Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/11/2024, 14:24
General
- Target f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe
- Size 4.9MB
- Sample241107-rqrypstfqa
- SHA256 f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7
Score
10/10
Malware Config
Extracted
Family
-
colibri
Version
-
1.2.0
Botnet
-
Build1
C2
-
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
-
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
- Colibri Loader
A loader sold as MaaS first seen in August 2021.
- Colibri family
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 45 IoCs
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 48 IoCs
- Checks whether UAC is enabled 1 TTPs 30 IoCs
- Suspicious use of SetThreadContext 14 IoCs
- Drops file in Program Files directory 8 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 15 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 63 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 45 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe"C:\Users\Admin\AppData\Local\Temp\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp9DEA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9DEA.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9DEA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9DEA.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe"C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0c3bd12-2d18-4e63-a72d-08b7ee4d2308.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d87c757b-e45a-4203-8577-7fdce8f8e41f.vbs"5⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\90f77bc8-3559-4853-bb19-0885e37028a5.vbs"7⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72e1f226-7a7c-475d-9a93-58843b0e43fd.vbs"9⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9a689b54-fa45-4892-8010-0252cd727b73.vbs"11⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cad13250-1023-46ea-bc97-29e0f27c6a15.vbs"13⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c3aa53a4-0ba7-4c0f-ab3c-0cc566fecf43.vbs"15⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6dd0bc9a-6393-483e-b5f7-5f6e2de987a9.vbs"17⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f226ba3f-07af-4685-bb96-f351c849c722.vbs"19⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06a4408f-c782-4463-a302-e740e8dd045d.vbs"21⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eefd3110-53e7-4d16-93b6-e38447c7b785.vbs"23⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cdf400b8-5ad9-4006-9479-86e3cabeed46.vbs"25⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe4472da-34ed-42a4-8aed-f0009f2978e6.vbs"27⤵
-
C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exeC:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ffcda0e3-d414-4d56-89c4-ae2c53a46645.vbs"29⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d279a911-4fa7-474c-a3f4-d9b134716717.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82fffb21-5f6c-4044-ad91-e87b7bc131fb.vbs"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB2EB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB2EB.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB2EB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB2EB.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bd2cef72-2135-4cfb-a916-5bd4ab419de3.vbs"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp82B3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp82B3.tmp.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp82B3.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp82B3.tmp.exe"26⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\65e8f484-d41e-4b97-b36b-52efd8409957.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5366.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5366.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5366.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5366.tmp.exe"24⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5094daf1-df49-4f64-a169-03d855dcef41.vbs"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp233E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp233E.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp233E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp233E.tmp.exe"22⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\05ee2bb8-7c2d-4a1b-9180-f96524b3038c.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp759.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp759.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp759.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp759.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5807e629-9050-48d6-b7d7-b10cce1f2bbd.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD6F2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD6F2.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD6F2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD6F2.tmp.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\36ce3308-f891-405a-8e24-ee159613d320.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA6DA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA6DA.tmp.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA6DA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA6DA.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA6DA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA6DA.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\33afd8c7-7575-4461-8406-a9b59e636a8d.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7635.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f8d07d3-3f0b-4184-b546-270a53d551ac.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4580.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4580.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4580.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4580.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4580.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4580.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a34e477c-ebd4-4602-b80d-e4ede16462ae.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp293E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp293E.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp293E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp293E.tmp.exe"10⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20bd5a45-f45d-429b-b2ce-3470b7ce18c0.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF973.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF973.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF973.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF973.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7711ef7d-55c3-4aae-a958-f0d2cf69b64b.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD7F.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b2c07077-5480-41eb-8d15-7c4cc5d70803.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpBE00.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE00.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpBE00.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE00.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpBE00.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpBE00.tmp.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Fonts\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Fonts\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Cookies\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Cookies\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7f" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7f" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe
f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
72e1f226-7a7c-475d-9a93-58843b0e43fd.vbs
90f77bc8-3559-4853-bb19-0885e37028a5.vbs
9a689b54-fa45-4892-8010-0252cd727b73.vbs
__PSScriptPolicyTest_1ppxxbfi.nqg.ps1
b2c07077-5480-41eb-8d15-7c4cc5d70803.vbs
cad13250-1023-46ea-bc97-29e0f27c6a15.vbs
d87c757b-e45a-4203-8577-7fdce8f8e41f.vbs
e0c3bd12-2d18-4e63-a72d-08b7ee4d2308.vbs
tmp9DEA.tmp.exe
memory/112-322-0x000000001BC90000-0x000000001BCA2000-memory.dmp
memory/1932-392-0x000000001BA60000-0x000000001BA72000-memory.dmp
memory/3448-70-0x0000000000400000-0x0000000000407000-memory.dmp
memory/4132-292-0x0000000002C10000-0x0000000002C22000-memory.dmp
memory/4232-487-0x000000001BDF0000-0x000000001BE02000-memory.dmp
memory/4452-451-0x000000001B4B0000-0x000000001B4C2000-memory.dmp
memory/4580-165-0x0000016062780000-0x00000160627A2000-memory.dmp
memory/4604-14-0x000000001BE60000-0x000000001BE6E000-memory.dmp
memory/4604-7-0x00000000031C0000-0x00000000031D0000-memory.dmp
memory/4604-12-0x000000001CB70000-0x000000001D098000-memory.dmp
memory/4604-272-0x00007FF81A2E0000-0x00007FF81ADA1000-memory.dmp
memory/4604-11-0x000000001BE40000-0x000000001BE52000-memory.dmp
memory/4604-10-0x0000000003250000-0x000000000325A000-memory.dmp
memory/4604-5-0x0000000003200000-0x0000000003250000-memory.dmp
memory/4604-6-0x00000000031B0000-0x00000000031B8000-memory.dmp
memory/4604-18-0x000000001BEA0000-0x000000001BEAC000-memory.dmp
memory/4604-15-0x000000001BE70000-0x000000001BE7E000-memory.dmp
memory/4604-8-0x00000000031D0000-0x00000000031E6000-memory.dmp
memory/4604-0-0x00007FF81A2E3000-0x00007FF81A2E5000-memory.dmp
memory/4604-9-0x00000000031F0000-0x0000000003200000-memory.dmp
memory/4604-4-0x0000000003040000-0x000000000305C000-memory.dmp
memory/4604-3-0x000000001BF10000-0x000000001C03E000-memory.dmp
memory/4604-13-0x000000001BE50000-0x000000001BE5A000-memory.dmp
memory/4604-2-0x00007FF81A2E0000-0x00007FF81ADA1000-memory.dmp
memory/4604-1-0x0000000000B40000-0x0000000001034000-memory.dmp
memory/4604-16-0x000000001BE80000-0x000000001BE88000-memory.dmp
memory/4604-17-0x000000001BE90000-0x000000001BE98000-memory.dmp