Analysis
-
max time kernel
118s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-11-2024 02:00
General
-
Target
ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe
-
Size
4.9MB
-
MD5
e971629e36a2f21bee6fe62b7a1f4b90
-
SHA1
43b66bb199d2d5aa4344a8f209578ded14d969fd
-
SHA256
ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373b
-
SHA512
70ae95e50548977ac1ceeaae65d0a80c911121aa7831bc0dc9edfa6d975feb11d0239966d2875c9dc238850220fa4d9f22ee45125ebc5f6a45a64befc0e9547b
-
SSDEEP
49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 36 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 39 IoCs
-
Checks whether UAC is enabled 1 TTPs 24 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 20 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 12 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe"C:\Users\Admin\AppData\Local\Temp\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp8957.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8957.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp8957.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8957.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp8957.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8957.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Recovery\WindowsRE\unsecapp.exe"C:\Recovery\WindowsRE\unsecapp.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1671f11b-a353-48e4-98e1-12316acd54c0.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e952921-6d3b-48b5-82ae-1bc6f6981bfd.vbs"5⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b8625d5a-4eab-4554-afd0-d2f0481653e2.vbs"7⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\532e351c-d86d-45b8-b3af-1c76125da60e.vbs"9⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\00813dd7-d2f0-4bef-8d6a-4fa5c6363c10.vbs"11⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c166adb4-5b5d-4cf1-b679-72500ddc354a.vbs"13⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d8b15891-2b3f-48a2-873a-687d00a92544.vbs"15⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\abec18bf-30a0-4058-b4ba-34fa951aab78.vbs"17⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d48512a5-41a7-4c67-83a5-0915fee88765.vbs"19⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\573c9a20-0539-441c-99e6-ea3f8e91fa2c.vbs"21⤵
-
C:\Recovery\WindowsRE\unsecapp.exeC:\Recovery\WindowsRE\unsecapp.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\daf625f1-0fb7-431e-9e36-eef04f4f89b3.vbs"23⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\42c5640e-6c7c-4f09-b441-638b67376d91.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp48B7.tmp.exe"26⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b960ef66-edee-4dd9-980b-ffbce46b771f.vbs"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1776.tmp.exe"22⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ab3ff048-f2c2-404a-b95a-ea0a8c6b75ce.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpFB43.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFB43.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFB43.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFB43.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29738704-2951-4222-b082-36d71b1bdef1.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpCBB7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCBB7.tmp.exe"17⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCBB7.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCBB7.tmp.exe"18⤵
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cd7653f-f49f-458c-98b0-8369f5b8eb16.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp9A57.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9A57.tmp.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp9A57.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9A57.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp9A57.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9A57.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54f89695-5437-4edb-9c38-03c4c04aa044.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6925.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6925.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6925.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6925.tmp.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f176bb3-4fe5-4d5b-91a6-0c5e0365ef3f.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp49C6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp49C6.tmp.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp49C6.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp49C6.tmp.exe"12⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\622b75e0-9305-42f8-b4b3-7ad697474add.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp18F2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp18F2.tmp.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp18F2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp18F2.tmp.exe"10⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7994054-0a5b-4dcf-9f28-f3718d7034f5.vbs"7⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0949787-3eb2-4a58-a6fe-d3cbc108bce3.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCC29.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a8c33f2-f733-4c7c-8718-abecfde83f37.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bNe" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bNe" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\MSBuild\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bNe" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bNe" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373bN.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Videos\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\Videos\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Videos\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD5e971629e36a2f21bee6fe62b7a1f4b90
SHA143b66bb199d2d5aa4344a8f209578ded14d969fd
SHA256ecfedbbe4065c1006af6e42d4fb8d2ca3795610bd6b01fc81a8e93694e62373b
SHA51270ae95e50548977ac1ceeaae65d0a80c911121aa7831bc0dc9edfa6d975feb11d0239966d2875c9dc238850220fa4d9f22ee45125ebc5f6a45a64befc0e9547b
-
Filesize
4.9MB
MD51bdf088f5f9b2b2670ac854b64488984
SHA1cd70a10974578190b98f2c83e1c65560d4165686
SHA2562a890d7e1609b28f52a044059d9c99ea017a51283be3d13558dd87a7eecb67ed
SHA51252bff88010ea99a6d5cbaef09cc0f9b650e317283df129e7cf139ca6d4c6b2e029c14cc8ffb4ec05b0cc51a0bf66870595912ebc7c67f7139fbc4f1f97e953b2
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
710B
MD51a421510ebc7a4775033b499e26abd07
SHA1a929574afd8cb0ee74aacb4dd93322e9b1aa2c75
SHA256f2ff9a742df25532afa888b180e36a3e1ce818409ce50215be7f7cac8f8ab2e6
SHA512fa437e82ff81016d975125f4a5ab4d2df8851548b045f442849fbbab174eac787dc7aa6c0e374bdcc3af1e3446b1a8ba452995ab059ce4270dbfca53ea5b61d8
-
Filesize
710B
MD59dcc1708abd82a3830954119ae1cdc77
SHA1cc38b876ac9358a8fd86adba61be3505a6a961dd
SHA256e6e32f26c13e34764d9d6e3f3e38264a5187f7fee1d4667f6bea3c176194da36
SHA512109f2f755b8a75af83922af1977a4bc649c431620d69626a7f05da5cc4ff22baa5ccf4e90f0e145e9fc6225441ec578d2b105bec73385ba0ebfbd1f1fddb4dec
-
Filesize
710B
MD58ea7c98b0f56574fa441493e0863a633
SHA152d6f755df1969d97bcbb2b57980318df71cba73
SHA2566dd11e3f83153b6fbfd42e006fff6589ae17448f9952fbc64c0b17dc9a073642
SHA512740bb83d15831b979a541c99c688797693cf58f239e619c8b3b3ea9e4ddda388f672757a3db56c62ba967a2aa87d71fd40250b2164ce57d4b77b432a45352271
-
Filesize
486B
MD56ce011241c4ad01c9763571069c6acd2
SHA183f77d15545bd72e729b4da208c57d845239e879
SHA256e3967325df1b3be999d65f207305f553a2810e52954710a61a7d8a23707e77ac
SHA512a6b44380c02f1aa1675f4d8cff5d081cc7b166daffbd5e1e165bbf36edfe23bbda9b9b420ebe51c036a40753d886ccbfaec5285c1fd100efac471f2e751e8cf1
-
Filesize
710B
MD5147e0c77b7dade7577b2b98fcd8e8265
SHA1b696f92b98add5e25d6ced7dae6793ee5d38467d
SHA256ffdfb1717d1bc80593154f7a56693e407560a5c7f8ff6e5bdb0d0bc1b9824c5c
SHA51227829a9a4c90c88f76b0c4f9bfc72b788e66af9d52ee877140de8d1b7b742971de1da84b76baa3c46da0e8ae8f6d0a518ebac1b44481486cf591656319ddceec
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
710B
MD5bc5fd3dc0e0d2c5e98ebe8b432a462b0
SHA1e898d94407eefd8607a91d748cbcbd0eabe862bf
SHA256f557a2d11a9fc525055d2013f0f0ee742879a64bf04929e53a4847cc82fb6195
SHA51204311977a740a94bcd6ff4fca81eedbb84949ffc1ff18d5355cc9acfae9d3553e335708a6725fa103ea13ac8ad444f5d263db1ff9ade5dd67ad46144991d050a
-
Filesize
710B
MD5355fe790119c7311bbd3af9df475d13f
SHA14ebcc78b66f5be3f4b8804d04999045440dc54b6
SHA25651cd8dec2cbb77152e64373244ec45798b4dd4e7b0f429a85e37b56ad591e912
SHA512f90b15063a75d6ac4ee65e109f15ed97095961ad288599fb871d44fa58797d0ad8dd69678b4a31674815f8555af6bb203a83bca7eac39eddf2d68894dfa05ba2
-
Filesize
710B
MD54349084f2ffedd73fe09fd7d7239ca0d
SHA13058e32cb5e3fa3c15909e182aa18e57625587b2
SHA256b251858e169484293fee9bcfade8a7cff70de9ca62c5f7ab8156221be0696576
SHA5125745e02fe5e8df2ff853ecac2427aa5a433679c601254af76251bc5c70bbe08290b7005fc58aa2246aef7b2d8fc5dd3ce6a08585206dba846bdd41f0abd6a48e
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
28KB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
5.0MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
320KB
-
Filesize
1.2MB
-
Filesize
10.8MB
-
Filesize
136KB