Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 09:33
Behavioral task
behavioral1
Sample
d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe
Resource
win10v2004-20241007-en
General
-
Target
d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe
-
Size
1.5MB
-
MD5
f98b8d957e56a925bdfe1a9ed6182860
-
SHA1
c30bd13e13837e96f0affe38dc3603d978c20d91
-
SHA256
d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020be
-
SHA512
7766fe75347bca80d4754f1e7eebdafb134de91491e94f951b5a22ae27a62d7015f5c6c326aeb6ab65cd8f176e4f8ba355f11751b4685c5c1d60765526ed6111
-
SSDEEP
24576:ceaMajUi+6C+mDjn7gbkFaSH7Wu4mIWGE1Sy/fBEXTHhaTEEER71RM4I13:ceaj9bHmMbkBHVdGE1Sy/ujhaIh+1
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 39 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1800 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4528 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4776 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1680 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4780 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 544 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4520 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2156 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4104 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3276 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2996 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 776 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3760 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1500 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1832 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4932 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4488 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1672 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2484 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4404 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1396 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3576 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3772 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5088 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2312 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3596 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4828 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3504 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4836 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3264 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3964 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 940 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4860 940 schtasks.exe 86 -
resource yara_rule behavioral2/memory/2588-1-0x0000000000F50000-0x00000000010DE000-memory.dmp dcrat behavioral2/files/0x0007000000023cd5-29.dat dcrat behavioral2/files/0x000d000000023b8a-107.dat dcrat behavioral2/files/0x000d000000023b8d-118.dat dcrat behavioral2/files/0x0013000000023b8f-154.dat dcrat behavioral2/files/0x000a000000023cd5-202.dat dcrat behavioral2/files/0x000a000000023cd1-263.dat dcrat behavioral2/memory/4536-266-0x0000000000C70000-0x0000000000DFE000-memory.dmp dcrat -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe -
Executes dropped EXE 1 IoCs
pid Process 4536 MusNotification.exe -
Drops file in Program Files directory 26 IoCs
description ioc Process File created C:\Program Files\MSBuild\Microsoft\TextInputHost.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\unsecapp.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\MSBuild\Microsoft\TextInputHost.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\MusNotification.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\RCXE369.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\MSBuild\Microsoft\RCXE784.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\unsecapp.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\MusNotification.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\Windows Security\BrowserCore\en-US\aa97147c4c782d d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\MusNotification.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\aa97147c4c782d d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXDE54.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\MSBuild\Microsoft\RCXE7F2.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\RCXED84.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\f3b6ecef712a24 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\RCXED73.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCXEF89.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\RCXEFF7.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\29c1c3cc0f7685 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Program Files\MSBuild\Microsoft\22eafd247d37c3 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXDEC2.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\RCXE36A.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\en-US\MusNotification.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe -
Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\RCXD9BD.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\PLA\Rules\wininit.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\PLA\Rules\56085415360792 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\ja-JP\121e5b5079f7c0 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\PLA\Rules\RCXD798.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\RCXD9BC.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\addins\Idle.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\27d1bcfc3c54e0 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\addins\RCXD572.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\ja-JP\RCXDBD1.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\ja-JP\sysmon.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\addins\Idle.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\addins\6ccacd8608530f d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\addins\RCXD573.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\ja-JP\RCXDBD2.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File created C:\Windows\ja-JP\sysmon.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\PLA\Rules\RCXD788.tmp d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe File opened for modification C:\Windows\PLA\Rules\wininit.exe d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4404 schtasks.exe 2312 schtasks.exe 4632 schtasks.exe 4860 schtasks.exe 4104 schtasks.exe 1832 schtasks.exe 3576 schtasks.exe 4828 schtasks.exe 3068 schtasks.exe 1680 schtasks.exe 2276 schtasks.exe 776 schtasks.exe 1672 schtasks.exe 4776 schtasks.exe 2996 schtasks.exe 3276 schtasks.exe 1396 schtasks.exe 3596 schtasks.exe 3504 schtasks.exe 864 schtasks.exe 1800 schtasks.exe 2156 schtasks.exe 2484 schtasks.exe 3964 schtasks.exe 4520 schtasks.exe 3760 schtasks.exe 1500 schtasks.exe 4932 schtasks.exe 4488 schtasks.exe 4528 schtasks.exe 4780 schtasks.exe 1668 schtasks.exe 3772 schtasks.exe 5088 schtasks.exe 2108 schtasks.exe 4836 schtasks.exe 3264 schtasks.exe 3700 schtasks.exe 544 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe 4536 MusNotification.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe Token: SeDebugPrivilege 4536 MusNotification.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2588 wrote to memory of 4536 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 132 PID 2588 wrote to memory of 4536 2588 d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe 132 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe"C:\Users\Admin\AppData\Local\Temp\d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020beN.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Program Files (x86)\Mozilla Maintenance Service\MusNotification.exe"C:\Program Files (x86)\Mozilla Maintenance Service\MusNotification.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\addins\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\addins\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\Rules\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\PLA\Rules\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\PLA\Rules\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:544
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_64\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Windows\ja-JP\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\ja-JP\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Windows\ja-JP\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\microsoft shared\ClickToRun\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\MusNotification.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1832
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Users\Public\Videos\MusNotification.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\MusNotification.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\MusNotification.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\MusNotification.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\MusNotification.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Start Menu\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Start Menu\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Program Files\MSBuild\Microsoft\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\MusNotification.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotification" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\MusNotification.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "MusNotificationM" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\MusNotification.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD55a5d888dad4ad7c11d2418a9b49fc07a
SHA127bcc83f6e89b812cec6304f9fff2e6104780a7c
SHA25652a01842ca4b6ebfdea07cd68e8a1c3143b1c586cf1da088f4c8f8e9e8952107
SHA512da29f272eed4e95d493538415daf79a86dec6d9bf49488be72d3970e668156739b8bc68084cf8385edd77df90298cd9905599792d8200c3e2cb1adc1a8e50ce4
-
Filesize
1.5MB
MD5f98b8d957e56a925bdfe1a9ed6182860
SHA1c30bd13e13837e96f0affe38dc3603d978c20d91
SHA256d4a31dc5744b566f097f20ee18f55acedec23a55117c88e3cca8d65d8f4020be
SHA5127766fe75347bca80d4754f1e7eebdafb134de91491e94f951b5a22ae27a62d7015f5c6c326aeb6ab65cd8f176e4f8ba355f11751b4685c5c1d60765526ed6111
-
Filesize
1.5MB
MD59a8d73f96da5ec67c435557576556ded
SHA1136031c1898eaf57f0d2e12df05bc562625a04ba
SHA2569b3760a344c1fdaa20b3f3aa26596f52ab8a27f5600107454e31578dbd43770f
SHA512f195cfbdb7a5ec28a41f48255d138982297704d8e351ca1e29fb471cc63512560e0c8ca4a7a19a1e327c2bcc16456408c8ee0cafba7f1bd24634bfd7e8acfcd2
-
Filesize
1.5MB
MD5c0144e843a57f8eb7cd2b5f47ffdf67a
SHA1b1a3a9a76fe79e47e529cdf01caba194cf918891
SHA256d8c40ae54b5d0cbc8b0cc6a4a075ab89e83633aa0f68cc9060a1962f3d4d8f4a
SHA512ac063eadfd7015607faa5c28f791545459dcb80c8daa783f9add4eddca5695c5e06570f440a27862d06551871a09ea975a5f099d2654caf47e075033bd470362
-
Filesize
1.5MB
MD55f7175caa00fac1159bdabb703c38117
SHA134b4e240ac9bfa9e00713bdb65752c936d51a1ca
SHA25607ca05fc74303ece5ef3a03d180f1709fe55bee2199540ce1fdc0b30dca7ed66
SHA512ac2f18b96576aaa58b21320e017c2de1418d300a2c92e4f1b296d0c23caaca0848b626b7196107513a6248191d57a47b1b931ac2cdcbabed6b6b184c3463d937
-
Filesize
1.5MB
MD56eaabda1dcda8845de603fd9cc8c5632
SHA1b8f0835bb45cef4b5caf49598c7ec924dd914c30
SHA2561dda412314672b2eba97b9c33c9235ec1c84b8b9af96bad6579c4ef47b276b7c
SHA51261488b2ae20158d8ace21282600000111aab818a1b9230a5da1754e9870208cd34f157eceb4db467b4741db605af28b840e6a2ecad5db33d4eea4509bb972fc0