 TTPs 26 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Drops file in Windows directory 20 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 13 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 39 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f86384891b455ddb5d94b659c947ad67b76b282fcb268f12a31a2f3005b19a3N.exe"C:\Users\Admin\AppData\Local\Temp\5f86384891b455ddb5d94b659c947ad67b76b282fcb268f12a31a2f3005b19a3N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp9D9B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9D9B.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9D9B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9D9B.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03135e6f-bf33-45cf-8b08-f2c323458e76.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8db4c35f-bdcd-46e3-8360-281f7cf6ae97.vbs"5⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\140879c5-b723-4cb0-a7ee-1a64c9bb0533.vbs"7⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6c58811b-79ab-47ea-9656-036f2bbad50d.vbs"9⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d7b93bc-bf50-4f9b-bc20-2663f9940086.vbs"11⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8527143-dbb4-4b75-bf58-5086ebbecb32.vbs"13⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a408b52-70f9-4c8d-a859-f83a69f9414c.vbs"15⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7d8ac5b-691d-41ee-94b6-acafd7905d11.vbs"17⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9134391d-0aa4-4002-b482-6584da1524bc.vbs"19⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9f7ec2a-bf57-4a4b-93d9-1d222ada4ab9.vbs"21⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1542a8c8-9e40-4df9-b875-d4f6bcd2b81d.vbs"23⤵
-
C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"C:\Program Files\Microsoft Office\root\RuntimeBroker.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a1a6807a-5ce6-42b5-a3c6-fae68a510b68.vbs"25⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83eac41e-5167-4831-9a1f-7de167d4b98a.vbs"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6150.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\353790b4-041c-44a5-ba3e-92429eaf3f4e.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp452D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp452D.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp452D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp452D.tmp.exe"24⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e109dfc3-5a31-4cc0-b430-0fc085fc0fd1.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\104a5a86-137a-4b0a-b7f4-e4a6a44f04aa.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF7B9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF7B9.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF7B9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF7B9.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f63980b9-d604-48c6-b687-5deb366fb798.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDBB5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDBB5.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpDBB5.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDBB5.tmp.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bdd0f5ca-20ea-447d-880a-860a61545252.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpAA74.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAA74.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpAA74.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAA74.tmp.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e1315f3-8b80-4fb7-ae10-3f8514b162ba.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7B46.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7B46.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7B46.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7B46.tmp.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\87fb5d4e-d1f1-47df-a469-7d07876795b1.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c098f4b8-3e33-427b-a25b-a4a768cc0156.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2DD1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2DD1.tmp.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2DD1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2DD1.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2DD1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2DD1.tmp.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3c2e41a4-2b0b-41b6-8d07-c04ba37da2d3.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpFEA3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFEA3.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFEA3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFEA3.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f12266f5-9b01-4a9f-a9e5-106a51a947b7.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE251.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE251.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE251.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE251.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f268f4d2-52b7-40aa-8837-d4d3d18b95f8.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC311.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC311.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC311.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC311.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\DiagTrack\Scenarios\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\DiagTrack\Scenarios\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\WindowsPowerShell\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Windows\DigitalLocker\en-US\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\tracing\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\All Users\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\twain_32\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\twain_32\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\root\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office\root\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Start Menu\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Start Menu\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
732B
MD5a3ae43a59d0ed4ff8ae4aabfde3914e6
SHA111d001da1424ac5232cf1de6467dcae289bc8370
SHA256d94e89a556ccdc3eec47a4d8167fe339d5401eaf7f2f2191ac8093a2c1d590e7
SHA5124e503c03c83e9b6db999425909989435e486fb9938440efad5ede03ddf07120b1e72e0c8f5fab3ba63c7772966251abf30c3e44c0e1672f81b76f42c4aec9348
-
Filesize
732B
MD55f00419d52ea199075ab8dbfec583bc5
SHA1c2a9e7f6805a1c197ea012c4749979f906e04b5b
SHA25620b25eadfbc8a41f2a2680c6e764eeb2be7c261d6bebd0faa3bd24e5e708521b
SHA5129434d2e7e4f03a96fb6da386f8372d76b3315531294fd8f0d9d516b3dfa086f127b5cf81ea823e71457b98e7776fbcd39ab788b031e787fbffd49dfff77356ae
-
Filesize
732B
MD5697ee9a646ea813db5a7c5a5d703d76b
SHA1e86efb148b91da23d0b681a22f3c42f1239a5830
SHA2561d7afb88ee7a3078f4c60ceb1854925097142b9d29545fe7f695e885d64ba4da
SHA512da66e85dba3ef92227e8a8926b5e5fa472d02bf4652c1b3e62f7bbae7df6c54d091368c833c73e180d066e53183992f957d07a89ab9e0fed9d03a01733decdc0
-
Filesize
732B
MD5865cbf11761fc3466c65660311204335
SHA108f829e15a3c180574c132c663f99b0126e47efd
SHA25614747c90aa88826b3a6d697be9e2cad7dae2ecd64ff84f8fc5bd4f9ebc33b76b
SHA5122e992c331f2331a947b78b91ae9373035701a80a56bfe9dbc39f0e7219efb714e2dadc4127d8a59bf680c1c843fd61a995e392fe392037ecb92f3c15259cac3a
-
Filesize
732B
MD5caa740d6e38a3a16bce2ebe17c4a0d02
SHA1d287a80b20eb8136341f1880b9fd4602c02645fb
SHA25616be27eda60f44139808a6d98d5445389835018ed814a25fa2147f22b1d0edf2
SHA512810660718e27a557165237a7dba7d0b82311e565fafc7519f4948ad4c3564ae977e46317b52c1eab7f36143814e8a7b527f9697ae2d6fcf2597250da755cdace
-
Filesize
731B
MD536f5c130e9fe494c3241b2cae77d93ec
SHA1f8895691798cdf24e659d1d651552bfbe4a45aa8
SHA25661805883dd684b299b627be99cfa5a590326e2c84869f74822a66ca251a32ed5
SHA5128beb8a6288775eddbf01de11851be282e5d47a7a456a5dbd1635d41934ff8aec06091f9209130d69f4efaf64a8614e83bd7ef8117d4fcd787ab3a56a5b03fd3a
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
732B
MD5e096a90d587b44eb5b590b732d027214
SHA1e4560625676d851fcb805011643a1548e778d633
SHA25630d838796c79b2e75f4e5a5284a8e619d3f5045b8788323b8943e9a1af8392b6
SHA512ede06cb218476fbf4f095ad69576bd1233545fe2ed60ee04da8e2922b66f24335032dac6268e2140fafd9445fa0330f404bcd10c44a4372150fc2d6d7653e835
-
Filesize
732B
MD53c9821fb3d30b0e2fb1146932bffd11a
SHA1448f962294902870c7aa85558c48dcece3c43aff
SHA256e6d73372b17b9e5fcbe3e98fa3037e35a78fbbab53239f26ba7d883aa14e9127
SHA512fb18363980258114a311acb45222404cb7fdabc7ce5911511dfc27d63291259c7e5f5376fdbd116c099c809804f398bb166868e61c6aec7addaaddc72796dfbe
-
Filesize
508B
MD554c2d93bbd61133eeb8aab4cef1d52d1
SHA1690b724ec6a2a8bb2309a843f03ce1cdd14df513
SHA2565ccbff02ae848aaf7e2abbe5d610890108519b2554a54d482802d342ac555995
SHA512a952de3a219016487e04b7b296e363603f12fd18be74cf7f34a27edbb74e27b227c252e1346ed28b85b6133ae142228b1487ae9199c9e7d34d8703bef3a3482e
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
4.9MB
MD5daed710b22905cb5be7fc4e38a77baee
SHA1a75afee100ec759f3a13f7a4dbb9254fe3649353
SHA25607ee2c78912c5021154f1c70fa77f373c906e7e568ef34217c8626410de679da
SHA5126276fe2c03a62dec979dab85182e4dc3a33ba7338a9ded987d114c95a0e6da93c2d953d0578b9e57f3fc7e330bc184a50df1b7bb8b12c31e69425e1e9ffee2bc
-
Filesize
4.9MB
MD51ee8e7191df743349bbc4bcd6e3570a0
SHA1aafd7860457e3a7ff9b53457e9c30451785fba60
SHA2565f86384891b455ddb5d94b659c947ad67b76b282fcb268f12a31a2f3005b19a3
SHA512fc08546b960bd11a31f76628a5eacaf4c811d312ccca0121f7a18f01f578360b07ff38193e55f46ccb8429ee73d224532cfcab3511831be4722072d13e73e10d
-
Filesize
4.9MB
MD5c12454ad40b854ad1bec9becbccd28d2
SHA15372cc5356f1c58f27a84916feef789cc1b18843
SHA256a88fd78edc0994011e89085036a899d3e5c869f3519318b87cc4ee37132a6cc4
SHA512cfc657d761cb857b9f31a41c3123278efdd323ef2385364b0ce93276f258517b0b9efc3ebbe8138950228c0915839dd841a1379a55a7fbd37a911d4d04f3a9c6
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
72KB
-
Filesize
5.0MB
-
Filesize
1.2MB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
28KB
-
Filesize
136KB
-
Filesize
72KB