Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1010deea290e...1N.exe
windows7-x64
1010deea290e...1N.exe
windows10-2004-x64
1010deea290e...1N.exe
android-9-x86
10deea290e...1N.exe
android-10-x64
10deea290e...1N.exe
android-11-x64
10deea290e...1N.exe
macos-10.15-amd64
10deea290e...1N.exe
ubuntu-18.04-amd64
10deea290e...1N.exe
debian-9-armhf
10deea290e...1N.exe
debian-9-mips
10deea290e...1N.exe
debian-9-mipsel
Analysis
-
max time kernel
802s -
max time network
434s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2025, 05:28
Behavioral task
behavioral1
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
android-x86-arm-20240624-en
Behavioral task
behavioral4
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral5
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
android-x64-arm64-20240910-en
Behavioral task
behavioral6
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
macos-20241101-en
Behavioral task
behavioral7
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral8
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral9
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral10
Sample
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
Resource
debian9-mipsel-20240611-en
General
-
Target
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe
-
Size
1.7MB
-
MD5
a95c577913d17f1786babed3306fed60
-
SHA1
16106bfac76f6e4f711a9dd7e016cd52fbaeb774
-
SHA256
10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91
-
SHA512
314edb12b8885f8f9ea83e991b49aafcc629d5325f3439460610cc0046f0f0d1d629cecd79c2a9c48899d07c171253be7e65a6ef27c1434cf5ff55d5043fdec0
-
SSDEEP
24576:N3QwuLyEbVoCtPreIjNLoN/VNGeSQDx1m17zezKOkCzeJGFUJ:NgwuuEpdDLNwVMeXDL0fdSzAG
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2596 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5068 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4128 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4320 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4408 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4396 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3084 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4252 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2868 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2044 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3032 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1092 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1196 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4216 3112 schtasks.exe 83 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3952 3112 schtasks.exe 83 -
resource yara_rule behavioral2/memory/3836-1-0x00000000005B0000-0x0000000000766000-memory.dmp dcrat behavioral2/files/0x0007000000023caf-30.dat dcrat behavioral2/files/0x0008000000023cba-59.dat dcrat behavioral2/files/0x0008000000023cab-93.dat dcrat behavioral2/files/0x0009000000023caf-104.dat dcrat behavioral2/memory/1244-267-0x0000000000A20000-0x0000000000BD6000-memory.dmp dcrat behavioral2/memory/3592-308-0x0000000000DA0000-0x0000000000F56000-memory.dmp dcrat behavioral2/memory/4932-316-0x0000000000470000-0x0000000000626000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3888 powershell.exe 4972 powershell.exe 3444 powershell.exe 1464 powershell.exe 3652 powershell.exe 3400 powershell.exe 3500 powershell.exe 4668 powershell.exe 876 powershell.exe 2560 powershell.exe 1568 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation smss.exe -
Executes dropped EXE 9 IoCs
pid Process 1244 smss.exe 4492 smss.exe 3592 OfficeClickToRun.exe 3536 csrss.exe 4932 StartMenuExperienceHost.exe 1996 OfficeClickToRun.exe 4080 smss.exe 1876 TextInputHost.exe 5044 services.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\RCXA9DE.tmp 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\RCXA9DF.tmp 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File opened for modification C:\Program Files (x86)\Common Files\Services\RCXB39C.tmp 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File opened for modification C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\csrss.exe 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Network Sharing\csrss.exe 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File created C:\Program Files (x86)\Windows Media Player\Network Sharing\886983d96e3d3e 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File created C:\Program Files (x86)\Common Files\Services\e6c9b481da804f 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe File opened for modification C:\Program Files (x86)\Common Files\Services\RCXB31E.tmp 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\System\Speech\RuntimeBroker.exe 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings smss.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2596 schtasks.exe 5068 schtasks.exe 2932 schtasks.exe 1196 schtasks.exe 8 schtasks.exe 4408 schtasks.exe 3084 schtasks.exe 1092 schtasks.exe 4128 schtasks.exe 4320 schtasks.exe 2036 schtasks.exe 3032 schtasks.exe 4216 schtasks.exe 3952 schtasks.exe 4396 schtasks.exe 4252 schtasks.exe 2868 schtasks.exe 2044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 876 powershell.exe 876 powershell.exe 4668 powershell.exe 4668 powershell.exe 3500 powershell.exe 3500 powershell.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3888 powershell.exe 3888 powershell.exe 4972 powershell.exe 4972 powershell.exe 2560 powershell.exe 2560 powershell.exe 1464 powershell.exe 1568 powershell.exe 1464 powershell.exe 1568 powershell.exe 3444 powershell.exe 3444 powershell.exe 3400 powershell.exe 3652 powershell.exe 3400 powershell.exe 3652 powershell.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 4668 powershell.exe 876 powershell.exe 3500 powershell.exe 4972 powershell.exe 3444 powershell.exe 3888 powershell.exe 3652 powershell.exe 3400 powershell.exe 2560 powershell.exe 1464 powershell.exe 1568 powershell.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 1244 smss.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe Token: SeDebugPrivilege 876 powershell.exe Token: SeDebugPrivilege 4668 powershell.exe Token: SeDebugPrivilege 3500 powershell.exe Token: SeDebugPrivilege 3888 powershell.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 2560 powershell.exe Token: SeDebugPrivilege 1464 powershell.exe Token: SeDebugPrivilege 1568 powershell.exe Token: SeDebugPrivilege 3444 powershell.exe Token: SeDebugPrivilege 3652 powershell.exe Token: SeDebugPrivilege 3400 powershell.exe Token: SeDebugPrivilege 1244 smss.exe Token: SeDebugPrivilege 4492 smss.exe Token: SeDebugPrivilege 3592 OfficeClickToRun.exe Token: SeDebugPrivilege 3536 csrss.exe Token: SeDebugPrivilege 4932 StartMenuExperienceHost.exe Token: SeDebugPrivilege 1996 OfficeClickToRun.exe Token: SeDebugPrivilege 4080 smss.exe Token: SeDebugPrivilege 1876 TextInputHost.exe Token: SeDebugPrivilege 5044 services.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3836 wrote to memory of 3400 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 103 PID 3836 wrote to memory of 3400 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 103 PID 3836 wrote to memory of 3500 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 104 PID 3836 wrote to memory of 3500 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 104 PID 3836 wrote to memory of 3888 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 105 PID 3836 wrote to memory of 3888 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 105 PID 3836 wrote to memory of 4668 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 106 PID 3836 wrote to memory of 4668 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 106 PID 3836 wrote to memory of 876 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 107 PID 3836 wrote to memory of 876 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 107 PID 3836 wrote to memory of 4972 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 108 PID 3836 wrote to memory of 4972 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 108 PID 3836 wrote to memory of 3444 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 109 PID 3836 wrote to memory of 3444 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 109 PID 3836 wrote to memory of 2560 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 110 PID 3836 wrote to memory of 2560 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 110 PID 3836 wrote to memory of 1464 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 111 PID 3836 wrote to memory of 1464 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 111 PID 3836 wrote to memory of 3652 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 112 PID 3836 wrote to memory of 3652 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 112 PID 3836 wrote to memory of 1568 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 113 PID 3836 wrote to memory of 1568 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 113 PID 3836 wrote to memory of 1244 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 125 PID 3836 wrote to memory of 1244 3836 10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe 125 PID 1244 wrote to memory of 3120 1244 smss.exe 126 PID 1244 wrote to memory of 3120 1244 smss.exe 126 PID 1244 wrote to memory of 1076 1244 smss.exe 127 PID 1244 wrote to memory of 1076 1244 smss.exe 127 PID 3120 wrote to memory of 4492 3120 WScript.exe 141 PID 3120 wrote to memory of 4492 3120 WScript.exe 141 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exeC:\Users\Admin\AppData\Local\Temp\10deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91N.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
C:\Recovery\WindowsRE\smss.exe"C:\Recovery\WindowsRE\smss.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e72d5173-49e3-4b8d-b253-169d57c70cd8.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Recovery\WindowsRE\smss.exeC:\Recovery\WindowsRE\smss.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea680630-7701-4d1a-bec9-22a51a4f6cef.vbs"3⤵PID:1076
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\Network Sharing\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\ssh\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\ssh\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\ssh\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Local Settings\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Local Settings\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952
-
C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe"C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
C:\Program Files (x86)\Windows Media Player\Network Sharing\csrss.exe"C:\Program Files (x86)\Windows Media Player\Network Sharing\csrss.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
C:\Users\Admin\Local Settings\StartMenuExperienceHost.exe"C:\Users\Admin\Local Settings\StartMenuExperienceHost.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe"C:\Program Files (x86)\Common Files\Services\OfficeClickToRun.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
C:\Recovery\WindowsRE\smss.exeC:\Recovery\WindowsRE\smss.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
C:\Users\All Users\ssh\TextInputHost.exe"C:\Users\All Users\ssh\TextInputHost.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
C:\Recovery\WindowsRE\services.exeC:\Recovery\WindowsRE\services.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5a95c577913d17f1786babed3306fed60
SHA116106bfac76f6e4f711a9dd7e016cd52fbaeb774
SHA25610deea290eb4d8620994434958a5ba14e8669f34a2ab998b65792acad1b49c91
SHA512314edb12b8885f8f9ea83e991b49aafcc629d5325f3439460610cc0046f0f0d1d629cecd79c2a9c48899d07c171253be7e65a6ef27c1434cf5ff55d5043fdec0
-
Filesize
1.7MB
MD5cccbeec3d22d8d990fef9cf77118c74d
SHA12554ff5e94d85c6f8ff5a9f671609322f4f30ac2
SHA256eb0c600f6dccd941b220a4278a64a0c1b2c90d79c51eebccfb440caa1ef261ff
SHA512705c8405526b8d61fbf336054e277a2e0f93b8fff60764475170e62775e47184ea91e562dea75470f424db083a58a8289260faea63fdb40ed735e9dfdc2cb90b
-
Filesize
1.7MB
MD544a10aa7a9ec22d959f8db65ba5e1b55
SHA1d4bf6196e09357fee999b513141ca0221aadf037
SHA25631c55eeea7e3fe7855f6f7c5c70fdc42e5a3c2a2359486b41c43882b5b499628
SHA5120bf94f028ef4bbf0ff0a7f95a178ab478866bd7681b6180212bfc194bd94b7e07388afef20ed3c778657c36c5d6d9c11788381b1c6a6efad13e5e1adf9c4b2bc
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD53ad9a5252966a3ab5b1b3222424717be
SHA15397522c86c74ddbfb2585b9613c794f4b4c3410
SHA25627525f5fc7871c6828ab5173315e95b5c7e918d2ee532781c562c378584b5249
SHA512b1a745f7a0f33b777ffc34f74f42752144d9f2d06b8bc613e703570494762b3af87e153212c3274b18af14f17b8619e2f350b7c3cc11228f7d4208d4251e90e6
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5a8e8360d573a4ff072dcc6f09d992c88
SHA13446774433ceaf0b400073914facab11b98b6807
SHA256bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b
SHA5124ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
1.7MB
MD55869dac59f3c306919217594853dd75b
SHA1496ba3d96d22b7026d310e0a9f8d3dee80e7c50d
SHA2562dd2c3ea45127737bd59202cf3ab45f82be02d715d6ee467718024806a76341d
SHA512082a55866cc60d90b66c51da7c4b8d5cca4008d013abeed7ac0348342344dad415b2102db3a4f621f883640d3519cfe340994f9b5a2a03284132085bc7048ca1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
706B
MD5bde286295ed4a57e23b22517d1ee580f
SHA1cb08bafaffe0ecec9cd587aa6191e1a82d77e2f9
SHA256a3f3ce368d007953ce0936ddcbfe82b644f00a4aed8cc64262299ee87e998c8c
SHA51236f10d3f12d3453a34abf3ddf60e2f98a804db3174e8fda681fd9e16eab0337edcc8c6568fd9498ab6ea8501d472486585a328742aef2e3ae293d3ca325418ab
-
Filesize
482B
MD55d800cd287e3163388687808ead49734
SHA1c6b2ed89a8bc5a2c4ccf4725106f5dcd2d18a6e2
SHA2566250ffb1da492021b440b632224ed5f9ecc7949149054ad78e4be191a6e5af8a
SHA5124a7631a6f0e14033bf104fbc6206f1c1c900e4dda80b06073e4391d5203f1d772cd4a491e3e750a8f9608e85196131d038545da180dfb94a1bec238a81c52d04