Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 16:43
Behavioral task
behavioral1
Sample
HEUR.Trojan-Spy.MSIL.Stealer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
HEUR.Trojan-Spy.MSIL.Stealer.exe
Resource
win10v2004-20250129-en
General
-
Target
HEUR.Trojan-Spy.MSIL.Stealer.exe
-
Size
1.3MB
-
MD5
20043020e5b82ce7e3d69c407a85e50c
-
SHA1
1502bdf6ccaa56c45716852cd1be8552d2cfa52c
-
SHA256
40603df340cee8c3d00939469470a28acbf64401ec12d32ba68fe54e7f04c6d4
-
SHA512
d62a363bcddd24bcb7d2e92f4fe5c1f6347560db439f83499973de59462605645c6b89d720eb768275da34bdecb715381471f14d0767e1e727684379535548d6
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1144 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5068 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5004 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 764 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3464 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4212 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 676 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3964 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 744 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1052 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3272 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5056 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3188 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1552 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3172 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4636 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3144 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1336 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4332 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1472 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4388 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3904 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2216 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2820 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 592 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 656 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3740 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1440 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1164 1004 schtasks.exe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2168 1004 schtasks.exe 95 -
resource yara_rule behavioral2/files/0x0008000000023bd1-10.dat dcrat behavioral2/memory/732-13-0x0000000000AF0000-0x0000000000C00000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3620 powershell.exe 4128 powershell.exe 1412 powershell.exe 4196 powershell.exe 3596 powershell.exe 4336 powershell.exe 2976 powershell.exe 2472 powershell.exe 1556 powershell.exe 1828 powershell.exe 4908 powershell.exe 3240 powershell.exe 4504 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation HEUR.Trojan-Spy.MSIL.Stealer.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation Idle.exe -
Executes dropped EXE 15 IoCs
pid Process 732 DllCommonsvc.exe 3580 Idle.exe 1500 Idle.exe 1332 Idle.exe 4072 Idle.exe 2096 Idle.exe 3612 Idle.exe 4352 Idle.exe 4784 Idle.exe 3768 Idle.exe 4776 Idle.exe 2304 Idle.exe 1616 Idle.exe 3192 Idle.exe 4004 Idle.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 55 raw.githubusercontent.com 39 raw.githubusercontent.com 40 raw.githubusercontent.com 60 raw.githubusercontent.com 24 raw.githubusercontent.com 52 raw.githubusercontent.com 50 raw.githubusercontent.com 53 raw.githubusercontent.com 59 raw.githubusercontent.com 21 raw.githubusercontent.com 35 raw.githubusercontent.com 49 raw.githubusercontent.com 54 raw.githubusercontent.com 22 raw.githubusercontent.com 45 raw.githubusercontent.com -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\6203df4a6bafc7 DllCommonsvc.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe DllCommonsvc.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\121e5b5079f7c0 DllCommonsvc.exe File created C:\Program Files\Crashpad\attachments\RuntimeBroker.exe DllCommonsvc.exe File created C:\Program Files\Crashpad\attachments\9e8d7a4ca61bd9 DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe DllCommonsvc.exe File created C:\Windows\assembly\GAC\Microsoft.mshtml\ea1d8f6d871115 DllCommonsvc.exe File created C:\Windows\ModemLogs\smss.exe DllCommonsvc.exe File created C:\Windows\ModemLogs\69ddcba757bf72 DllCommonsvc.exe File created C:\Windows\es-ES\Idle.exe DllCommonsvc.exe File created C:\Windows\es-ES\6ccacd8608530f DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HEUR.Trojan-Spy.MSIL.Stealer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings HEUR.Trojan-Spy.MSIL.Stealer.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings Idle.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4636 schtasks.exe 3144 schtasks.exe 4332 schtasks.exe 4652 schtasks.exe 2520 schtasks.exe 3188 schtasks.exe 3172 schtasks.exe 592 schtasks.exe 2764 schtasks.exe 1144 schtasks.exe 4212 schtasks.exe 1472 schtasks.exe 656 schtasks.exe 1052 schtasks.exe 5056 schtasks.exe 3904 schtasks.exe 3740 schtasks.exe 764 schtasks.exe 3600 schtasks.exe 2216 schtasks.exe 744 schtasks.exe 2960 schtasks.exe 1440 schtasks.exe 5068 schtasks.exe 3964 schtasks.exe 3272 schtasks.exe 1336 schtasks.exe 2820 schtasks.exe 1164 schtasks.exe 5004 schtasks.exe 3464 schtasks.exe 676 schtasks.exe 220 schtasks.exe 1552 schtasks.exe 4388 schtasks.exe 2168 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 732 DllCommonsvc.exe 4908 powershell.exe 4908 powershell.exe 1412 powershell.exe 1412 powershell.exe 2976 powershell.exe 2976 powershell.exe 3240 powershell.exe 3240 powershell.exe 1556 powershell.exe 1556 powershell.exe 1828 powershell.exe 1828 powershell.exe 3596 powershell.exe 3596 powershell.exe 2472 powershell.exe 2472 powershell.exe 4504 powershell.exe 4504 powershell.exe 4196 powershell.exe 4196 powershell.exe 3620 powershell.exe 3620 powershell.exe 4336 powershell.exe 4336 powershell.exe 3596 powershell.exe 4128 powershell.exe 4128 powershell.exe 3580 Idle.exe 3580 Idle.exe 1412 powershell.exe 4908 powershell.exe 4128 powershell.exe 4196 powershell.exe 1828 powershell.exe 1556 powershell.exe 2976 powershell.exe 4504 powershell.exe 3620 powershell.exe 2472 powershell.exe 3240 powershell.exe 4336 powershell.exe 1500 Idle.exe 1332 Idle.exe 4072 Idle.exe 2096 Idle.exe 3612 Idle.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 732 DllCommonsvc.exe Token: SeDebugPrivilege 4908 powershell.exe Token: SeDebugPrivilege 1412 powershell.exe Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 4196 powershell.exe Token: SeDebugPrivilege 3240 powershell.exe Token: SeDebugPrivilege 4504 powershell.exe Token: SeDebugPrivilege 4128 powershell.exe Token: SeDebugPrivilege 3596 powershell.exe Token: SeDebugPrivilege 1556 powershell.exe Token: SeDebugPrivilege 1828 powershell.exe Token: SeDebugPrivilege 3580 Idle.exe Token: SeDebugPrivilege 2472 powershell.exe Token: SeDebugPrivilege 3620 powershell.exe Token: SeDebugPrivilege 4336 powershell.exe Token: SeDebugPrivilege 1500 Idle.exe Token: SeDebugPrivilege 1332 Idle.exe Token: SeDebugPrivilege 4072 Idle.exe Token: SeDebugPrivilege 2096 Idle.exe Token: SeDebugPrivilege 3612 Idle.exe Token: SeDebugPrivilege 4352 Idle.exe Token: SeDebugPrivilege 4784 Idle.exe Token: SeDebugPrivilege 3768 Idle.exe Token: SeDebugPrivilege 4776 Idle.exe Token: SeDebugPrivilege 2304 Idle.exe Token: SeDebugPrivilege 1616 Idle.exe Token: SeDebugPrivilege 3192 Idle.exe Token: SeDebugPrivilege 4004 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1012 1692 HEUR.Trojan-Spy.MSIL.Stealer.exe 88 PID 1692 wrote to memory of 1012 1692 HEUR.Trojan-Spy.MSIL.Stealer.exe 88 PID 1692 wrote to memory of 1012 1692 HEUR.Trojan-Spy.MSIL.Stealer.exe 88 PID 1012 wrote to memory of 2344 1012 WScript.exe 92 PID 1012 wrote to memory of 2344 1012 WScript.exe 92 PID 1012 wrote to memory of 2344 1012 WScript.exe 92 PID 2344 wrote to memory of 732 2344 cmd.exe 94 PID 2344 wrote to memory of 732 2344 cmd.exe 94 PID 732 wrote to memory of 4196 732 DllCommonsvc.exe 133 PID 732 wrote to memory of 4196 732 DllCommonsvc.exe 133 PID 732 wrote to memory of 4908 732 DllCommonsvc.exe 134 PID 732 wrote to memory of 4908 732 DllCommonsvc.exe 134 PID 732 wrote to memory of 4128 732 DllCommonsvc.exe 135 PID 732 wrote to memory of 4128 732 DllCommonsvc.exe 135 PID 732 wrote to memory of 3240 732 DllCommonsvc.exe 136 PID 732 wrote to memory of 3240 732 DllCommonsvc.exe 136 PID 732 wrote to memory of 4504 732 DllCommonsvc.exe 137 PID 732 wrote to memory of 4504 732 DllCommonsvc.exe 137 PID 732 wrote to memory of 1828 732 DllCommonsvc.exe 138 PID 732 wrote to memory of 1828 732 DllCommonsvc.exe 138 PID 732 wrote to memory of 1556 732 DllCommonsvc.exe 139 PID 732 wrote to memory of 1556 732 DllCommonsvc.exe 139 PID 732 wrote to memory of 2472 732 DllCommonsvc.exe 140 PID 732 wrote to memory of 2472 732 DllCommonsvc.exe 140 PID 732 wrote to memory of 2976 732 DllCommonsvc.exe 141 PID 732 wrote to memory of 2976 732 DllCommonsvc.exe 141 PID 732 wrote to memory of 3620 732 DllCommonsvc.exe 142 PID 732 wrote to memory of 3620 732 DllCommonsvc.exe 142 PID 732 wrote to memory of 1412 732 DllCommonsvc.exe 143 PID 732 wrote to memory of 1412 732 DllCommonsvc.exe 143 PID 732 wrote to memory of 4336 732 DllCommonsvc.exe 144 PID 732 wrote to memory of 4336 732 DllCommonsvc.exe 144 PID 732 wrote to memory of 3596 732 DllCommonsvc.exe 145 PID 732 wrote to memory of 3596 732 DllCommonsvc.exe 145 PID 732 wrote to memory of 3580 732 DllCommonsvc.exe 159 PID 732 wrote to memory of 3580 732 DllCommonsvc.exe 159 PID 3580 wrote to memory of 404 3580 Idle.exe 161 PID 3580 wrote to memory of 404 3580 Idle.exe 161 PID 404 wrote to memory of 3316 404 cmd.exe 163 PID 404 wrote to memory of 3316 404 cmd.exe 163 PID 404 wrote to memory of 1500 404 cmd.exe 165 PID 404 wrote to memory of 1500 404 cmd.exe 165 PID 1500 wrote to memory of 1440 1500 Idle.exe 167 PID 1500 wrote to memory of 1440 1500 Idle.exe 167 PID 1440 wrote to memory of 2216 1440 cmd.exe 169 PID 1440 wrote to memory of 2216 1440 cmd.exe 169 PID 1440 wrote to memory of 1332 1440 cmd.exe 171 PID 1440 wrote to memory of 1332 1440 cmd.exe 171 PID 1332 wrote to memory of 216 1332 Idle.exe 176 PID 1332 wrote to memory of 216 1332 Idle.exe 176 PID 216 wrote to memory of 708 216 cmd.exe 178 PID 216 wrote to memory of 708 216 cmd.exe 178 PID 216 wrote to memory of 4072 216 cmd.exe 180 PID 216 wrote to memory of 4072 216 cmd.exe 180 PID 4072 wrote to memory of 592 4072 Idle.exe 182 PID 4072 wrote to memory of 592 4072 Idle.exe 182 PID 592 wrote to memory of 2332 592 cmd.exe 184 PID 592 wrote to memory of 2332 592 cmd.exe 184 PID 592 wrote to memory of 2096 592 cmd.exe 186 PID 592 wrote to memory of 2096 592 cmd.exe 186 PID 2096 wrote to memory of 2924 2096 Idle.exe 188 PID 2096 wrote to memory of 2924 2096 Idle.exe 188 PID 2924 wrote to memory of 232 2924 cmd.exe 190 PID 2924 wrote to memory of 232 2924 cmd.exe 190 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR.Trojan-Spy.MSIL.Stealer.exe"C:\Users\Admin\AppData\Local\Temp\HEUR.Trojan-Spy.MSIL.Stealer.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:3316
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zlmto9DLwM.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2216
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3B2OAH3dio.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:708
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oPL6j2OtN4.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2332
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\aWJwCUxpp4.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:232
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"16⤵PID:4200
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4092
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4352 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OrAhl4fNEA.bat"18⤵PID:1740
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2300
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1F0LTC0kP2.bat"20⤵PID:808
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:2008
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TiDn8Em9ri.bat"22⤵PID:4996
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:2472
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gQkyN2upze.bat"24⤵PID:1164
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1448
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"26⤵PID:1620
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:2556
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1616 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fZs2sOO0th.bat"28⤵PID:4736
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:516
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3192 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\95TPLp0dsP.bat"30⤵PID:4448
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:2708
-
-
C:\Windows\es-ES\Idle.exe"C:\Windows\es-ES\Idle.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4004 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"32⤵PID:1692
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Windows\assembly\GAC\Microsoft.mshtml\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:764
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\providercommon\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3144
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\plugins\mux\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Windows\ModemLogs\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\attachments\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\es-ES\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\es-ES\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5a43e653ffb5ab07940f4bdd9cc8fade4
SHA1af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA51262a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5e8ce785f8ccc6d202d56fefc59764945
SHA1ca032c62ddc5e0f26d84eff9895eb87f14e15960
SHA256d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4
SHA51266460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
190B
MD508d5d22bb83f6fe6ce175ee7a96382dc
SHA16abce6de26f2204fc86d1a8058268bed900cc93a
SHA25613d8c770acc183e8b5e2323d2e93d9389c55fbcd7e965432b66afd3a917b7a09
SHA512ea5595f4ca64fc58c81322b0a57a2d99743562e310612eccaddbc702f0ce8460754e353c9f5950bbbd073b49ed886aca81a70608b131b73ac32d9483806331b8
-
Filesize
190B
MD5364952addb27a9f2fca0932d782d4d17
SHA14fac71f364d755ba9ed5e3fbfc386c701a44394e
SHA256c0e817fbac299a38facd908af3a884222422066bfc732defdf1e1740b205339b
SHA512538e26ba422860dab6b298080b8291588f84eca83d52d01ceae5afd3f59bb4ad5490f2fb9b5a26dc500a8d0ada8ba511899eb273f1849cb7e49e6c3f5ca42682
-
Filesize
190B
MD580018103f7a2e6eb7547da608f9ea950
SHA111582e5b12a3351cfe7975173b67c993aaa1250e
SHA2564d21e9702c0d426086f81928d65506213c0841eb787cb39636f05887bf3ab08a
SHA5123a25a110f7d0190c6be25a5abdaa82c26f8219b17f57e1dc2620046c184a39a39e7283665b2ba420a8e72c3a0e2d250d5682fc29185ff939b18ab3bcefc1fc4d
-
Filesize
190B
MD545d5ebc1f83660d186c4d15c2ab9909f
SHA1530caede81d7594b4981332c2353efcc831e1422
SHA2563542aa4ef25ef532226e0f4e16dae70e1868fdd323b97aedd2d6d93b0dcea6ea
SHA512202a4ec33be48bf64386c691e072f435c8f7ea89c5a86c8c484ac513f6e701a1060ce96bc3c89eb60007a6c4c427ceb87dca39d5594d969769ca257f5aec2936
-
Filesize
190B
MD5b5dfcd541e5aa5eac786454111196cf0
SHA11fe90e32569b03b59c5cf0a4ce7bb9d6c6a5016d
SHA256e91cf55c55357f346cc89b1f906c8eabb52a6f1c2f315bd8619b28537ff1119e
SHA512d8b4828405bd858390826ce58d61f1ef82c43e8e92e156d2177daad1e1a6e23b28f8a15a0720f7688a826f6e06954214ab90a5706817e7ee8f775bab3ddc78bd
-
Filesize
190B
MD51927ed9f206cb0e3db444a7b7175c955
SHA1791dfa7595d38f864c1c96c764e0f99be0cbbe13
SHA256603a1566aa358b2995c03e70fec2f1a20f7d21bd02f7de2182d458dd98d73a21
SHA51208e4578eed19994d41bd382efb4e0c4c8859a0be482f294363375e64c8f45edf4c1154150df0346f911568305f5234d25bd50f374297415a0796f14a93373ec5
-
Filesize
190B
MD55007b3cbc33cf063ac06e076a0abef84
SHA188d1629b3e04d88e93eb357bcd1f5ad6c56d422e
SHA25655f22dd05c8531aefdf50925e15c592959e05e730105bdc7209e725cf12488b8
SHA51216263c500c386786798ca973035467ff6df4ccabf51335736f93874c856ff5896137d65f9e7d7cee6ba3bae8ab6e5cd06b9a89da01d218d10525bc5221829edb
-
Filesize
190B
MD5ec4b122b361affbfa4fa5b1d138e5932
SHA1ac3dd3411452594dadc5837f5d2483baace30093
SHA256d380f84300da53d38453ff84289734c07b4c4f19ca851ecb2b73dbf222856b84
SHA512d078db4ac1e74563ba61188f0b9dbf63480dbc72af5cc8cb00b87077657da049a180dc8811c57b3c0352880818975dc553062f3b10ca6100204a102cc91ec23a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
190B
MD57ed98ce7445491a57316428b5b665764
SHA135def1f980add7077487b4d5b222305c954d4381
SHA2568a6a0cf86eefea70fe960643854d2239adfecb4d08b9e8a420bde6bd7609e969
SHA5126c0c4baee06eec21397a3a48930c8518499071c1ee7c84be0679e93d7c17032bcf0f1e8b8d48bf15b48c7495658080218605a6ef476c4b1dd32f18ca64672ffb
-
Filesize
190B
MD524b227dd21ecfec0bd92aac0f88aed83
SHA1bfa8da720d9a10ea672bdfffed1105db5a0bb123
SHA256c24d7b1d644798634402c8ac6b9d114c95332ab067723811be2160498c9110f9
SHA5124ab8fcc7e10d04ab3248f919ab94508faf62f907906c382c2531d30627fb581f5ad4959c2162a2df88251feec52c49eb2afbb3cd670f06acad4ce62094aaf61f
-
Filesize
190B
MD5f2514f1d3c4885bda43fe304a09db31d
SHA1b945a0c4e9f8af87351a34b04a1a0ed054bf5a59
SHA256ad1d26fc05fecbd8cba0b3de213675bc1ca8570e17e9632ce8116644ee163e7f
SHA51225ce5ede6ad36a3775a4bea60ca075b968036cff29981cf8f0ddb9c6f0e3e73949a22fbb511b4707b2fe86fc15a3e2ec1610d25ed8c3a4ee7487f9f9e4991082
-
Filesize
190B
MD5030d2275540ee16f86946816ecd853e0
SHA1383db5d98639bfc538495686d7cf381555726516
SHA25609b7affc948e51fffda42ac5ba2c2ef347e4b305b5b871966222370e39de2e8a
SHA512d29133352605963be3ec31866e3d40761d2f29cb46dede6dd2cc244edcf350688225449545a0362c710273717a5b03d3264b6950d97799ad1a44b13d294be28b
-
Filesize
190B
MD53932668043771dcf322a966e78c4ef48
SHA172e310ad87b6efd225031c1442039bd76f2bdd58
SHA2565d70d09c802f4f61d8613ef0e3e7ec18ca6dafb6210ce71418072e2bf7708848
SHA51275a9531ba12912dfdf6a4ebacac9cca2e6f89baeac929b208cd3735fb7cf22b93d6e386cbe3e9d62ed88e1c39080e68e3ac36d907b50d085f1eedc0602096ae3
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478