Analysis
-
max time kernel
118s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-12-2024 20:34
General
-
Target
0401226a7fb3c2d913e0ecd8dcc8d19a04979ee1414c30042215f24c9fc43656N.exe
-
Size
4.9MB
-
MD5
094c63e5d39cc0d204e4cc47398dffb0
-
SHA1
a33098a3e39361f7f2a405a45c29234b1b17d55a
-
SHA256
0401226a7fb3c2d913e0ecd8dcc8d19a04979ee1414c30042215f24c9fc43656
-
SHA512
7541e961fbd5b28b72519484c177181ff3c6f37d01b1664bc547d1f956f2808bfb09e9d288d0f9fe354eb91ac17b64fcf414f73fe98897e2323f8dbf0453a0e2
-
SSDEEP
49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 36 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 37 IoCs
-
Checks whether UAC is enabled 1 TTPs 24 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 12 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0401226a7fb3c2d913e0ecd8dcc8d19a04979ee1414c30042215f24c9fc43656N.exe"C:\Users\Admin\AppData\Local\Temp\0401226a7fb3c2d913e0ecd8dcc8d19a04979ee1414c30042215f24c9fc43656N.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp956C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp956C.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp956C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp956C.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HmrlOhE6lA.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Recovery\WindowsRE\upfc.exe"C:\Recovery\WindowsRE\upfc.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97f5521f-088a-441b-9d83-7a248c04f3b1.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\beb62e8d-8279-482b-b644-9ebef9b7356f.vbs"6⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cf4d1b7f-f21a-4aaa-a106-016278271d7d.vbs"8⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe9⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c928b318-5121-45c8-8725-c80b9b9d8498.vbs"10⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe11⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\225673c4-c621-4f54-aba4-de909e10c798.vbs"12⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe13⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1bc64945-09f6-4e22-ac3b-4afe4395fe9f.vbs"14⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe15⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6fee9135-71ee-4f55-b9da-9f86002cec14.vbs"16⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe17⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6644d5a5-4f84-4835-92ac-50bf6439d7ed.vbs"18⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe19⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f849ce9-aa93-4a51-aa3e-6027a962d677.vbs"20⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe21⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17bc55d2-efb7-4f78-9a2c-9e2bd453c543.vbs"22⤵
-
C:\Recovery\WindowsRE\upfc.exeC:\Recovery\WindowsRE\upfc.exe23⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\19d89cf6-b783-4866-a70d-426aee484dfc.vbs"24⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fe2fc33a-e04a-4c06-8bbc-99d4f625f7e3.vbs"24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5922.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5922.tmp.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp5922.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5922.tmp.exe"25⤵
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41ede7a3-f51d-45c0-b905-e38bc85f35e7.vbs"22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp3733.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3733.tmp.exe"22⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3733.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3733.tmp.exe"23⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c5df9416-bfea-4ccc-86e8-31c7d9b57480.vbs"20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp19C8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp19C8.tmp.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp19C8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp19C8.tmp.exe"21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp19C8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp19C8.tmp.exe"22⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de0154c1-adc3-4744-8496-a2e0bdecf0ab.vbs"18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFC9B.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7be3dc8-160d-4019-b45e-8b4ae1e996ba.vbs"16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpDA9C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDA9C.tmp.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpDA9C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDA9C.tmp.exe"17⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\400ee2a4-61e0-4f1b-9190-9b8a9745c230.vbs"14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpA709.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA709.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpA709.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpA709.tmp.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8cae1164-be0a-451d-b885-57c4d5da2960.vbs"12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp7162.tmp.exe"15⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb774964-6d16-4d03-b0ce-38081cea0438.vbs"10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4FC1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4FC1.tmp.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4FC1.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4FC1.tmp.exe"11⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6ccc521b-6ee8-49cc-9e11-71f5c44f192e.vbs"8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp1D18.tmp.exe"9⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7193bb5-a42d-4060-b4f5-57a1def27c64.vbs"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpE81E.tmp.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f5924270-f38e-4ce9-a997-278cc243eb0f.vbs"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC8DE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC8DE.tmp.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpC8DE.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC8DE.tmp.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\root\loc\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\loc\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\root\loc\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Users\Default\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\Default\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Windows\bcastdvr\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\bcastdvr\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\bcastdvr\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
706B
MD5143550701002a72b97f06f8508e5c834
SHA13806bea196f5d8efc0c49875e73b7b2797a5c551
SHA256b1704d644db566cfa5a7eba20f521b92216ef62d5d40d15f9c7eec60c751ce5b
SHA5123690bb38999c48aae001e7d3ce0b0fa19c832a89e03969423e3cfc1d7bd79d2877f789ea9cef4bb7f3f24b8220a075565e7a95f6f2ed5196121f959cf4cc6dde
-
Filesize
706B
MD5089b80cfe46ad4e6e0833f448e091fa0
SHA1e0ffbeba404b639b2810c126812ef31a439cd974
SHA256fe31738c7fcca7748222e48fb3924eee9e69d9bdd8f1cd931ae1dedee842d6d3
SHA5126e2c6d0b172166c1ff607a4a866356be097af323e1501c8e89ae6b499fe143227d7102cc82fb397dddd9a3dc474347990e927ae027fb442e81848c82328d33ff
-
Filesize
706B
MD5243e1b74346e5eb073e40ce89d17a721
SHA13f9073069a740cc17db253a0ebcda50a9eb06089
SHA256ed0a7dc9aaa05bba61567ba907fce7983c8cd35c8b4c09f39dadb4db7db5309d
SHA51245266a5bb98cd15eb5dd811f417e5304d3c88a5b55567e26be8adc25db316e67bbf8cbc5290d1216c9a07d7e4a74902d6ac88543ecdd5decce9adde34f0c5921
-
Filesize
706B
MD587096ede6ed14391051be7da01de27d9
SHA15c0bd9ce33dae9eb92ccff5faacbb4548ca46c75
SHA2563a127c453b4890ed24cdb697f4af935c8bba3e8f3faa2a0cfa2381d9e78ebc51
SHA51296fb867f723f894ee6907abd85728ead7c5e83eac7e9bc74d3e8a31e0d959fc606f14bccc5cd28856eccdf3865d3940564a2534234be99a61680cd67addc0297
-
Filesize
195B
MD5cf68043fe4c3711f2b5cc184dc3a3f5f
SHA1dcbbb5e9c53fe1a46ec6023a48266a4e58451135
SHA256ee963be04bab3c22b9f9e4738bd1b22be2610b3187092df8e93bd02b59e81eb1
SHA512d6862a315bcf1a81a720683c69b2939ec42d6e86590b641c0739cc99803246179dfa0334660db8c926adac675e9c9e3c9c7f1c418387a9d2c736a6fa9b1b7629
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
706B
MD5b3c587954e6b7f343ef66e47ec68d4d1
SHA1b8b991840ceb21f63c2d83174e08193e94206510
SHA256527b15d1c4fd13299df305652a4aa2c42ca1c4df2e3ddbd80fc4d9c213298b65
SHA512616258e8074f50e74c313378987446a28fcf21a8275f405166c91db461fe41f9ba3f3464fd86b791c30b0798bd6b7f2dfa24cc251f7bb54fbd4e16ab9605040c
-
Filesize
706B
MD5854f77a87db2397e59b9887106a9541e
SHA19f81e060b23fd05fcec00ac85d55faaaab79187e
SHA25666319c3fedd54ae7f5a6f0ade9b90ed29e0c53b6d0ccbdbfd2785fcfd97e3ad0
SHA512f1123357ebe09025f0951cd4190e546728604981dca853634caa1e8d2e8debca7e2b15cdb08531f77f8e57e8a97029ab6eb85961756f774d7c1b65be054b37d2
-
Filesize
706B
MD50d2ac40b8cf3b339ad416e0b011ff7d6
SHA131f75c759d3b3e1018e5962da6a95eff976d8e93
SHA25634d33c4e14d59a125ed569dfdd957e7f60576c214b221954061ee5f25391068d
SHA5125e5a6b598bacb3f87f414fa3e01a0779528cbc3b3053774ab1721fae8a52bc5750936b8dcb35e546cc15caaa54caeaefa08e60ece653e6c8299aa224b7c313a8
-
Filesize
482B
MD58a900b907913e4f950e86531a1a95122
SHA11a9d465a184c16d31f818528ed295749becce985
SHA256058949ffcf592d4c91bc0bd704294d07165390999a8563dff2548101ee09cfe8
SHA51293936b456ee06e869145ef2f892355cc95653346ca456f6eb5b48323e56857a04c74e3163f49f85a0794cba62971cded79d0a8be9859e8af6248e7a0476dbfb5
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
4.9MB
MD5094c63e5d39cc0d204e4cc47398dffb0
SHA1a33098a3e39361f7f2a405a45c29234b1b17d55a
SHA2560401226a7fb3c2d913e0ecd8dcc8d19a04979ee1414c30042215f24c9fc43656
SHA5127541e961fbd5b28b72519484c177181ff3c6f37d01b1664bc547d1f956f2808bfb09e9d288d0f9fe354eb91ac17b64fcf414f73fe98897e2323f8dbf0453a0e2
-
Filesize
72KB
-
Filesize
88KB
-
Filesize
5.0MB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
5.2MB
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
1.2MB
-
Filesize
32KB
-
Filesize
112KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
28KB