Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/12/2024, 22:03
Behavioral task
behavioral1
Sample
1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
Resource
win10v2004-20241007-en
General
-
Target
1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe
-
Size
952KB
-
MD5
ea363f97b2eb4114d986a81633f21b20
-
SHA1
5358a564395c004068ed9907cc6a0809801b8581
-
SHA256
1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11
-
SHA512
b40d208dea8daa1ada700aa93e2559f3ee2d11e8f59b38a288ef8d402a8a11eef3636dd3460d21b72bf3bca78bd2c8ebfc9690bc95e40dd79e427e1122be1096
-
SSDEEP
24576:2+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:R8/KfRTK
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\", \"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\", \"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\", \"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\", \"C:\\Windows\\Cursors\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\", \"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\", \"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\", \"C:\\Windows\\TAPI\\SppExtComObj.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\C_860\\dwm.exe\", \"C:\\Users\\Admin\\Saved Games\\dwm.exe\", \"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe -
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4572 3324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2660 3324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 3324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2856 3324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3700 3324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 800 3324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4480 3324 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3704 3324 schtasks.exe 83 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dwm.exe -
resource yara_rule behavioral2/memory/804-1-0x0000000000240000-0x0000000000334000-memory.dmp dcrat behavioral2/files/0x000a000000023b81-20.dat dcrat behavioral2/files/0x000b000000023b76-52.dat dcrat behavioral2/files/0x000c000000023b78-63.dat dcrat behavioral2/files/0x000c000000023b7c-74.dat dcrat behavioral2/files/0x000c000000023b7e-85.dat dcrat behavioral2/files/0x000300000001e767-105.dat dcrat behavioral2/memory/452-134-0x0000000000290000-0x0000000000384000-memory.dmp dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe -
Executes dropped EXE 1 IoCs
pid Process 452 dwm.exe -
Adds Run key to start application 2 TTPs 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\TAPI\\SppExtComObj.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Cursors\\RuntimeBroker.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\Saved Games\\dwm.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\C_860\\dwm.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Admin\\Saved Games\\dwm.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\System32\\C_936\\SppExtComObj.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\KBDBR\\spoolsv.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Windows\\TAPI\\SppExtComObj.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Windows\\System32\\C_860\\dwm.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Google\\Update\\1.3.36.371\\dllhost.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\iprtrmgr\\lsass.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\Cursors\\RuntimeBroker.exe\"" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dwm.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dwm.exe -
Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\System32\KBDBR\spoolsv.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\iprtrmgr\lsass.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\KBDBR\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\C_860\RCX8521.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\C_936\RCX8A35.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\C_936\SppExtComObj.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\iprtrmgr\RCX94AE.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\C_936\e1ef82546f0b02b7e974f28047f3788b1128cce1 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\C_860\RCX8520.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\iprtrmgr\lsass.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\KBDBR\RCX91BE.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\iprtrmgr\RCX943F.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\C_860\6cb0b6c459d5d3455a3da700e713f2e2529862ff 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\KBDBR\spoolsv.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\C_936\SppExtComObj.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\iprtrmgr\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\C_936\RCX8AA3.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\KBDBR\RCX91BD.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\System32\C_860\dwm.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\System32\C_860\dwm.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\RCX8F4A.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\RCX8FB8.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\dllhost.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\dllhost.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Program Files (x86)\Google\Update\1.3.36.371\5940a34987c99120d96dace90a3f93f329dcad63 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Cursors\RuntimeBroker.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\Cursors\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\Cursors\RCX8CC7.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\Cursors\RCX8D35.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\Cursors\RuntimeBroker.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\TAPI\RCX96B3.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\TAPI\SppExtComObj.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File created C:\Windows\TAPI\e1ef82546f0b02b7e974f28047f3788b1128cce1 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\TAPI\RCX96B2.tmp 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe File opened for modification C:\Windows\TAPI\SppExtComObj.exe 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 800 schtasks.exe 4480 schtasks.exe 3704 schtasks.exe 4572 schtasks.exe 2660 schtasks.exe 2676 schtasks.exe 2856 schtasks.exe 3700 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Token: SeDebugPrivilege 452 dwm.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 804 wrote to memory of 452 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe 93 PID 804 wrote to memory of 452 804 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe 93 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dwm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dwm.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe"C:\Users\Admin\AppData\Local\Temp\1bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11N.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:804 -
C:\Users\Admin\Saved Games\dwm.exe"C:\Users\Admin\Saved Games\dwm.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:452
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\C_860\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\C_936\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Cursors\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\1.3.36.371\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\KBDBR\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\iprtrmgr\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\TAPI\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD5ea363f97b2eb4114d986a81633f21b20
SHA15358a564395c004068ed9907cc6a0809801b8581
SHA2561bafdc2e89ed7d118b2695ec89ccd09f0114020308b94da96d8284022e04ad11
SHA512b40d208dea8daa1ada700aa93e2559f3ee2d11e8f59b38a288ef8d402a8a11eef3636dd3460d21b72bf3bca78bd2c8ebfc9690bc95e40dd79e427e1122be1096
-
Filesize
952KB
MD55cf42ff03cf88b2f63827a0a05abb1b9
SHA181fd29f49d53c52db42c2713411cd85a5650b37f
SHA25675489ccaf9487d5d9f96707ef97a0c4ccf7764d9b05d281ea55fd00c64589948
SHA512b5db43de4f3b60a9662039b0d5f0aec07869bdb0e5a97255c57fb08974f26c1db2c6d81f98c19358ce28f612d767df4533c39199d9262f76489953b337a928b7
-
Filesize
952KB
MD504de5ec5e5ef5482f47a1938bc31a825
SHA186846e5e527df9a968742f432424e0f27274691c
SHA2569d21f5f086d7b5cabb2f96d5b904e442e115e9a8b4e575907318e102fdd7ec6a
SHA5123dc788702aef7012dd64625fffc2555afc274a966de9564fcb94de82c9b5a7700635c15a37ea5f25250a26f55f3c632ec5cfcabe0410907c77fb0f222b4a7a92
-
Filesize
952KB
MD5fa54ae1bdeb189a08b55b9c1d35add76
SHA1453c8506375b9bca66d9e37051b187604daa8476
SHA25693de58f91c81313f8e6700b1f65f450ea61c0facb16d91c2133df22ab4f36446
SHA5128cfcb1395c6614c970b54158cc73ad1ae5b75596733e4ff66d9f2a47eddc0423fae45c4caa7032b270a94b9ae076b298c56e9f68f55f23ab243224894542f5ab
-
Filesize
952KB
MD553c530051a5b50a5c37530ca7abfe7fe
SHA178f1097ffb90d77b61e60a8f80d605c7ed855f3e
SHA2569a001d0bc02c3e7ec58476408d52b97398d87c84d304e9964e0455a76a1a5b25
SHA512cc81dbb0ddc0deb8c3cd27ef74b5c41791f482cb1822ad36b5741c8a61f4e1445b3681098fdf7d5cff3942d531a6a15a2789168d270ace628381070d5a1d9a26
-
Filesize
952KB
MD567cb4ddfd9a380160b24649eca6c6f80
SHA1a7f28f4f24686cea8fe17818c12d0024feb50403
SHA25655fa7cb16a401abf638ca06dfd49dae7050ba5c20ae0c3bb18592fab1cf7aee8
SHA512eb810fb188a98370b448036c12fa1afe84371e8591f3aa2666c1daba44c632305014b2e2180f78c3fc82097a77038e0fce89e8b789dd5791cdf6cd2c46478408