Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 02:46
Behavioral task
behavioral1
Sample
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe
Resource
win10v2004-20241007-en
General
-
Target
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe
-
Size
1.1MB
-
MD5
119ede06afc1b721278e8955fe8338f4
-
SHA1
3917c6cfd13689a83e8410c157f54c0e05550bcf
-
SHA256
ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0
-
SHA512
72193ded81941ecef91da566d47e22667e98d927a18cbe06be3e4cbea6c1504664a7569fd9531ddbf1b4b019a953e53deb8da34938d1b879b4d74902eff3be78
-
SSDEEP
24576:AMYPCI+q+U4cIG409ozWucypk1Nd4AX+iB/YjuM6kyh+:ABPZ0Kr1FXHB/guM6k+
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\", \"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\", \"C:\\Program Files (x86)\\Google\\Update\\csrss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\", \"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\", \"C:\\Program Files (x86)\\Google\\Update\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\OSPPSVC.exe\", \"C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\smss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\", \"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\", \"C:\\Program Files (x86)\\Google\\Update\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\OSPPSVC.exe\", \"C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\smss.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\spoolsv.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\", \"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\", \"C:\\Program Files (x86)\\Google\\Update\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\OSPPSVC.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\", \"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\", \"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\sppsvc.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\", \"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\", \"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\", \"C:\\Windows\\System32\\0C0A\\dllhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\", \"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\", \"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\", \"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\", \"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\", \"C:\\Program Files (x86)\\Google\\Update\\csrss.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\OSPPSVC.exe\", \"C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\smss.exe\", \"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\spoolsv.exe\", \"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\dwm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
resource yara_rule behavioral1/memory/1544-50-0x0000000001330000-0x000000000145E000-memory.dmp dcrat behavioral1/files/0x000900000001746f-49.dat dcrat behavioral1/memory/2932-1-0x0000000000260000-0x000000000038E000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 1544 System.exe -
Adds Run key to start application 2 TTPs 36 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\smss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Google\\Update\\csrss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\OSPPSVC.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\spoolsv.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\Vss\\Writers\\System\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\spoolsv.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\dwm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files (x86)\\Microsoft Office\\Document Themes 14\\Theme Fonts\\System.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0 = "\"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\dwm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files\\Microsoft Games\\Mahjong\\es-ES\\audiodg.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0 = "\"C:\\Program Files\\Windows NT\\Accessories\\en-US\\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Google\\Update\\csrss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default User\\sppsvc.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\Pictures\\Sample Pictures\\lsass.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\0C0A\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\0C0A\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\services.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Google\\Temp\\lsm.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\OSPPSVC.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OSPPSVC = "\"C:\\Users\\All Users\\Microsoft Help\\OSPPSVC.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\smss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\inf\\ServiceModelEndpoint 3.0.0.0\\0000\\smss.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\dllhost.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\f6a14ac2-8725-11ef-a9ab-dab21757c799\\winlogon.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Default User\\sppsvc.exe\"" ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\0C0A\dllhost.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Windows\System32\0C0A\5940a34987c991 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\101b941d020240 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\Windows NT\Accessories\en-US\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\1610b97d3ab4a7 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\dwm.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\27d1bcfc3c54e0 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\69ddcba757bf72 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\Windows NT\Accessories\en-US\b6768d31d2a420 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Google\Update\886983d96e3d3e ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\6cb0b6c459d5d3 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\audiodg.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files\Microsoft Games\Mahjong\es-ES\42af1c969fbb7b ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Google\Update\csrss.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Program Files (x86)\Google\Temp\lsm.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Vss\Writers\System\dllhost.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Windows\Vss\Writers\System\5940a34987c991 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\smss.exe ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe File created C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\69ddcba757bf72 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1620 schtasks.exe 2808 schtasks.exe 1192 schtasks.exe 1732 schtasks.exe 772 schtasks.exe 2464 schtasks.exe 2060 schtasks.exe 1748 schtasks.exe 2288 schtasks.exe 1252 schtasks.exe 1764 schtasks.exe 1988 schtasks.exe 2428 schtasks.exe 1600 schtasks.exe 1428 schtasks.exe 2264 schtasks.exe 272 schtasks.exe 2284 schtasks.exe 1568 schtasks.exe 1960 schtasks.exe 2688 schtasks.exe 620 schtasks.exe 3020 schtasks.exe 1696 schtasks.exe 1908 schtasks.exe 2484 schtasks.exe 2652 schtasks.exe 1996 schtasks.exe 2516 schtasks.exe 2132 schtasks.exe 2984 schtasks.exe 912 schtasks.exe 604 schtasks.exe 2120 schtasks.exe 2268 schtasks.exe 3008 schtasks.exe 1856 schtasks.exe 2424 schtasks.exe 2972 schtasks.exe 2164 schtasks.exe 2560 schtasks.exe 2020 schtasks.exe 2612 schtasks.exe 844 schtasks.exe 1476 schtasks.exe 988 schtasks.exe 2196 schtasks.exe 1256 schtasks.exe 1884 schtasks.exe 1108 schtasks.exe 1808 schtasks.exe 484 schtasks.exe 2816 schtasks.exe 3064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 1544 System.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe Token: SeDebugPrivilege 1544 System.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1544 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 85 PID 2932 wrote to memory of 1544 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 85 PID 2932 wrote to memory of 1544 2932 ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe"C:\Users\Admin\AppData\Local\Temp\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe"C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\sppsvc.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsass.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\lsass.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\Sample Pictures\lsass.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\System.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\System32\0C0A\dllhost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\0C0A\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\System32\0C0A\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2972
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:3020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\winlogon.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\winlogon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\winlogon.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\lsm.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\lsm.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Temp\lsm.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\smss.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Games\Mahjong\es-ES\audiodg.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Microsoft Games\Mahjong\es-ES\audiodg.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Games\Mahjong\es-ES\audiodg.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Vss\Writers\System\dllhost.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Vss\Writers\System\dllhost.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0a" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\en-US\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0a" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\en-US\ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Google\Update\csrss.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2132
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\smss.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\smss.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0000\smss.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\spoolsv.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\spoolsv.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\spoolsv.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\dwm.exe'" /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\dwm.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:912
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\dwm.exe'" /rl HIGHEST /f1⤵
- Scheduled Task/Job: Scheduled Task
PID:1696
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5119ede06afc1b721278e8955fe8338f4
SHA13917c6cfd13689a83e8410c157f54c0e05550bcf
SHA256ad4072aa43c0fcac0cc0c5f86147c93fb16707a547d7760407a02be06bf9d8f0
SHA51272193ded81941ecef91da566d47e22667e98d927a18cbe06be3e4cbea6c1504664a7569fd9531ddbf1b4b019a953e53deb8da34938d1b879b4d74902eff3be78