Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-01-2025 06:00
General
-
Target
a7a6bc6eb9a42d31662bc3b20a5fcde5cbe63b64c48c4fb484ba249baf5b7da4.exe
-
Size
1.5MB
-
MD5
e663bacf67d867450934809cff3fd749
-
SHA1
14fed8278438f7d659341d4642b99667e154d33b
-
SHA256
a7a6bc6eb9a42d31662bc3b20a5fcde5cbe63b64c48c4fb484ba249baf5b7da4
-
SHA512
957da6b848aa325dd63bdb65f772daa30b83d3396bb633725765fd8aa2888153cb871b0037768876ad3082885260fb4a5c8a5984391f210ee32eb087d7ff2411
-
SSDEEP
24576:UNNUtQhWhtqDfDXQdy+N+gfQqRsgFlDRluQ70eJiVbWpR:kzhWhCXQFN+0IEuQgyiVK
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 9 IoCs
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 54 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 17 IoCs
-
Adds Run key to start application 2 TTPs 18 IoCs
-
Checks whether UAC is enabled 1 TTPs 36 IoCs
-
Drops file in System32 directory 16 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 18 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 54 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7a6bc6eb9a42d31662bc3b20a5fcde5cbe63b64c48c4fb484ba249baf5b7da4.exe"C:\Users\Admin\AppData\Local\Temp\a7a6bc6eb9a42d31662bc3b20a5fcde5cbe63b64c48c4fb484ba249baf5b7da4.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a7a6bc6eb9a42d31662bc3b20a5fcde5cbe63b64c48c4fb484ba249baf5b7da4.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\makecab\spoolsv.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\fhcpl\dwm.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\TextInputHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\upfc.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\ServicingUAPI\dllhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows.Internal.Signals\lsass.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\sysmon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a8c254c6-85c7-461e-a9b2-b66124074a75.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7345e695-5efc-4f87-af48-278256dd1039.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1de3748-7f37-4cd2-b3a4-eceb540ad4ca.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d12522e3-1268-4f49-9222-3b96c854e39e.vbs"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\440fdc36-da5c-4285-9e92-f084fc46dfe5.vbs"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8520df77-8148-4eac-b75b-383f5236a552.vbs"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95c24f7b-b862-4ed3-9593-02e8c6b2fa8c.vbs"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e041737b-d2ec-4283-8a7a-a286adf8be37.vbs"17⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02d34e65-fdfa-4fa7-980b-a063d0da8acd.vbs"19⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6bfc4e6-7949-4171-ba71-52e0dcaaccfc.vbs"21⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7086be3-b6e7-4351-ae86-bc75d6d10a65.vbs"23⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\be56e785-bcdf-4152-8f31-ad9b650690de.vbs"25⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe26⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2d84334-a48e-4519-96f7-017a35c7c425.vbs"27⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe28⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\826072ac-dc73-482c-9e8d-33fc02ebcdb8.vbs"29⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe30⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\71b387d6-bb70-4c15-9201-8dedb68cf93b.vbs"31⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe32⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\40981a85-4c8e-4a6e-93c4-57cca0cc143b.vbs"33⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exeC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe34⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2c77f261-5d41-48ad-b466-8df702bed3e9.vbs"35⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f7f798cd-e4e8-4488-a807-da5f901b3d3e.vbs"35⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c9f86c7f-944a-4e57-847b-d6e07c239235.vbs"33⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ce2512d2-0e71-424b-b270-dc141009ae5f.vbs"31⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3152d30-3401-4186-8321-a0e30c47bb8b.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\96e2c002-833e-48c6-b3c0-0947ee65a5f0.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e192e54-1c57-46c8-8024-d41b83426f41.vbs"25⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c08090ea-0bf0-413c-9a35-1e24c00aea3f.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82959c61-e0e7-4334-b373-809cb08c2044.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18126187-280d-44da-b65c-2c5a5a863e92.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2f62896b-1395-437b-a328-96dc8bab19ad.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e28d9848-f530-4ef1-82c5-a89e20c621a9.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad5f44f1-76be-4342-ba8a-4ea8d302c753.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a0ed481b-c82b-4cdd-aa82-09b78595e4fd.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fef3f65c-205f-445c-a008-c326756c4399.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75029703-b400-4826-ae10-aff864cb8a72.vbs"7⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\115b6e62-f11f-4fe8-a44f-960decb6e0ee.vbs"5⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b1b6a876-9cf7-4059-9adf-eaeb11896acd.vbs"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\makecab\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\System32\fhcpl\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Documents and Settings\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\SuggestionUI\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Installer\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\ServicingUAPI\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\Windows.Internal.Signals\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5229689e55c432b804bd4d58955bc508a
SHA1c98f50934bdcdf2591855dbc4176b1011a209cb8
SHA256990163e024920067ce74263cdcdde11d27f827932540c2faa0c8802c1e1edde7
SHA5123f51f780353ce6a20e851bb56785b8d6b02209c44fa14b043536d3340e80d92fcff16c07e93bec3017ac17d6fc403f7ecd281fedc60ecec2ab6301a8921971b3
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5e448fe0d240184c6597a31d3be2ced58
SHA1372b8d8c19246d3e38cd3ba123cc0f56070f03cd
SHA256c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391
SHA5120b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4
-
Filesize
779B
MD5ec8eeedcaa467a1ae1b6f752a8e3faf6
SHA10e1436531447df00a5f68f43775b29154b231bdc
SHA256d551e687f4d55e3b1adba3013f5d63e2152fe184d702792d9247480120e93c93
SHA512c226ca2a78fa8d41b986b89721e80de9a439eed54d014938594bfc34de4badd3a923186e1d0e38227ec7d4bdf4e75b05741658652869ff70d91bdf0f3811f1db
-
Filesize
779B
MD54d4bd9bae99c0951f9dd53376b4fe775
SHA18ba60a4106f49b672f26f5b0cc5307aada483f3e
SHA256c238a285afaa85fa32bf3ab76f2bda1f4a9cd0fe16ec1f8f778f0e07970ac498
SHA51278a851d8d9fad7b879bc5845fd587d3048000a4f4c2e862626bef6f667968bf6ca5baef4078c093025900c86037acc489142b3ecb8152ee5ce206623955a9513
-
Filesize
779B
MD55896e142b6d0672b01ed95efab66a178
SHA1ea8a79358cea7628783054a59d5ac3b583c6c7d4
SHA256b4e5c848f5debf221b20d2cdd133823884f3ed816b84661649e693c3d11ce005
SHA512918a568e92e8c601770e29ecddc730b43faed7f87174e2da0f148b4a0c4ee4a63b29cec2a1509b1e0ecd770bf3f77ef1d1c2e02f81bdcf9f6de4bbdc3a59a9e8
-
Filesize
779B
MD541354958bd0a4b0113c3c73428f6a434
SHA14110f163231bd6877bb18cd600ef33fd0b100efa
SHA25605b9d28ae9177f73ed06b8cd0be17ccc894bd7aa41648800da0ab797f00c611e
SHA5120eb7af5711f171ccbb969fe210941f1fd11c98ded7a8242f69bd04b2c62fdceb6533bdf802075712890bc0962abd859454dae45374717dc6c6494b72fec912d5
-
Filesize
779B
MD5e1dd4b84a5f60c4977fe70ea26cfbdeb
SHA1b84fc20bea9f5e956746700965aa8555cb3e5754
SHA256314f1cd20ef21f270c0882ceaefca77b0c129085e9910d01297bbfce39dddb9e
SHA512b25fd293d4c7d475d170c9eb766e280f4343a79f5a6b3a272299c6b56c426ebfd8702e5761ac92c3d3187a52729c6c67ee2d0b5dcfeb960f210e3ad6f41bf634
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
778B
MD555d1c5a7baf77879f78e7d8a01665d19
SHA1e743bddd64ca2a8564872f3500c5d3bb36b0b635
SHA2560dfbb8ddcef777fb513ef79b93e3f1d308e98fcefe7490274f235f407686af46
SHA51230d3b15c058794c33ee40ec255c2e968f7b826ab063e7d1ac4930e7fdae4a3f71943b2cfd2901af7988ebf9df0781d67c9337f32ba965d9dcfc64eb23d489bd5
-
Filesize
555B
MD5db433758bfd6b535ee709c90a6ba1958
SHA1f3a8a64462a6f451f7cdf90062bf3c71a2711fa6
SHA256c4baed4314def371d64fab9d4810b41eaedd3242ee7b49fdd17c66126128f44a
SHA5123c3916a3c96106295eceea600f4bb24f203cd3196448f9f96357d56cb137ce8f72b07516da955d53e78b02ae1e4a12a583cf338b2abd00c439a3fff4144290e8
-
Filesize
779B
MD5e526850109519100cf37231203e77aff
SHA108fbaf30610385821903b53127694ba683c250c9
SHA2562bf0bf318d97ea93879ac8d795807147418f6c14df0cf0ebe7bae24f4c6304a0
SHA512a9f5f402f78c06db3c9005ac07343c3d74e3ba89a9b58a9991531c24257b21ec201d4875f4bcef086c15bcaa24297211cf89b46e5ca625066f795e72f893b2f5
-
Filesize
779B
MD5aaec58fa0dc387e44ca9cb840170fba6
SHA1bbbc386b38533db8ef05e4a6cb9ff31a1b98b1b2
SHA256a5c1808ca0c43e705fafd54a26199a60778669fe59dc4a8f2512bc92787c93d0
SHA512a406644e9b0f7c849d68d7423e965d12da3cbe9dd548d2d42da629ebcfbf42354a8c82bf5bd80b1553e7fb8e692a4eae11579540380466202f736df2fe9a7331
-
Filesize
779B
MD5ed1960b37712b65a376a155e295eb32b
SHA1b6491a837f1eda48e8bd2c73a14781f8f15fc627
SHA256ce1f8f1ae701f6409a6adcf2ffab69031e5ca2c27b5dc87bc478d56c9a265c58
SHA512922b8780e864efc3785655177a9060416b1abbc35e7e2bb6b5605afec8962bfbfafe2f7b26f6ca8aa76650180378908fb9aa152d06de69141d90eb840ff08aa3
-
Filesize
778B
MD50f8612847ebf07635403aa3788d24108
SHA1bb0585a0cbe0287283a23c95bdfee68212c9b79d
SHA256ab282034bfe7eb7645975b2e59905152c401909931e7d0139801567e12c04041
SHA5122414bd925df3693b5857e1f19c25fd41bc99a2196219d9512f85e1d1beec94a3aa70fe1636b6293918f92c441fd82c1b8d16b71795261eef1e7f7056fe5a1511
-
Filesize
779B
MD5ae06839c8a96fab5087b3f74c02b90aa
SHA10085a8ef546508c3066086cc34939edbec89703a
SHA2563a0d532aac639709636958b701162ee73497d145b96694c7fe4832eddd5047c5
SHA512cc7b22fbb10e38795ca18ca7c052f5677ffd46f4285207074689ea765b4364e466e2353213464dbb7096cc6220b170d8da81d30ead13c8a51641358eaaf17a65
-
Filesize
779B
MD578cd7e0dc2670daaa1321998bafce4cc
SHA175bb5ef9faa95fe77c7a3f28cf720f17332adb8f
SHA2567ed2199e20bde9c52014c6174baa68f7ccb82650635b1c413dd31e6e2f73ddef
SHA51275113ab491b2683669d0f040f66a9e4224be39e940d0641387d33b187e1b8b93c9f5654ad7b64ab3f45989d0d82aeeddf36bf2c79e0a945ddfeb479c3d32a71d
-
Filesize
779B
MD5cd7c42d3a0e82fa7350db65674c0fc72
SHA1cd3ed8bb88d8f594c784953bccfc36becbd48b8e
SHA2563094633010686673dc9d677c7f70558966e23fa08f21fd467107b6499864f56c
SHA5122a9d317008e66869717af9d15a70741db451981be2f7fc9a46748f0cd48f7bec8bfa4377ac2efc9b05b6b7e610f8e0c9aa6015305574c69dea72e781633720f5
-
Filesize
1.5MB
MD5e663bacf67d867450934809cff3fd749
SHA114fed8278438f7d659341d4642b99667e154d33b
SHA256a7a6bc6eb9a42d31662bc3b20a5fcde5cbe63b64c48c4fb484ba249baf5b7da4
SHA512957da6b848aa325dd63bdb65f772daa30b83d3396bb633725765fd8aa2888153cb871b0037768876ad3082885260fb4a5c8a5984391f210ee32eb087d7ff2411
-
Filesize
1.5MB
MD5b1980a2b33738aa2daff78ebe6217cf1
SHA144b89a4f1095ab9114f662b9dacc0b8ce0ebb5ee
SHA2568d88ac33ffc6290789861483d3db38d8566fde787f7237b767b80a32f5471d9b
SHA5122faf03f37bbb84b18564461d473e063f1710dcd9e44fc57ed9ce6b672bbbc45244308f6b975c44ca9520480b0297112ebf202ed96cfe80f3cfbe85d4b30e9b21
-
Filesize
1.5MB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB