Analysis
-
max time kernel
118s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 00:56
General
-
Target
9aaa74c410a6e97b930a65c1f088598ceab8054b9bc1928b31a4a57a1e98f764.exe
-
Size
4.9MB
-
MD5
4da9ed14404a53268904e7dd6959f52b
-
SHA1
c3d798fd07decc8136c52523428d02610fad42c4
-
SHA256
9aaa74c410a6e97b930a65c1f088598ceab8054b9bc1928b31a4a57a1e98f764
-
SHA512
cba29b2cce4fa6211409fea7103d12f7ab4408e9c1916c77c2de44106a52a1d34eab1c73331768e5e8d49127b8bdd54d08a8ab4889a11fc80b03db11ce7fa284
-
SSDEEP
49152:rl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx87:j
Malware Config
Extracted
colibri
1.2.0
Build1
http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php
Signatures
-
Colibri Loader
A loader sold as MaaS first seen in August 2021.
-
Colibri family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 15 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 42 IoCs
-
DCRat payload 1 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 40 IoCs
-
Checks whether UAC is enabled 1 TTPs 28 IoCs
-
Suspicious use of SetThreadContext 12 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 14 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 42 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aaa74c410a6e97b930a65c1f088598ceab8054b9bc1928b31a4a57a1e98f764.exe"C:\Users\Admin\AppData\Local\Temp\9aaa74c410a6e97b930a65c1f088598ceab8054b9bc1928b31a4a57a1e98f764.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\tmp8792.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8792.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp8792.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp8792.tmp.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c4291429-bdc6-42eb-a05b-0dc6b6b3c2ce.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\03fee667-3b6c-48ed-b41c-866250f58763.vbs"5⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d9d4a39f-3be9-403e-be4c-301c67a1e267.vbs"7⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\597971e9-a9d4-4baf-9fe1-e6e4e304f5f4.vbs"9⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\43ab6051-3391-4da0-a570-08fc6f7ef743.vbs"11⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce503a9e-d08d-4d50-a091-843466426510.vbs"13⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fa057bad-061a-4f0f-bfad-0601420c4192.vbs"15⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a0d55e9-ef5b-4f88-af44-74fc47f6adc7.vbs"17⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\287889ef-5064-4ee5-a98a-bbf1bd9eb517.vbs"19⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f58a9ec7-f328-4ee5-b6db-caa21abb411b.vbs"21⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0eb7e322-5db5-4776-afba-20fc8600d4ea.vbs"23⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fb9d1f8b-5b00-42d8-8797-f597372354d9.vbs"25⤵
-
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe"26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6eddbb9-a0b7-49a6-83e1-d05d8089870e.vbs"27⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2670a12e-09d8-4236-ba53-a73f06a34871.vbs"27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp4992.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4992.tmp.exe"27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp4992.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp4992.tmp.exe"28⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3361203a-e1a3-4ee6-872a-a38942eff30d.vbs"25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2D40.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2D40.tmp.exe"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2D40.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2D40.tmp.exe"26⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp2D40.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2D40.tmp.exe"27⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f854a95d-c199-4b70-b019-8e4bbb7df1b6.vbs"23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpFE70.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFE70.tmp.exe"23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpFE70.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFE70.tmp.exe"24⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba6cd1a6-ffa9-468e-9cb7-24870fb691c5.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\44689537-5c30-4e11-be7b-61ebc4db298f.vbs"19⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpC484.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC484.tmp.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpC484.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpC484.tmp.exe"20⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a7f6c7e1-fb04-4c8f-b8c5-2cc8d9f403e3.vbs"17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp94C9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp94C9.tmp.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp94C9.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp94C9.tmp.exe"18⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\08d98b07-0ef0-4778-bade-27788fc8fa6d.vbs"15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp77AC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp77AC.tmp.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp77AC.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp77AC.tmp.exe"16⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e9e7cf8c-e320-474b-8db5-10b0c69f223a.vbs"13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp5927.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5927.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp5927.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5927.tmp.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7044c013-8ff2-44e8-8ae6-2cd0cb2a2d77.vbs"11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp3C77.tmp.exe"14⤵
- Executes dropped EXE
-
-
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\20680ba2-d8ff-4084-8867-4f1dcb2fb76c.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a1aede8-8f50-43d0-9393-40bbd0801df0.vbs"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpEE09.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEE09.tmp.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\tmpEE09.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpEE09.tmp.exe"8⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\99fb00ab-365c-4817-b6ad-9521ec0353c7.vbs"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmpD179.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD179.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpD179.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD179.tmp.exe"6⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\50b01765-9180-4d65-8d0a-4002891019a7.vbs"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tmp9F0F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9F0F.tmp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp9F0F.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp9F0F.tmp.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\es-ES\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\Accessories\es-ES\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.9MB
MD54da9ed14404a53268904e7dd6959f52b
SHA1c3d798fd07decc8136c52523428d02610fad42c4
SHA2569aaa74c410a6e97b930a65c1f088598ceab8054b9bc1928b31a4a57a1e98f764
SHA512cba29b2cce4fa6211409fea7103d12f7ab4408e9c1916c77c2de44106a52a1d34eab1c73331768e5e8d49127b8bdd54d08a8ab4889a11fc80b03db11ce7fa284
-
Filesize
1KB
MD54a667f150a4d1d02f53a9f24d89d53d1
SHA1306e125c9edce66f28fdb63e6c4ca5c9ad6e8c97
SHA256414659decfd237dde09625a49811e03b5b30ee06ee2ee97ea8bcfac394d281fd
SHA5124edd8e73ce03488a6d92750a782cd4042fbb54a5b3f8d8ba3ea227fda0653c2cd84f0c5d64976c7cdc1f518a2fdc8ff10e2a015ec7acf3cd01b0d62bc98542d8
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
759B
MD54c7f55db08c65fbe13380b02a2e63fed
SHA18ee5371beab40aa6a11534f13417056e198e7d98
SHA256e481629351b3ec7642cf3bf7dcec4ae8c8b51d7dbc688b027c0e906caca91ac9
SHA5123188efae165172e86438d3091bc524a8a106536765db4c5e7e29cc09e667cb7de4d62fbfeab74a802536c80e7c3c883752ac08f26c551e25018366983a6384b3
-
Filesize
759B
MD5b17c550140ac5399a92248636bdf2200
SHA160f648a1a12978ba627fcbc34af5444ea50de46f
SHA2562862dd79177f6b34c93653f4db6428ad9ea4e3368c81d0695ae3b677690cdf40
SHA512c6156761713a720eb542f7af16cdcf57970563a885ef1be3d29ad57d674c172305566c2cc127d6494b84ddbc9dc45570811b4bea5848c0096a1f503266e76a57
-
Filesize
535B
MD58269e0bea14ca2be260ebac4cec08f5f
SHA17f3ef8159de5da9e412c0c4ab53cb8ef7b3cdd0b
SHA25692328093b1010182bd903030380914d659374f3ab1be9d84abece9db4640a32f
SHA512a7dcc00c6bed95f013cbabc6e7512e54a1a23a9ea2870c8e1783b4216df33a3bd45966f9ea7565bc4c1db8525b5a50ee3bafd4e4210315b6905f2d60e244fd9f
-
Filesize
759B
MD5a4440dbb17be789488cb7f347bd1fa4c
SHA1ea70092efebb59b38ae22e0fee794403e6dc27b6
SHA256862f9c1e8762155db8f037cefbd8e9fa5e7e87ba397f5ed2ef375c362ccd99c2
SHA512fd0072ae7bba873e72427e594eed3e33ea0b203fa56b448daa19f31169e7a68fcdbadbff87cc174e0624d5753a824d4ad58153bf678297034d1ca778e21e3b76
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
759B
MD58f66aba74d110e8354be16df66b96e00
SHA13a3f38b2ee8293a49e592edfbc8cc98a0d76c390
SHA256cd47ffe501d178f85052ba528d7b52ad0aefcc95e8f5aa4c4e3218ea1d3e4160
SHA512b94e7a75184e37f8ff36bedeb5da79a8e2b8a5bc50637cce8977aa8f4b7607fb375f58b3160f4d45c133aaeb47be975be81f3577802e481659d6727cb199d96e
-
Filesize
759B
MD594c08096e27993ce4bf10ca09df62bb3
SHA1e6597f6390a66a5639570cecec9282754780dfa1
SHA256ea0f7ae2b3193a825e8421f3c69030c912e67e79dfa532b553222eac8ea88f3f
SHA51263413d156a161951028406f876a5e30f14ad32d349b37aa1547938cfa1bce35b912adaa896d121202e32c6438a4ac0b39d95bd48aa36cb401273f07815bf241f
-
Filesize
759B
MD5d081ca6f737e8688ee3d19add7331442
SHA18b910619c8333513872f06b152cb1f3780596efa
SHA2566d5bcb23e0ee8ae708ae4275f4b08c7dbf8235a3e769e4a584aa95df5be54a85
SHA51289b6fe901f3ead071bf4e91c576157077a45a38c4b16563b0f41a33a3518e563b55fc8bff7e3fece2ab74e11044eeddc0dd35f74648338b9b987b827d6dd29fd
-
Filesize
759B
MD5527f4b9acbe18ea83be810e09ef7e09d
SHA1d08382cdcd7d8646b41a76f36230d01ebadf3c65
SHA2561a667cd72b79ae652c438206c0de5f234300d42f2d0f8febe3ad5501608b6ec0
SHA512245c32154e61538b2300dd04fba95629402c8c0a3674cfc20a505de56e6349898cf738174f5546bccfaa985f29e91199c16b17e5cc3a3bee0d1c7e3be58a4f5d
-
Filesize
75KB
MD5e0a68b98992c1699876f818a22b5b907
SHA1d41e8ad8ba51217eb0340f8f69629ccb474484d0
SHA2562b00d8c2bcc6b48e90524cdd41a07735dc94548ed41925baff86e43a61a4c37f
SHA512856854f5fd89ae1669e4b2db10b73b4a78496bf80117003244c83e781f75e533e2e2bea9aa6c1b3aba3db1ed92ea0ed9755fbfd78cd6c86ba95867d07fc0ece2
-
Filesize
72KB
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
5.0MB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
48KB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
112KB
-
Filesize
1.2MB
-
Filesize
10.8MB
-
Filesize
28KB
-
Filesize
72KB
-
Filesize
72KB