Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/01/2025, 03:32
Behavioral task
behavioral1
Sample
f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe
Resource
win10v2004-20241007-en
General
-
Target
f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe
-
Size
2.0MB
-
MD5
b1ee79054f4b22b3288337c0d0a70619
-
SHA1
0cbe1c16fc78a1fc15974e2b452fd6a20011571a
-
SHA256
f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356
-
SHA512
4961a2bb7ce3148388f43fcb2ee001745c9b5bad575ce4f704d0affd63df3ec858ef039c5099d38bd827bbd2a05d57e4ac2162040ac785d9289bb2b9e2a68335
-
SSDEEP
24576:U2G/nvxW3Ww0t042y0hlXx+FY8ghJwOvPBE4oL1agNTUL/5aH/abU:UbA30db0hogRBaDGTU
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2724 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1920 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1640 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1256 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1152 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2896 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3056 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 948 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1292 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1660 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 600 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2344 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2552 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1304 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 328 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2332 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 668 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 376 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2484 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1036 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 876 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2456 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1644 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2088 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2364 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 880 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 2852 schtasks.exe 35 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 2852 schtasks.exe 35 -
resource yara_rule behavioral1/files/0x0008000000016dc8-14.dat dcrat behavioral1/memory/2784-18-0x0000000000980000-0x0000000000B32000-memory.dmp dcrat behavioral1/memory/1604-62-0x00000000008C0000-0x0000000000A72000-memory.dmp dcrat -
Executes dropped EXE 2 IoCs
pid Process 2784 Browserrefperf.exe 1604 sppsvc.exe -
Loads dropped DLL 2 IoCs
pid Process 2788 cmd.exe 2788 cmd.exe -
Drops file in Program Files directory 11 IoCs
description ioc Process File created C:\Program Files\Uninstall Information\taskhost.exe Browserrefperf.exe File created C:\Program Files\Uninstall Information\b75386f1303e64 Browserrefperf.exe File opened for modification C:\Program Files (x86)\MSBuild\taskhost.exe Browserrefperf.exe File created C:\Program Files (x86)\Windows Defender\en-US\WmiPrvSE.exe Browserrefperf.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\winlogon.exe Browserrefperf.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\lsm.exe Browserrefperf.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\101b941d020240 Browserrefperf.exe File created C:\Program Files (x86)\MSBuild\taskhost.exe Browserrefperf.exe File created C:\Program Files (x86)\MSBuild\b75386f1303e64 Browserrefperf.exe File created C:\Program Files (x86)\Windows Defender\en-US\24dbde2999530e Browserrefperf.exe File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\cc11b995f2a76d Browserrefperf.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\DigitalLocker\de-DE\0a1fd5f707cd16 Browserrefperf.exe File created C:\Windows\Offline Web Pages\services.exe Browserrefperf.exe File created C:\Windows\Offline Web Pages\c5b4cb5e9653cc Browserrefperf.exe File created C:\Windows\ShellNew\csrss.exe Browserrefperf.exe File created C:\Windows\ShellNew\886983d96e3d3e Browserrefperf.exe File created C:\Windows\rescache\rc0006\csrss.exe Browserrefperf.exe File created C:\Windows\DigitalLocker\de-DE\sppsvc.exe Browserrefperf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1640 schtasks.exe 2896 schtasks.exe 2108 schtasks.exe 600 schtasks.exe 2552 schtasks.exe 2568 schtasks.exe 2456 schtasks.exe 2060 schtasks.exe 1532 schtasks.exe 2520 schtasks.exe 1660 schtasks.exe 2152 schtasks.exe 376 schtasks.exe 1656 schtasks.exe 2692 schtasks.exe 2908 schtasks.exe 1304 schtasks.exe 668 schtasks.exe 1720 schtasks.exe 2284 schtasks.exe 1644 schtasks.exe 2364 schtasks.exe 2724 schtasks.exe 1256 schtasks.exe 3048 schtasks.exe 948 schtasks.exe 2344 schtasks.exe 2484 schtasks.exe 880 schtasks.exe 1192 schtasks.exe 1036 schtasks.exe 1920 schtasks.exe 3064 schtasks.exe 3056 schtasks.exe 2536 schtasks.exe 328 schtasks.exe 2332 schtasks.exe 2088 schtasks.exe 876 schtasks.exe 764 schtasks.exe 2468 schtasks.exe 1868 schtasks.exe 1152 schtasks.exe 1292 schtasks.exe 2428 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2784 Browserrefperf.exe 1604 sppsvc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2784 Browserrefperf.exe Token: SeDebugPrivilege 1604 sppsvc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1912 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 30 PID 2036 wrote to memory of 1912 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 30 PID 2036 wrote to memory of 1912 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 30 PID 2036 wrote to memory of 1912 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 30 PID 2036 wrote to memory of 2420 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 31 PID 2036 wrote to memory of 2420 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 31 PID 2036 wrote to memory of 2420 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 31 PID 2036 wrote to memory of 2420 2036 f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe 31 PID 1912 wrote to memory of 2788 1912 WScript.exe 32 PID 1912 wrote to memory of 2788 1912 WScript.exe 32 PID 1912 wrote to memory of 2788 1912 WScript.exe 32 PID 1912 wrote to memory of 2788 1912 WScript.exe 32 PID 2788 wrote to memory of 2784 2788 cmd.exe 34 PID 2788 wrote to memory of 2784 2788 cmd.exe 34 PID 2788 wrote to memory of 2784 2788 cmd.exe 34 PID 2788 wrote to memory of 2784 2788 cmd.exe 34 PID 2784 wrote to memory of 1604 2784 Browserrefperf.exe 81 PID 2784 wrote to memory of 1604 2784 Browserrefperf.exe 81 PID 2784 wrote to memory of 1604 2784 Browserrefperf.exe 81 PID 2784 wrote to memory of 1604 2784 Browserrefperf.exe 81 PID 2784 wrote to memory of 1604 2784 Browserrefperf.exe 81 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe"C:\Users\Admin\AppData\Local\Temp\f9de98bb8b3a6918df525169f13fdb4f2a0389025b2d39c33c129c4c877cc356.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockPortWebfonthost\B1fFnqpKl3GGD4HF0Q9OQruQ5J.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\blockPortWebfonthost\oiHeiGZ5nXV56qFTglSJrQC.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\blockPortWebfonthost\Browserrefperf.exe"C:\blockPortWebfonthost\Browserrefperf.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\DigitalLocker\de-DE\sppsvc.exe"C:\Windows\DigitalLocker\de-DE\sppsvc.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\blockPortWebfonthost\file.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:2420
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\blockPortWebfonthost\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\blockPortWebfonthost\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\blockPortWebfonthost\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\en-US\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\en-US\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wscript.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wscript.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wscriptw" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\wscript.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\de-DE\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\de-DE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\DigitalLocker\de-DE\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "BrowserrefperfB" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Browserrefperf.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Browserrefperf" /sc ONLOGON /tr "'C:\Users\Default User\Browserrefperf.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "BrowserrefperfB" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Browserrefperf.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Windows\Offline Web Pages\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\ShellNew\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ShellNew\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellNew\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Program Files\Uninstall Information\taskhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Uninstall Information\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\blockPortWebfonthost\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\blockPortWebfonthost\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\blockPortWebfonthost\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\blockPortWebfonthost\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\blockPortWebfonthost\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\blockPortWebfonthost\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220B
MD580fc773bb48724fd1484a43ed8d8037c
SHA12bf290594881426e0393bdcb0e6826d03ffe2aeb
SHA256859ceb32c6435a9becc80ded132d3d607c1cec68313b523d5ca36f58936695a6
SHA512cf468ae1c0c2fd4ddc5c2b5be5428a71895769760b821d77807ca84532468bb1339f57653e7befe1dc1827199b1f4f55d4c78f44ad045bfe5e77ceed1bf997fb
-
Filesize
34B
MD5677cc4360477c72cb0ce00406a949c61
SHA1b679e8c3427f6c5fc47c8ac46cd0e56c9424de05
SHA256f1cccb5ae4aa51d293bd3c7d2a1a04cb7847d22c5db8e05ac64e9a6d7455aa0b
SHA5127cfe2cc92f9e659f0a15a295624d611b3363bd01eb5bcf9bc7681ea9b70b0564d192d570d294657c8dc2c93497fa3b4526c975a9bf35d69617c31d9936573c6a
-
Filesize
44B
MD5f9d1d98df33c887cf53515e6c3f72252
SHA14a13d543fbe8e3fe50ed0468a76186dc2733fcab
SHA2563dd1df076acd52aa43d18b8c9e93ba9f476d4d837cdbf7bebac2bd3d730aca83
SHA51291b9537ea1c95156badec09a1688bda4a2ff5770b8f675678906f0834f2754e4ce39fe6f478ab72872359964d1f396fee8473cfcab556d00833be346459fb906
-
Filesize
1.7MB
MD553bf12b91d006d8e3acaf03f5c6973fe
SHA11b15f03372dc2d5d75759c563bf8ed6dc3403251
SHA2567aed94357ac1cbf630ba47c7b21f8dd1c8f140ae735c8d406cc4b8748a65bc41
SHA5121cdb00bfbf9b114f69f0aa0d9f1cebc7462f7d616741108d889f09e677d1d4f588a6fc34f75f0026fe0e4de5f80611b42628f9b0f0202cdbf1b3330f8b740bd5