Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
05/12/2024, 17:29
General
- Target 2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe
- Size 4.9MB
- Sample241205-v2ts8a1jaj
- SHA256 2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f
Score
10/10
Malware Config
Extracted
Family
-
colibri
Version
-
1.2.0
Botnet
-
Build1
C2
-
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
-
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
rc4.plain
Signatures
- Colibri Loader
A loader sold as MaaS first seen in August 2021.
- Colibri family
- DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Dcrat family
- Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass 3 TTPs 48 IoCs
- DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 52 IoCs
- Checks whether UAC is enabled 1 TTPs 32 IoCs
- Suspicious use of SetThreadContext 16 IoCs
- Drops file in Program Files directory 24 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 16 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 48 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe"C:\Users\Admin\AppData\Local\Temp\2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp859E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp859E.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp859E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp859E.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Public\Desktop\RuntimeBroker.exe"C:\Users\Public\Desktop\RuntimeBroker.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0e09ee33-d4f5-4491-8827-2811942ecea9.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\62c6d701-68ca-4c36-be3d-53ef851fbbcc.vbs"5⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30190e81-917b-4ed2-8809-3f6b303b6112.vbs"7⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb3f1302-6d6d-418c-97b7-777590c978f0.vbs"9⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dde11c61-a25a-4009-a1fc-2a09daf010b1.vbs"11⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b483b252-db5a-4d6b-bed7-77d4a5d1b4e4.vbs"13⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d0c28aba-5a00-4330-a506-bfc0b0751f35.vbs"15⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e314e197-03e6-4741-8204-42be50edf5cd.vbs"17⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ef5f5063-f1c9-4178-8c4c-b72433bf9e3a.vbs"19⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43fdd7a7-9a4a-408c-b78b-0e85ab0f291f.vbs"21⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e29013b0-3af3-45bb-bb63-611b69e7d4c4.vbs"23⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2b68382c-8512-45df-ac5c-692c00e581dc.vbs"25⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5041da45-2795-4f83-935a-172de4759007.vbs"27⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec96ff0c-bc0f-4ee7-a72a-3f2b3c672e54.vbs"29⤵
-
C:\Users\Public\Desktop\RuntimeBroker.exeC:\Users\Public\Desktop\RuntimeBroker.exe30⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be0a2d6e-b9d8-4fea-9012-bc6131da3cd9.vbs"31⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9cc37b28-e611-4fd4-8809-8e7e9464f575.vbs"31⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB898.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB898.tmp.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB898.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB898.tmp.exe"32⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB898.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB898.tmp.exe"33⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ee712fe-5d55-40a2-8a35-7666cf24e033.vbs"29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp8728.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8728.tmp.exe"29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp8728.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8728.tmp.exe"30⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be9fd81b-9eaf-4b8b-ba76-e22b224d6c56.vbs"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp6B33.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6B33.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp6B33.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp6B33.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44cdb564-59ac-49a3-ab04-fe9d71230a99.vbs"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4EF1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4EF1.tmp.exe"25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4EF1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4EF1.tmp.exe"26⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81f1ee43-eaaf-415c-9f4f-5a59a3ed8b2e.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp3195.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3195.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3195.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3195.tmp.exe"24⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eb81123a-39bf-4ce4-91aa-3b18f453fa70.vbs"21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA2.tmp.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA2.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA2.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA2.tmp.exe"23⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ff46cad-56a6-4ea1-bca4-62425a3e7f72.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD06A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD06A.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpD06A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD06A.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5fbb4b4-33cc-4f97-987a-f314c26b5def.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpB551.tmp.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\713f203f-599f-484c-a93f-20b20a9f5eb5.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp96DC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp96DC.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp96DC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp96DC.tmp.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\759bf957-bab6-43e2-979a-e807fd6352d5.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp79BF.tmp.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8500a9fc-cf36-406a-ae25-0dddfc3d03f0.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5D7D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5D7D.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5D7D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5D7D.tmp.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5D7D.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5D7D.tmp.exe"13⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f89a9d99-4195-47d3-b08d-7336be4ae971.vbs"9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71d46b16-9c21-4bb4-a10d-0725929736c5.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEA1.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\db085dc9-e659-45b1-b248-457edf20eb9e.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDE3A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDE3A.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpDE3A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDE3A.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d4920ac-cf40-4cdb-acdf-2457f010f56b.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpAC6C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAC6C.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpAC6C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpAC6C.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Videos\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Videos\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Videos\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\OneDrive\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\OneDrive\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\OneDrive\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f2" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f2" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\2103ddb95fd9d29dcf0f532ae9baa5593b7ed02d27682ec0b727e3e4d9061c8f.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Music\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0e09ee33-d4f5-4491-8827-2811942ecea9.vbs
30190e81-917b-4ed2-8809-3f6b303b6112.vbs
5d4920ac-cf40-4cdb-acdf-2457f010f56b.vbs
62c6d701-68ca-4c36-be3d-53ef851fbbcc.vbs
__PSScriptPolicyTest_opawlxnb.2gu.ps1
b483b252-db5a-4d6b-bed7-77d4a5d1b4e4.vbs
cb3f1302-6d6d-418c-97b7-777590c978f0.vbs
d0c28aba-5a00-4330-a506-bfc0b0751f35.vbs
dde11c61-a25a-4009-a1fc-2a09daf010b1.vbs
tmp859E.tmp.exe
spoolsv.exe
Idle.exe
memory/756-534-0x000000001BFF0000-0x000000001C002000-memory.dmp
memory/992-338-0x000000001D7F0000-0x000000001D802000-memory.dmp
memory/1472-290-0x000000001D140000-0x000000001D152000-memory.dmp
memory/1552-183-0x00000244EA140000-0x00000244EA162000-memory.dmp
memory/1972-551-0x000000001BFF0000-0x000000001C002000-memory.dmp
memory/3128-74-0x0000000000400000-0x0000000000407000-memory.dmp
memory/3680-10-0x000000001B760000-0x000000001B76A000-memory.dmp
memory/3680-12-0x000000001C4F0000-0x000000001CA18000-memory.dmp
memory/3680-18-0x000000001B960000-0x000000001B96C000-memory.dmp
memory/3680-17-0x000000001B950000-0x000000001B958000-memory.dmp
memory/3680-16-0x000000001B940000-0x000000001B948000-memory.dmp
memory/3680-14-0x000000001B920000-0x000000001B92E000-memory.dmp
memory/3680-15-0x000000001B930000-0x000000001B93E000-memory.dmp
memory/3680-9-0x000000001B750000-0x000000001B760000-memory.dmp
memory/3680-8-0x000000001B730000-0x000000001B746000-memory.dmp
memory/3680-11-0x000000001B900000-0x000000001B912000-memory.dmp
memory/3680-289-0x00007FFDBF310000-0x00007FFDBFDD1000-memory.dmp
memory/3680-0-0x00007FFDBF313000-0x00007FFDBF315000-memory.dmp
memory/3680-13-0x000000001B910000-0x000000001B91A000-memory.dmp
memory/3680-6-0x00000000011C0000-0x00000000011C8000-memory.dmp
memory/3680-7-0x000000001B720000-0x000000001B730000-memory.dmp
memory/3680-5-0x000000001B770000-0x000000001B7C0000-memory.dmp
memory/3680-4-0x000000001B700000-0x000000001B71C000-memory.dmp
memory/3680-2-0x00007FFDBF310000-0x00007FFDBFDD1000-memory.dmp
memory/3680-3-0x000000001B7D0000-0x000000001B8FE000-memory.dmp
memory/3680-255-0x00007FFDBF313000-0x00007FFDBF315000-memory.dmp
memory/3680-1-0x00000000004E0000-0x00000000009D4000-memory.dmp
memory/4088-498-0x000000001D6C0000-0x000000001D7C2000-memory.dmp
memory/4664-515-0x000000001D900000-0x000000001DA02000-memory.dmp