Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
70s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/01/2025, 02:53
Behavioral task
behavioral1
Sample
73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
Resource
win10v2004-20241007-en
General
-
Target
73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
-
Size
3.6MB
-
MD5
f2997dfb6f126670204c83344b678f0e
-
SHA1
fb1a90117ff594cac3b2cebbbbd072674f246ce3
-
SHA256
73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0
-
SHA512
20bd6c2e2aebf5e96f8d9497880538061f23ed8b925cf916749da16db6339a2dd2ff5166aa0c096e23f7654e5b2959d9af108cf5ccf68291cc80f8c7c2d235ad
-
SSDEEP
98304:NzRppqmmRX+6fo6du/5P2nPNWNG5trztTgyz+65WzU:NzRppqVDqOnVWNG5bR+65WzU
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Detect Neshta payload 8 IoCs
resource yara_rule behavioral1/files/0x0001000000010314-12.dat family_neshta behavioral1/memory/1492-134-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-238-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-242-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-265-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-266-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-267-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta behavioral1/memory/1492-269-0x0000000000400000-0x000000000041B000-memory.dmp family_neshta -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Neshta family
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2080 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1324 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2136 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1756 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1980 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1420 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1576 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2480 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1328 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1408 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 952 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 108 1040 schtasks.exe 31 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1172 1040 schtasks.exe 31 -
Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 888 powershell.exe 1288 powershell.exe 2632 powershell.exe 796 powershell.exe 364 powershell.exe 1772 powershell.exe 1176 powershell.exe 548 powershell.exe 1720 powershell.exe 1588 powershell.exe 944 powershell.exe 2024 powershell.exe 2116 powershell.exe 2008 powershell.exe 2276 powershell.exe 2648 powershell.exe 1156 powershell.exe 1520 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 1948 smss.exe -
Loads dropped DLL 3 IoCs
pid Process 1492 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 1492 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 1492 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File created C:\Windows\L2Schemas\explorer.exe 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe File created C:\Windows\L2Schemas\7a0fd90576e088 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2932 PING.EXE -
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2932 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1420 schtasks.exe 1172 schtasks.exe 2692 schtasks.exe 1980 schtasks.exe 2708 schtasks.exe 1532 schtasks.exe 2480 schtasks.exe 2672 schtasks.exe 1324 schtasks.exe 2136 schtasks.exe 1328 schtasks.exe 1756 schtasks.exe 1576 schtasks.exe 108 schtasks.exe 952 schtasks.exe 2428 schtasks.exe 2080 schtasks.exe 1408 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe Token: SeDebugPrivilege 796 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeDebugPrivilege 944 powershell.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeDebugPrivilege 888 powershell.exe Token: SeDebugPrivilege 2276 powershell.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeDebugPrivilege 548 powershell.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeDebugPrivilege 2024 powershell.exe Token: SeDebugPrivilege 364 powershell.exe Token: SeDebugPrivilege 1288 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 2008 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeDebugPrivilege 1948 smss.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1948 smss.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2320 1492 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 30 PID 1492 wrote to memory of 2320 1492 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 30 PID 1492 wrote to memory of 2320 1492 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 30 PID 1492 wrote to memory of 2320 1492 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 30 PID 2320 wrote to memory of 1176 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 50 PID 2320 wrote to memory of 1176 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 50 PID 2320 wrote to memory of 1176 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 50 PID 2320 wrote to memory of 944 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 51 PID 2320 wrote to memory of 944 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 51 PID 2320 wrote to memory of 944 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 51 PID 2320 wrote to memory of 2008 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 53 PID 2320 wrote to memory of 2008 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 53 PID 2320 wrote to memory of 2008 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 53 PID 2320 wrote to memory of 2024 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 55 PID 2320 wrote to memory of 2024 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 55 PID 2320 wrote to memory of 2024 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 55 PID 2320 wrote to memory of 1288 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 57 PID 2320 wrote to memory of 1288 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 57 PID 2320 wrote to memory of 1288 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 57 PID 2320 wrote to memory of 548 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 58 PID 2320 wrote to memory of 548 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 58 PID 2320 wrote to memory of 548 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 58 PID 2320 wrote to memory of 2632 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 59 PID 2320 wrote to memory of 2632 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 59 PID 2320 wrote to memory of 2632 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 59 PID 2320 wrote to memory of 796 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 61 PID 2320 wrote to memory of 796 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 61 PID 2320 wrote to memory of 796 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 61 PID 2320 wrote to memory of 364 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 63 PID 2320 wrote to memory of 364 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 63 PID 2320 wrote to memory of 364 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 63 PID 2320 wrote to memory of 2276 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 64 PID 2320 wrote to memory of 2276 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 64 PID 2320 wrote to memory of 2276 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 64 PID 2320 wrote to memory of 1520 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 65 PID 2320 wrote to memory of 1520 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 65 PID 2320 wrote to memory of 1520 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 65 PID 2320 wrote to memory of 888 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 66 PID 2320 wrote to memory of 888 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 66 PID 2320 wrote to memory of 888 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 66 PID 2320 wrote to memory of 1772 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 68 PID 2320 wrote to memory of 1772 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 68 PID 2320 wrote to memory of 1772 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 68 PID 2320 wrote to memory of 2116 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 69 PID 2320 wrote to memory of 2116 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 69 PID 2320 wrote to memory of 2116 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 69 PID 2320 wrote to memory of 1156 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 70 PID 2320 wrote to memory of 1156 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 70 PID 2320 wrote to memory of 1156 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 70 PID 2320 wrote to memory of 2648 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 72 PID 2320 wrote to memory of 2648 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 72 PID 2320 wrote to memory of 2648 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 72 PID 2320 wrote to memory of 1588 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 73 PID 2320 wrote to memory of 1588 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 73 PID 2320 wrote to memory of 1588 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 73 PID 2320 wrote to memory of 1720 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 74 PID 2320 wrote to memory of 1720 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 74 PID 2320 wrote to memory of 1720 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 74 PID 2320 wrote to memory of 2972 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 81 PID 2320 wrote to memory of 2972 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 81 PID 2320 wrote to memory of 2972 2320 73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe 81 PID 2972 wrote to memory of 680 2972 cmd.exe 88 PID 2972 wrote to memory of 680 2972 cmd.exe 88 PID 2972 wrote to memory of 680 2972 cmd.exe 88 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"C:\Users\Admin\AppData\Local\Temp\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1288
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\explorer.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\Sample Pictures\smss.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2116
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\winlogon.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'3⤵
- Command and Scripting Interpreter: PowerShell
PID:2648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\WmiPrvSE.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m7kuOebR2S.bat"3⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:680
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2932
-
-
C:\Users\Public\Pictures\Sample Pictures\smss.exe"C:\Users\Public\Pictures\Sample Pictures\smss.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1948
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Windows\L2Schemas\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Pictures\Sample Pictures\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c07" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c07" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1172
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Change Default File Association
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD5cf6c595d3e5e9667667af096762fd9c4
SHA19bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80
-
Filesize
177B
MD58820377596f1f02328bfcaab5c7e7944
SHA156418e020c0aa61545d3ac4c6c9a5e9e2007eedb
SHA256a2d578cc25c3dc5762a3b3de5da70474f1268f9b252df9596f43ecdab86177dc
SHA51264387b8770b17ea2d1556ca3b300fd0cea5e054e2accb21363cc8e5ea84c884fba64900a71c82968f106d63821accbef69992ea53ce0774e3b6c2fdbcfe98064
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD54cb08af7460082c48a62789a4155ed02
SHA1a3508deb3a79613c882f65f9fd96cef2cfad38e7
SHA256297e483d85b14082d5b385483ecdf8662e8d511d5aed9a06f33b6560807997e5
SHA5122dcbe031029a5c2f99ffe702da5b6320ff8f6ab312bd43ba8bcaf17fddea28528f9b7763db0b1ca4d3c400baedd01582782b0f3c8a15bb7143e2e8cfb595fdf4
-
Filesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\73b461a9d859f019ed4f0dda1e0cc86a36b826bde0f318e806503876056b41c0.exe
Filesize3.5MB
MD53e3fe7663181211e5983da48431ddf33
SHA10bea67a96dba0798541ea15426fb0ac38c10ff06
SHA256cc398c54d30b3c0c1ff1d54f03fb157578346d088c9ce38fc6347698f25fc166
SHA51280056c508dade773729c239bd0b43d92c9e6d8de513b19776bf28665e37e44d022fd6c5f33ebfa3fe31b9480ce0705e9581d872b8e79703931da459d4f5922a0