Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-11-2024 04:12
General
-
Target
f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe
-
Size
4.9MB
-
MD5
06f186fc55f38b20a7273da22fe0007a
-
SHA1
3eae6dd2aec4dcd82864b9fbe446e85ea603784b
-
SHA256
f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7
-
SHA512
05ea938925775b835e347265e255372c0c2deee1d68b356836c85b93f5751fced8ca8d758ebdc745c0274c53c9c350e63cc2a8624b99aa345438b2963b2a1f37
-
SSDEEP
49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 45 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 48 IoCs
-
Checks whether UAC is enabled 1 TTPs 30 IoCs
-
Suspicious use of SetThreadContext 14 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 45 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe"C:\Users\Admin\AppData\Local\Temp\f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Xwyb0BsBsO.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Recovery\WindowsRE\Idle.exe"C:\Recovery\WindowsRE\Idle.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5830075c-0507-443d-a276-4d9514600d8b.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\57443aad-d8fc-4c7d-8a0b-8b36f00c7694.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7dc509dc-3186-49a7-ae0a-7305eadbac67.vbs"8⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2a25cc03-ff10-45a8-98c4-9b76f3dd7427.vbs"10⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\80474a23-eb1c-4499-8a10-753c0477db1e.vbs"12⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b9ac389-bbe2-44d6-be13-b6d6eda30379.vbs"14⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39a49aa0-d473-4350-bf78-e04025022f8a.vbs"16⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cd369ba0-8673-43e1-a2e3-11e5c5f8bd65.vbs"18⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76239330-6d35-423c-b909-6da3b6c81b79.vbs"20⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b7c5aeb-b984-4e9e-b894-fddc34fafc71.vbs"22⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95f96e06-f50e-4dec-b591-a042c3a9fc6e.vbs"24⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe25⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3f9480c7-78d2-4e37-af91-e729ad9ec079.vbs"26⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe27⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f3fbde14-11fd-40a6-b299-1d80909437e1.vbs"28⤵
-
C:\Recovery\WindowsRE\Idle.exeC:\Recovery\WindowsRE\Idle.exe29⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\499558e6-6bc0-49c7-9f16-8b408a020876.vbs"30⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\229fa1d6-f149-45af-a43b-694b6cc94c96.vbs"30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpCD0A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCD0A.tmp.exe"30⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCD0A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCD0A.tmp.exe"31⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82bbc7eb-08ae-4f9a-8533-b843d5f20df6.vbs"28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB126.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB126.tmp.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB126.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB126.tmp.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB126.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB126.tmp.exe"30⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a47db060-a831-4f58-bd56-2080e2a500eb.vbs"26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"28⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp811D.tmp.exe"29⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58167827-61e6-4aa1-a995-6f6842600f68.vbs"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp64CB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp64CB.tmp.exe"24⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp64CB.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp64CB.tmp.exe"25⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\afcbba59-9f45-447c-8ac7-b41dd6e7f9aa.vbs"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2159.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2159.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2159.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2159.tmp.exe"23⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4607f17e-891a-448c-a143-0f6d138854f6.vbs"20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpF112.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF112.tmp.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpF112.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF112.tmp.exe"21⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0258e453-952f-4246-9281-1abb6f4676e0.vbs"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD58B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD58B.tmp.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD58B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD58B.tmp.exe"19⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b10c979-3f83-49ab-8757-cbcab9d5fba9.vbs"16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA505.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA505.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA505.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA505.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff72fc72-bbf7-4569-8afe-a2ddcf821ccd.vbs"14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp751B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp751B.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp751B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp751B.tmp.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38540769-2dbc-4dfa-a170-73a04a033b6f.vbs"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5762.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5762.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5762.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5762.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9374e067-1a99-49cf-ab1b-0efad2d72a5c.vbs"10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp274A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp274A.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp274A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp274A.tmp.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bda288c4-4c6f-4f6b-a7ee-9e68e838d4d8.vbs"8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB07.tmp.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d063032-ada2-4942-8580-06fa90ea871b.vbs"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEDAC.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18d6a13b-a1f4-430f-9dd4-ea9e3e888ea9.vbs"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD15A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD15A.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpD15A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD15A.tmp.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD506f186fc55f38b20a7273da22fe0007a
SHA13eae6dd2aec4dcd82864b9fbe446e85ea603784b
SHA256f0e26d840e7cb41461066f723eb501e4444764f66d3712ea877c456dbcedc4f7
SHA51205ea938925775b835e347265e255372c0c2deee1d68b356836c85b93f5751fced8ca8d758ebdc745c0274c53c9c350e63cc2a8624b99aa345438b2963b2a1f37
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
482B
MD511f1172fac2a38230e1feb5b2845a843
SHA150ad29dacca77151b239c8e73abd3a74e35fb237
SHA25656cd20337bbbeefdf49bb162f2b09f96a6ced9cee2182477ea31b80d54d01a35
SHA512a06da5d6f7e90034f6e01b0a3f09bda175800d60eabbd9ca5570fca0aead2b849bb96482ac37053cf8f605f2e68398ea86aea0b0be267db2ce8a9180e2d00f1b
-
Filesize
706B
MD54e0d42fd0de304e9837d1e27c9805ff4
SHA1d13498af3ce14d12be5c9e29cd38578f05efe10a
SHA256aa97b53be479cd5b2b29a3121e5f583cc908415cdc4ec9c04911274b727f8214
SHA5126df35b7c7ef46591aa0df2c4654510bf0a1f45dc8f37b47c8dec08cdfb33495d41b4b3b8c3881a6322d27f66e3fc4370afbb417cc1fdda1a10b497dfc39ad486
-
Filesize
706B
MD5738af3fdb403c0698a8e41c358d058c1
SHA19d3b0334a34230f120cb85a45d0b384da73b58d0
SHA256d16ec8efa5cdcec149c0e5d38d45229f9b90782064dd10985b51b7256999a2e4
SHA512a753581421eea8ce43d19f82779611a460fb19f6e29239f0999e715996e69a1d9edbf6155965f66c8f9a65e197b7c3c2e1ea8faf912e1c7acb6b143fbfa10e92
-
Filesize
706B
MD5be5f330cf1fd2f75ada9ddc457e641a3
SHA16394ffed8a9459de1457d7ca22838c31cc14960b
SHA256371aae9a43bab3c66c656f7eadba459efd054ed57e93d480cbf5c9c7cb75b8e4
SHA51226bea1c337d87dc28350c73b6ebee49593ed7ded4abd31d2b0a06dde6a846a95201b6e2832a9ac7c3ddfeacc2bb3c825d85867a7f544db20f3588d978320123a
-
Filesize
706B
MD58dc3e262f6e8febea73ff164f89116ab
SHA1975ab7c5031f12d851d27db9a4e1b5dc627f8b41
SHA2566ef7a8a12851dd44f0ca6c693f26e486c45356dc55a56be9cb144b5500b79fa3
SHA512d0fe8fd4d4c10d0e1b9ffb284860f036c4a78f09a48f16e9b2d7a6b0892bef4abcc677f9559a8507d1ba888d375a94c26ce94c5de9291ff66bbd4260379db2b4
-
Filesize
706B
MD5e5593d9f28739ad91aeb7570481fc883
SHA1519d3fc8238b37b446bc4327cfd73d9cc6c47efc
SHA256e8454455d8eabcd1cfafdfcceb06a53c635b9c070eb49658db51854dd1c68202
SHA512eb95140cd4e62af98ef2a5fca08aeb4a010b6d39ed72ffa75f45349cf1e62a80cd25a7f79f77047ee17423bd8126e616eb201aa1796e47c14c10c6a92d89b4a0
-
Filesize
706B
MD5ce9ce001a7898cab7bf1910aeaf878a4
SHA180121ddd04a7913214585304c0df4f48d4bb3928
SHA25637d41152587734ce19a6537c76cfd1119495c40e21e6935ba09fa90c63371d90
SHA512929891702c4759ef124d60c80a13aa37d2bb90cfbea6919333f5fa14a4a2a2b678dc91b1305ebbf5967ad898255c41a56ee3baaa970784241fb0749cb9e58f0e
-
Filesize
706B
MD57d1a76a4bae013f67815695335c321c0
SHA1da33d892c9c925c02c76c4326cfd93c47041fa2c
SHA256518d079417c41e271285764de6aaecb52737061490a652d0ffdecf31c75ac09e
SHA512a1c6fe879c7e4c5bd5cc075a469fa80b9bb0f69d09733f999a7fbf27a5c5204281b1876a9c89cf6f5c8e3806a450ac3f033128235b407e1aaf57527f01188873
-
Filesize
195B
MD5e62dcd2208bd9e3b53825eef6c7ae32f
SHA16d8882549276212c4fe179808927c2f3caba3656
SHA256cbb30913ef8aa809add3cbd8abb4d4aac507e3a79baafadce8475907bb835232
SHA51235eb28ac347a319723bd96d56d317facc621698d7d01775735049d6822432af11253a96a627b51f126c740a3f3477959f8272888b845e7e2e1c605490e329c39
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
320KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
112KB
-
Filesize
8KB
-
Filesize
56KB
-
Filesize
1.2MB
-
Filesize
56KB
-
Filesize
5.0MB
-
Filesize
10.8MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
136KB