Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-10-2024 14:37
General
-
Target
67801c6458505230f9b814761cab327585213e9dd9d5f04777142bcb77c5b227N.exe
-
Size
4.9MB
-
MD5
a87a3e93eb8f7ee1a70c9b6204930910
-
SHA1
d5540d781ad24f6ebd68773fc6581a519d8c44a9
-
SHA256
67801c6458505230f9b814761cab327585213e9dd9d5f04777142bcb77c5b227
-
SHA512
d8c2ea8d31db9e5f96113057fd1a43d042ca7988081c8f31ba69aef10af91098eaaa6837504c91886452dba5f4c94ba9d6054375b6044409b1ccc1b74907e19d
-
SSDEEP
49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 45 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 51 IoCs
-
Checks whether UAC is enabled 1 TTPs 30 IoCs
-
Suspicious use of SetThreadContext 15 IoCs
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 59 IoCs
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 45 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\67801c6458505230f9b814761cab327585213e9dd9d5f04777142bcb77c5b227N.exe"C:\Users\Admin\AppData\Local\Temp\67801c6458505230f9b814761cab327585213e9dd9d5f04777142bcb77c5b227N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp9241.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9241.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9241.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9241.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9241.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9241.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7179f2dd-0ac8-4d87-8721-f09429153fc8.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a39951c6-c6f4-4022-816e-f179735c8377.vbs"5⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2c8c32c-dabe-4dc2-8ee4-bea03b5eb05d.vbs"7⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9deae5aa-9ed1-4f21-ba4c-5dcc77d2a2da.vbs"9⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cad7ea9a-b2f0-4549-b9d7-71a1bda2d36c.vbs"11⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ee28e5b0-38cb-477e-8005-39834d87bcf9.vbs"13⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fc396502-957a-4b2d-bf81-aa04a9705655.vbs"15⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27b3c8d2-5788-421a-9662-c56b3ef623ac.vbs"17⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69daae52-5de6-47d7-a9fe-d5249353e498.vbs"19⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cdd02e3-511b-4bf9-883b-9bfc00f08f3a.vbs"21⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1d95200d-690b-445c-b023-92e55382e989.vbs"23⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da8d59e2-853a-4046-be82-a333f6118d86.vbs"25⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\157c22f5-4cf9-4b68-bcf8-c3eac8073c10.vbs"27⤵
-
C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"C:\Program Files\Windows Photo Viewer\SppExtComObj.exe"28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b03c4b19-e130-40c7-9a53-c08847bd2384.vbs"29⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\943f2072-73ff-4333-b131-addcd335c5be.vbs"29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC7CB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC7CB.tmp.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpC7CB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC7CB.tmp.exe"30⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6e2d6304-d4bb-4fea-b6bd-516936a3a60a.vbs"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8478.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8478.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8478.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8478.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4022c84f-d540-48d9-ac44-14e489440eaf.vbs"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5569.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5569.tmp.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5569.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5569.tmp.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5569.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5569.tmp.exe"27⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cfe52dd-40ca-48fa-a7e7-92d474639a6f.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp37FE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp37FE.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp37FE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp37FE.tmp.exe"24⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e3f2e1eb-522b-460e-8584-c925f17f7f51.vbs"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8FF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8FF.tmp.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8FF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8FF.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8FF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8FF.tmp.exe"23⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0fe86f43-c77e-48d1-8801-5b834cc71c6b.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpEE05.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEE05.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpEE05.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEE05.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8c3493e-5774-4e43-bc3e-2d3341b0b1fc.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD220.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD220.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD220.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD220.tmp.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de9caece-f178-4d4c-9572-ce4f40de9049.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA16B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA16B.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA16B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA16B.tmp.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cae50746-6112-4b0a-896e-2b4d728955fb.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8548.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8548.tmp.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8548.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8548.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8548.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8548.tmp.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9de66cf1-398e-4883-9d3e-171b2e941472.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5530.tmp.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4f9647f-115a-4d4f-bedc-2dbf6e9cdccf.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp249A.tmp.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95eda992-2534-4950-858a-dc16bc42107a.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF433.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF433.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF433.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF433.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aec1c437-16b2-41aa-8062-65839cf323ab.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC36F.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d1d93f0c-0226-424a-a163-71ea356f09be.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA5A6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA5A6.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpA5A6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA5A6.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\dotnet\swidtag\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Program Files\dotnet\swidtag\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Photo Viewer\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Photo Viewer\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Windows\es-ES\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\es-ES\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Start Menu\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Start Menu\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5a87a3e93eb8f7ee1a70c9b6204930910
SHA1d5540d781ad24f6ebd68773fc6581a519d8c44a9
SHA25667801c6458505230f9b814761cab327585213e9dd9d5f04777142bcb77c5b227
SHA512d8c2ea8d31db9e5f96113057fd1a43d042ca7988081c8f31ba69aef10af91098eaaa6837504c91886452dba5f4c94ba9d6054375b6044409b1ccc1b74907e19d
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5a43e653ffb5ab07940f4bdd9cc8fade4
SHA1af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA51262a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
730B
MD5d11689662a48a196ba687b06c940fbeb
SHA150b6b4dc26aeb1253d17dee40de336e7b5622ca3
SHA256da5bc8af3f60026b03baeedea1472d80f4630d4989312e5fd83d4c64c197fca7
SHA51291212b468b83e8d84b72ce00891c8562159faf60149345db195e316f92667f8de4848bd6f85f5297b093a9cb95bd8ed2d57dbf870d19b103d40b6129011b6607
-
Filesize
730B
MD5f33706ed949fd94fbf8d01cf201dd1c4
SHA13b510c1f8d37cdc6cf277a75fdfafb9cfee87d7d
SHA256b6326bd36ef3eae4bb76bd7c3a200054089997661a60b0ac60d119680d5b774f
SHA51215ba10b7aa883d9bc3f1abf71af3990663e0a72f1c62940d1183b57a9593e4240b65ace09fc1c97dfc30ede4aa93c2d6befdcd6459a3556735158f3a53ddc5fb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
730B
MD5a694625ee6c2870f6716afb61eeb3a18
SHA1e81ba80bee25c9d88b329e62bd45512dce7b4e35
SHA2563c2bac81611437a5f0989f4d32376fa3fb7bf696cb487d7c213689413ad48420
SHA512122bb81399d20b2543062e6b2ff2666b145c17602f44bd431b3af7663b022bd7898b31643cf1c12519a216977c4cfb865ff592c2eef47bf886fced266a97127a
-
Filesize
730B
MD523efdf69e6a22a8b4dbf4f0c546ee2eb
SHA1f159d8ae604818b08f36735b77ed2d5b3721b75d
SHA2561e5432f341a6bd34fffa47be59a94e6c449b9400b0ec7f9625d58c416856abc8
SHA512dc3b3ff1a6ada158e83ea0d115025f98e3c0a28742a3aea1e850005fd3f6002ae70ba4d1a3aaf792d7710ad474e882dddf8c6deceb24d351804156ad2cb783b8
-
Filesize
730B
MD59f18bf1a9f032a5d7155569d7a796abc
SHA14428f768f1c7004d51d9324249a53d5beb38f226
SHA2567a05eb5094c2c3d0c6bf9b91aee3b91e26cd19c36c84efa3cedb3b85df867ec7
SHA5126d388f1a4ab219eff83649e089a61608d618257c75016ea1f58feceff4c1aaa2881a932b6c9c487c29fe3c2b3875e20799425b94486d05db3647a3db6dde38f2
-
Filesize
506B
MD52c4f47e95b42c4951c6b9c6dbce052b4
SHA15df37ca59e05e9f7849a6a533f94c01dae061b3a
SHA2564a4834eea5d49d4d7a0507fae9d2a102e5441b6d8cccaed459cb2f711d3e78ae
SHA512d1c1af7da2e3078c327573e7d85c2b4ddfbf2c4228c4cbad7fa0e9f270f4bc229b5e0a468b314a02563b1fa809de28210e13ec27830be15f59afa7d5031ab37e
-
Filesize
730B
MD5d12669047268725f53dd040bb5c54d59
SHA104535455b3edd13c5213799391d7d120961e33c7
SHA2565119cfbb651e9b52df5141707a0c491de0a6e9ebbb4dacfd06545e6c5f5e1814
SHA512d37182d9339815787ddb91cf615fe1fdd1fca568eae1f3be880868773d16c65052d3a53e8d71b089daaf3577e520d2f4c6f17cd7b8a509b9e691cdcc955d7058
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
112KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
5.2MB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
5.0MB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
1.2MB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
28KB
-
Filesize
136KB