Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 15:19
General
-
Target
5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe
-
Size
4.9MB
-
MD5
4cb19f29a50b590b4e049659105ec340
-
SHA1
80bc53b20a62cf2d790376f121ec32ef2b1dc905
-
SHA256
5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4f
-
SHA512
53f74cb5cb83953316d0801c003e29c090acf4bb3d28f924ce70c188475dc052844abe7fd06825e068453496a5106f23d81e574c405b8887fa6445a71ed9ddd9
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 42 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 44 IoCs
-
Checks whether UAC is enabled 1 TTPs 28 IoCs
-
Suspicious use of SetThreadContext 13 IoCs
-
Drops file in Windows directory 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 14 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 52 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 42 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe"C:\Users\Admin\AppData\Local\Temp\5f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4fN.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmpA25D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA25D.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpA25D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA25D.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\L2Schemas\upfc.exe"C:\Windows\L2Schemas\upfc.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c98ac34-dba6-4a8c-9526-91b368971417.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eefb12f7-e527-4073-a7f5-c8da8663effe.vbs"5⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\667dd22b-d114-492e-b770-f5ae36df307a.vbs"7⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df49bdc9-7183-495f-b1b0-12285e8569d9.vbs"9⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea95635b-695a-42f2-acb5-3ccf0d965c7c.vbs"11⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36cc1511-511e-49a8-953d-53a5d3bee841.vbs"13⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcdacae5-f179-443f-adfa-52226ce3a9eb.vbs"15⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e19afbef-36f3-4c91-aabc-fa51d1e3a161.vbs"17⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed84798a-f401-4ab6-8fa5-b902571999fc.vbs"19⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd757962-0026-4b49-bab3-8e88817a250d.vbs"21⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8168b1d4-4e46-4e5c-9580-a81af901732a.vbs"23⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58e19ce9-31d8-4cf4-b316-67e045c79db1.vbs"25⤵
-
C:\Windows\L2Schemas\upfc.exeC:\Windows\L2Schemas\upfc.exe26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19aa1be2-2618-4a80-be9c-eb929f7425c4.vbs"27⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52c6847b-18a1-4b08-bb31-2696d9fa052a.vbs"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6596.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6596.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6596.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6596.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c0bc66c-56d2-4a26-a396-8dae4e143813.vbs"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4A1F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4A1F.tmp.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4A1F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4A1F.tmp.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4A1F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4A1F.tmp.exe"27⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bf2b8a8e-0aed-4de1-94dd-08877765a7fe.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2F05.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2F05.tmp.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2F05.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2F05.tmp.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2F05.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2F05.tmp.exe"25⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5785245e-b223-46b8-82ae-5b915d4e22bf.vbs"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1321.tmp.exe"22⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80b53a22-1fd6-4d95-836b-38639dae72ca.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE143.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE143.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpE143.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE143.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\246be212-9cdc-4ed6-aeee-10405a4735b3.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB179.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB179.tmp.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB179.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB179.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB179.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB179.tmp.exe"19⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\23c87aeb-1c1c-4452-b9fd-dd2bc79fa582.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2aaa2fa1-7215-41bd-8c85-0a863464c09d.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1fe402e8-ad99-4b55-b358-16ac56fec8de.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp30FE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp30FE.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp30FE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp30FE.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp30FE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp30FE.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70044b35-fc1c-45f4-b457-0bc2b87102d1.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp12F6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp12F6.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp12F6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp12F6.tmp.exe"10⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\26b60561-1e3c-487e-a337-f56d82f816a5.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF6C4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF6C4.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF6C4.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF6C4.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad364295-0f85-43db-bf27-dce128e74242.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD939.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD939.tmp.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpD939.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD939.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpD939.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD939.tmp.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e553c5b-2a9e-4764-90fb-86c2a15bb605.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB824.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB824.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpB824.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB824.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\NetHood\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\NetHood\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Windows\InputMethod\SHARED\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\InputMethod\SHARED\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\SHARED\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Windows\L2Schemas\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\L2Schemas\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Speech\Engines\TTS\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Speech\Engines\TTS\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\Speech\Engines\TTS\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
704B
MD51b75058529216632ee8bc97b9a802cfb
SHA16226f74773146b650a8ca3fa114827857f2cc6f6
SHA256c0ebc1f53dfa4cce82b1d8a0706e6e91479f5df7ae223148d7cf4ea44c62000a
SHA5125819fa610353b804917f634be0f17e96f1865f48fa0b9d87112b8950233604b80a6185bd523c4e6b8fc401addd51fd9c901b1be413370b4ff6cf88aa56757695
-
Filesize
705B
MD5dca55ac8dd6fce8d2d184b601eda3746
SHA1c12cf5ed5d12e8b7ea80bad104fa8d19523e303c
SHA2565dc2e94307312825af7d87f27571f58c1922012282ee22928750079e34d78534
SHA512e823506616bb911ae0ca7b5a81f61d5413ed49c7e40ea255406b71207ccb991adae9228fe07c53d63a85a983d607e58448dae90933d575def40e5a59f36a01e2
-
Filesize
705B
MD5afbb2dd42ee787905e50604b804dc1e4
SHA14b88f8cbd657bb5bc45773a928bd0360ad276b0b
SHA256ce06923254789db419010e8f08579587456d40f317ce3622ecb16ab6c01cb6d1
SHA5120ac61fe87d35695836676e5c3cd1679b11d30600882b4fe7faa1b4dfe5a153778557071d754deb8d6e50e12f723ef1a0bcb93d1c6e4faffab345f51789e05c59
-
Filesize
481B
MD547e2b8674fb869cce3cd862b9d41643e
SHA11e3849dea7dd7ecba74271e4d7c6aae18ba0e33f
SHA25662e81c2f47465780e9901fa956a3fd8edae5b4885972be2e1d59f6978a6e15c7
SHA5126a14bdab438927a8ee0b4f1cbb6afa6e706e757c460683008882016397307753caec9d76c9edfbb05df092ce4ee0bf972135e7cb4baf5240aa16d9bad4b7010a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
705B
MD5e55ba49a38a148f65c18cb42d0441b05
SHA111a0fd028a289312537f06c6cd91b89ceb09850b
SHA2561103469458148ec33c389ec70041208f1efa7e73178030e2c9a06260c45f06a1
SHA512a6752273f3aeb1bc6c66ab27ac97c2586b40f220bce64dd0836bec5654d37f7cefe7896dfb6542913b457d45c5319d65ee7b8bb430e613b3bd7752080dc3edc0
-
Filesize
705B
MD5b610b6015cff4bacc645398c3bbf9f8f
SHA1fc28e36da717cde2c665188ff4b4f2d2a123b0b8
SHA2566fd2ca69613a29b5e818a146b48d7e6beeae918b30cf6efc6117763797e51b7e
SHA5127e938d0d28246cb4f5fb3885fd2ebfc6cf758059df3ae3164abe61210c1356cf8e07197b37865e89bbdc3bda749cf9689b327a461f09a93c1f8c6b16836351dc
-
Filesize
705B
MD5dccf968376ac4a7bb75fecf7414b9569
SHA1794a89ce9e4721f15a326c63764a04de3377d199
SHA256d958a76dfc0b17a2002e2d97e7877e06f5e8e65038a26ae29064a5900d80756e
SHA51234ae2fbdd965b94d4f4a208c1fae3a85eed5e6aff2931d7961693beebdcdc626cb8164777f3784d6757b524338380c74e66a2c7086c2214a6fee515c3924490d
-
Filesize
705B
MD51e007c3a4721b113a57994c1c85c9433
SHA1b38dfdca47ac27c9871670b5de021f8e459ce05e
SHA25671009961e5349fbbb562daafb002c716c8d10c5aa2eada53ef644747b02f8d3f
SHA512c6204c91fe612a2c617771612c39e08ed6f20fdc3575fccc75b4f145526f8cc1d1008ff3728d8c1f62a2bcbe67b82438ef460673f44c8cd85650d0d113ad9251
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
4.9MB
MD54cb19f29a50b590b4e049659105ec340
SHA180bc53b20a62cf2d790376f121ec32ef2b1dc905
SHA2565f6123163b483cf0d066198718dcf531abedfd43c880ba0252fcf7d55340fa4f
SHA51253f74cb5cb83953316d0801c003e29c090acf4bb3d28f924ce70c188475dc052844abe7fd06825e068453496a5106f23d81e574c405b8887fa6445a71ed9ddd9
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
1.2MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
5.0MB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
28KB
-
Filesize
136KB