Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24-11-2024 00:39
General
-
Target
b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a.exe
-
Size
4.9MB
-
MD5
a450c06717644483e3437db615ea4114
-
SHA1
93ece99062cee7344d7059986cc4727c92dbfca9
-
SHA256
b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a
-
SHA512
cb7d295f30fa69e98f52ac240e76ed9e776142a898a15c0a8911a693ccdcea441281a79c2b7f0e1e6567cc0bb73a9a6320c359a4a775b943fc84b78df6e42a24
-
SSDEEP
49152:Dl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8+:e
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 36 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 36 IoCs
-
Checks whether UAC is enabled 1 TTPs 24 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 12 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a.exe"C:\Users\Admin\AppData\Local\Temp\b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC97D.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Recovery\WindowsRE\dwm.exe"C:\Recovery\WindowsRE\dwm.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\da4cef27-218d-48db-893a-a4713930ed0a.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f164aae2-fd64-47fb-a8a3-5b56ece06f74.vbs"5⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e682f238-c660-4c97-a3c9-32b67418a067.vbs"7⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4535f9d-5017-42b1-95f7-a8b9effdc2c3.vbs"9⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abfc63f4-f30e-4630-8d98-985425c91807.vbs"11⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42857aee-e807-477b-939c-8859e32a5aa9.vbs"13⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\98d5c167-da9b-4266-9cae-c74c1840b68e.vbs"15⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3761a890-eaa6-4d54-af61-23fde9fdcfbc.vbs"17⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff37afd9-d75a-47d2-9a62-afd18befaabf.vbs"19⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3c581fa-1004-4c33-a985-dcdcd4862abf.vbs"21⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41062ffb-b70d-43b4-87fe-86127f45f6b4.vbs"23⤵
-
C:\Recovery\WindowsRE\dwm.exeC:\Recovery\WindowsRE\dwm.exe24⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\72ee8e35-23be-48fd-b786-ca471ba919df.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp674B.tmp.exe"24⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b467758-745b-4f83-8725-0dc21e29467e.vbs"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4ADA.tmp.exe"22⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f28c2f0e-87bd-438e-ade5-f88e9bde86d9.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8466ad8-97b6-4e1c-84a6-724662beb28f.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFBFF.tmp.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4e92c58f-9dd3-4d09-9dbf-4e3367ffd455.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCBA8.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9ceebe32-aa29-4aeb-a236-aff838452ad9.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAEB9.tmp.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2043775b-9ee5-4619-9919-1677013f9de8.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7E34.tmp.exe"12⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35fab6db-b684-4647-b872-06dea049bcba.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6201.tmp.exe"10⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e4395dec-2ab2-4d86-9195-4875a363085c.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3004.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8d24e6e-1460-4ae8-914e-5b567a02af09.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1279.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5ffec77-0447-4c7d-acd8-b82c3be3d0de.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDD8F.tmp.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\addins\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5a450c06717644483e3437db615ea4114
SHA193ece99062cee7344d7059986cc4727c92dbfca9
SHA256b8a3b35b685e72c1be24942f0520a286d5e65873aafb0f959ba551dae50ff94a
SHA512cb7d295f30fa69e98f52ac240e76ed9e776142a898a15c0a8911a693ccdcea441281a79c2b7f0e1e6567cc0bb73a9a6320c359a4a775b943fc84b78df6e42a24
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
705B
MD5f7809dcc24aa019d39341ac901e07a76
SHA14ce4fc1bff95bd62ddba1aa575bf5134b86c95ff
SHA2561c6af3bdf964021c76dfce7ac8f29b542449a36914d64b60e0a371a52e904ecf
SHA51249e7d5e29195431041bc3a36e5bf260ad503b69feee4a2cb3b42798fbedcd8fd10e5db38816c1dd7e64abb0bad0096a654b6edf697829e35ccb8920fb9d60c93
-
Filesize
704B
MD59e90a5648fbf1c98833b29065f152d15
SHA12ee021a3dbc5dc2bd61441ec5880a46ef67c1f60
SHA256d7b87371008eb04393ec03fc445cf68281232c236ea5efcb7d6b1d7055fe3817
SHA512e268153410c4ebe6c6a00c4af15f02d117411e47e8a02e68c961fd33f66e5405a89e4350c32cc353ebecbee0bda066ab20a9becb4ba07bf0a4ddd9bc1a47f066
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
705B
MD514c3c862a3bcb16c79a6d7bd9431a50f
SHA1faec24a971b40044388c4964b9aeeeae8e2f4dac
SHA25603d4db47117b335d102ba1a651ca4a04c280675cb018ae5593d27eb820182d94
SHA5124c77ccd99e47697cbea37aff19fac752d5661405a38f5fa18a9bdc55a37dc234d34c3caf534d4991e6585854df2921fee3353fd08cd045f30ed92813b980b264
-
Filesize
704B
MD50388ef0af8f4568756e600c3fa50e990
SHA1b6fdaee3f4c933f9117305292137ff302b013175
SHA256cc8bdbdc8ea0addaf717a62083831ac5671fe84d4ed958315e42d417e7f3daea
SHA5129f05c7593cd2ae07c197e9e7e44c516ee3f7cbc6f8614cb34c4a4898c15585ded43efdd1538befee1f0ed37eff25f613165ca75cca56281a00e8a85ef3281aa0
-
Filesize
704B
MD5502178fae6ea4345983f055976b0c87b
SHA18b90d67eebaef68148038fb00c374518776291fe
SHA2562908bc75e12090c3616d7b5099a22022377983ab5ad5b7bd4a95a7caa00149d2
SHA5127e735a9bd5f956011be5cbba4a241aac270ece6ca92daa8ff98deb1c3b7ca0a83231b7242f323d8167288ec87492c9a36e00a94ac521212e3e4e73dd73c4dea8
-
Filesize
481B
MD5720b210bd578c4ad17eff83e2c112e2b
SHA1a599a63b297f2cd8ebf2f59bba4a3d617a0e22d1
SHA256246f5cdf2cb389f21b1ceabda077343bbc8d66149a83de3f3c458d5a19a2dfb4
SHA5122faf0abdd13273672ded3b07a936d198104cc8e21c37561edb60fb45572f340b062030853e8c6fd4ee1e4f1eac0f8e9fac86f2e117ca2ceccf934f7d0a65c954
-
Filesize
705B
MD57dc0d22094baa712a33b4225699a7ca1
SHA12107139e189abcb5a1d284418e1211086a0d9077
SHA25621db8b93f4c4fd66da6ef2d6bd412c6efcfbf7358ec052dbc1b2d21899470ef1
SHA512c028e5ea240a1f3a521a0a552cd795422efa1e622be66cfca5ba7aeb24a06ad66afeedd890da0c58808dc2bbb890a957b30a9d6389d4de50bb7c6e08112a76eb
-
Filesize
705B
MD5addb2dab2c06e572228238d9d43e9a2e
SHA13806a720ffff1b1792a2ca3840cade725a63c362
SHA25605cf326a307ae13f0e98e1dccea661d6693b5dbb44a2e8e5404d66e112b7bc41
SHA5122fddb1650a8d43270026fba234ec9e61f02d5647292d1d09a09b2dab38fbf6557464f9c46fcb783ded23226c3f582c58e956cfce66d67165d6061d6c65701956
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
28KB
-
Filesize
136KB
-
Filesize
5.2MB
-
Filesize
88KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
5.0MB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
1.2MB
-
Filesize
10.8MB
-
Filesize
72KB