Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-10-2024 18:51
General
-
Target
101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe
-
Size
4.9MB
-
MD5
682295e9dea6b6c362facab1d64dbcfd
-
SHA1
f919a213030d33a2cdea27e7471ddbadf2f2a268
-
SHA256
101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5
-
SHA512
4cd90d088a4f5faf082b5567314e3d5e1a80a1ebffb1f3cf7eb69a71386e6f87205e38a49a350a7118e03b888cb5e61408b356f78e16a6282913dac2a09d622e
-
SSDEEP
49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 42 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 44 IoCs
-
Checks whether UAC is enabled 1 TTPs 28 IoCs
-
Suspicious use of SetThreadContext 12 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 14 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 42 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe"C:\Users\Admin\AppData\Local\Temp\101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp96A6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp96A6.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp96A6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp96A6.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f67bae5-32b8-420a-bbef-b3dc7d17278d.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fd9e37d-ad61-4321-b2fd-8f637b490d06.vbs"5⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b2f36a2-4988-406b-a84a-9678f34cdc49.vbs"7⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71c504ef-895b-4245-8f8a-2225fb1a4f1e.vbs"9⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba0eecd2-307a-480c-9497-6fd283b41f99.vbs"11⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fec081af-e855-4dc6-bccc-c342de3d118b.vbs"13⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e50a1ad-de86-46a7-b44f-ecc08e773105.vbs"15⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\001c3137-78fc-4394-a48d-acf6d38bda6a.vbs"17⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49793587-db5a-469e-826b-d0795d45c3d1.vbs"19⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d21358cb-4650-44a9-af0b-d8418e23fd0f.vbs"21⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cb7e640-0e89-405e-b75d-29b3b9e8ee1c.vbs"23⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0bb75507-6340-4b71-8c18-e3ca98740b56.vbs"25⤵
-
C:\Program Files\Windows Security\backgroundTaskHost.exe"C:\Program Files\Windows Security\backgroundTaskHost.exe"26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a3658b8-c98d-4e76-af8d-82bf37a70027.vbs"27⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c48a20e-45d2-4969-ac14-e9fe8b99bd45.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f079da77-e23b-4c73-ac26-7ef67e439aea.vbs"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA251.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db952bc1-dfec-4ed0-8b82-d292865289f6.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8524.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8524.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8524.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8524.tmp.exe"24⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13abe1be-8477-479b-a9ce-c46473f772e9.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0134cdbe-a16c-4dca-8308-f1a7d95d76a8.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2522.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2522.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2522.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2522.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\48649186-8395-4972-94ce-bb6351edebda.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF45E.tmp.exe"21⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ee5dbc3-b4c0-4092-bd6e-854f7e36605a.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC501.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC501.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpC501.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC501.tmp.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fdc37414-9d76-4499-82cf-aa8e767f86a2.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA94B.tmp.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70b8ad89-19e5-48e9-b337-c166f143ff0e.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7896.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7896.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7896.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7896.tmp.exe"12⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bda1373-a79f-461e-bb69-373151537f38.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp47A3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp47A3.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp47A3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp47A3.tmp.exe"10⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\807f3f7d-3421-4d1a-af4c-0cba26b21c0c.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1865.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1865.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1865.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1865.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\336fb1cc-fba8-48c2-952e-d47ef9db1417.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE8F8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE8F8.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE8F8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE8F8.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc2448bd-d38f-4b2f-8c8e-f43d0a57966b.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB844.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB844.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpB844.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB844.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Windows\SoftwareDistribution\Download\SharedFileCache\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\Download\SharedFileCache\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\SoftwareDistribution\Download\SharedFileCache\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Windows\ja-JP\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ja-JP\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\Engines\SR\es-ES-N\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\Engines\SR\es-ES-N\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech_OneCore\Engines\SR\es-ES-N\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\SoftwareDistribution\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\SoftwareDistribution\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5682295e9dea6b6c362facab1d64dbcfd
SHA1f919a213030d33a2cdea27e7471ddbadf2f2a268
SHA256101706972216b2377ea15046f3707034c45b88e70773942f47ab0e74468712b5
SHA5124cd90d088a4f5faf082b5567314e3d5e1a80a1ebffb1f3cf7eb69a71386e6f87205e38a49a350a7118e03b888cb5e61408b356f78e16a6282913dac2a09d622e
-
Filesize
4.9MB
MD5b28df1189535d631c141b427bb270e1e
SHA1a7365a2d061102d9b9982531cad0182f3381d848
SHA256cf8fa7605ee1090e1dd5f8ba883de2f02e07c9f0232a291b99d8b97b7f98813f
SHA51294fd7997421e0145e9035aa21a5e4818e13ca943db7ecaaa871cc7a6843742b6f2a2bc71063c037e0741c95470f904330e88909e5b7ef8399dcb1423d0c28cd6
-
Filesize
4.9MB
MD5542b47314e323b9225dbe068ee013cb5
SHA132e8e8d1e3aca900c5577f0229cd6c568c4b401f
SHA256204a057c98abc91c20f6bf6b2c2fd99936ef1cbd40cb86ae62ed69c206d5486d
SHA512569992fc4d374e5bb4823b6c38acb986fb1bd7d2db89538a43770b2a2c965c4b57c13205480aa9f8fd1a80023032a08f19edfeee0f63d1edcf67da6957118aac
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
731B
MD59b620365afb856513612a0ad3869afe6
SHA165caa0c9aad069c4f79fb025aa69820ce3d725cc
SHA256e4d5d8f581d291d6f9e2775d5b63c11bf3b754307876d1d61ed7bc6fd32bbc3c
SHA5123086f2a07fdde83d02ac066cce0112dd4bdc0c62e33af46f0dc647cce41085721c2283cd84b57966023a7878583ab04eea8ed453b1cd2e748d2631d7659d0844
-
Filesize
732B
MD5931a05a5d695973dc5396a96b515225d
SHA12b7e942fdd1d51d105d9b4813e4fe076814673e6
SHA256b004687dc6a12a6de5da1a407aae3ee4dd459ddd1801976ac3feee13afc82603
SHA5125914db88df544dff5b83381068c700460d4be374e326f483f14c64508e5d77030231b5776f78bc68d74c9a5fe10fa6e53e23898978ed4775e5327993ff6cba45
-
Filesize
732B
MD509fd308096b67650da4f3943bcebef82
SHA10ad73c9c99e8f5c38d4f99e0dce44d476b00f259
SHA256de37f6b34f855564fd757961f967ec6de6c2544ab0c49fe8b848a54e74048ce2
SHA512a224c67c318d3ec9cab533440f840c8fd30759d145e8a3e08642be104b592b21cc3880683d43d308173b01a568780bf1c832cf54e9ead45104834f9d45910336
-
Filesize
732B
MD5435beea67bad9253a6e7090fc3866072
SHA17541816f0c6abf1e40fe1247601e963726864387
SHA25638bbbd13c590af71feb2fe0e11661bdf5507469570e0d00abc493ba579c857de
SHA5128254a268399b480f7dc642a108e7948a32653169276849efe74a014758f5fe37d1bcf57326796c7a1bd1a287270d0f1bda6c552847327eef99ff3e8e75061bbd
-
Filesize
732B
MD56bb82627eb0593a1c508a503aa2e4b11
SHA155f5a613c068b8ab93950fa50a33ecfc58733f33
SHA256268cf52d102082fa35fd15f9dd1fa27b8bfce1fdfe609e89550b7d1f95cd318b
SHA512badd48e0f273931a487b4c3bd00d685834eb959809b4085c6a77461c5faf459f58b13c994f4c7ad131593f7b025c6f2d73f0257c5981cd9f4f8ee821c397ca9a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
732B
MD56cb0cf6658ac067709559eebb68e7439
SHA1b22848b25bba8b88d04aa8d18dc54f8f52e67b95
SHA256d19c1f242ccda2a6c707412eb4fee587bb0065b7d36857941a5627c50827483f
SHA512c325283db7bfa618b12d6b9f400e37301198a9fd1546314417e87fa1a8cf0c0501165ec190a7d9255f44ba7b22ea290154b603f267b235bf80094b4e55a9f6b2
-
Filesize
508B
MD5c19543e251d0f590bae0e6553e739863
SHA1bec059194c1ea2280f6de660d79177be2cb408aa
SHA2569c58cd2068d0d36b5114269f2b37ada0b42d15bbeb1ac3c9b6f811d81a4566e5
SHA512d65800a5b1c12375b27fba14e89eeddbeb5c6f102dc770a192e46120a1d444f6992945a93b5fd603bcc341cf92d697318236886ff9322562419ff27f690aa8e6
-
Filesize
732B
MD57f37112d8a08e8cb63852a7cce578662
SHA1129b855a1aab40b18eef49434dd9c0ee29742a90
SHA2562c529a9692985a26d2b26247fe48bf6cc0d9c6a44cd9d23c602f3d4caca93bb9
SHA512ac58cd854b478f947bc166ab79205162ccba9b81423a3dd4bac7ae8089d27423ebc6d22047ad7571ef2daeac3faeb446fcd1b2fe9d85788b93dc02bd755c1bd8
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
1.0MB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
5.0MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
1.2MB
-
Filesize
56KB
-
Filesize
5.2MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
28KB
-
Filesize
5.0MB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB