Analysis
-
max time kernel
76s -
max time network
81s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
07-02-2025 07:41
Behavioral task
behavioral1
Sample
blockcomponentbroker.exe
Resource
win10ltsc2021-20250128-en
windows10-ltsc 2021-x64
20 signatures
150 seconds
General
-
Target
blockcomponentbroker.exe
-
Size
315KB
-
MD5
54a9243a4fb9ac14e2b20d9e572d92ca
-
SHA1
a9a04900fcdb00eaeb1ddb785052416fe098f8d3
-
SHA256
c2bd0a38a4cb588ce6810b40e587b0bc019d1806e963ead76a27e13de707787e
-
SHA512
cdcb15c7b4a20149fb42ef58afe69267542c68cc514d386479952c5e7061b78a8c8d366ea66f64adf914e6b59bd899f3424dc81a086b694165d6f449ec771aac
-
SSDEEP
6144:Nhky2oo7KkpZv/gsOPOw891ZdjkxLv+vFRLH4qUdx7bvr9u:NT2N71jQsOwZdbLYXdxfZ
Score
10/10
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 716 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1564 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3572 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3984 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4908 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2296 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3468 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5012 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1004 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3524 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3792 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2056 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4892 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4384 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3756 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 1684 schtasks.exe 80 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 1684 schtasks.exe 80 -
resource yara_rule behavioral1/memory/2492-1-0x0000000000060000-0x00000000000B6000-memory.dmp dcrat behavioral1/files/0x0007000000027ddc-10.dat dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Control Panel\International\Geo\Nation blockcomponentbroker.exe -
Executes dropped EXE 1 IoCs
pid Process 2432 TextInputHost.exe -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe blockcomponentbroker.exe File created C:\Program Files (x86)\Windows Sidebar\29c1c3cc0f7685 blockcomponentbroker.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\6cb0b6c459d5d3 blockcomponentbroker.exe File created C:\Program Files (x86)\Windows Multimedia Platform\22eafd247d37c3 blockcomponentbroker.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe blockcomponentbroker.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\22eafd247d37c3 blockcomponentbroker.exe File created C:\Program Files (x86)\Windows Sidebar\unsecapp.exe blockcomponentbroker.exe File created C:\Program Files (x86)\Google\TextInputHost.exe blockcomponentbroker.exe File created C:\Program Files (x86)\Google\22eafd247d37c3 blockcomponentbroker.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\dwm.exe blockcomponentbroker.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\dllhost.exe blockcomponentbroker.exe File created C:\Windows\apppatch\5940a34987c991 blockcomponentbroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000095f5c9691a3f5045a15e6265aefaa9bf00000000020000000000106600000001000020000000aeb2cbdfb8b1e0da6795a96980152f34526c5612c05670d2d6af2bd660c6f23c000000000e8000000002000020000000c6775dbd0c4878b4e7079d53214ff933774985520402b7e9c8f80ec54dabd5872000000046db36583c934523dee96f5c1518d0e4c86dcc8c9aa78540270d59323141fb2f40000000253758cf0198587125e8d36be72d3a113fd4cc5caf7b38692a513507c4b0157115f89ef6d24cfac50a8f6356aa5b43add3b5c29aef5cc55eb83e0ea75d372119 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ac9cdc3379db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{19561E7C-E527-11EF-A5BE-EE9EBF747D0B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-590766166-4003350121-2036565200-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4384 schtasks.exe 3756 schtasks.exe 1212 schtasks.exe 3984 schtasks.exe 2296 schtasks.exe 1608 schtasks.exe 3792 schtasks.exe 716 schtasks.exe 2564 schtasks.exe 2396 schtasks.exe 4988 schtasks.exe 1564 schtasks.exe 4908 schtasks.exe 3468 schtasks.exe 1004 schtasks.exe 3524 schtasks.exe 2056 schtasks.exe 4892 schtasks.exe 3116 schtasks.exe 3572 schtasks.exe 5012 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2492 blockcomponentbroker.exe 2492 blockcomponentbroker.exe 2492 blockcomponentbroker.exe 2492 blockcomponentbroker.exe 2492 blockcomponentbroker.exe 2492 blockcomponentbroker.exe 2492 blockcomponentbroker.exe 2432 TextInputHost.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 2432 TextInputHost.exe 2432 TextInputHost.exe 2432 TextInputHost.exe 2432 TextInputHost.exe 2432 TextInputHost.exe 2432 TextInputHost.exe 2432 TextInputHost.exe 2432 TextInputHost.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 2492 blockcomponentbroker.exe Token: SeDebugPrivilege 2432 TextInputHost.exe Token: SeDebugPrivilege 3464 taskmgr.exe Token: SeSystemProfilePrivilege 3464 taskmgr.exe Token: SeCreateGlobalPrivilege 3464 taskmgr.exe Token: 33 3464 taskmgr.exe Token: SeIncBasePriorityPrivilege 3464 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe 3464 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1920 iexplore.exe 1920 iexplore.exe 3764 IEXPLORE.EXE 3764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2432 2492 blockcomponentbroker.exe 103 PID 2492 wrote to memory of 2432 2492 blockcomponentbroker.exe 103 PID 1648 wrote to memory of 1920 1648 MSOXMLED.EXE 128 PID 1648 wrote to memory of 1920 1648 MSOXMLED.EXE 128 PID 1920 wrote to memory of 3764 1920 iexplore.exe 129 PID 1920 wrote to memory of 3764 1920 iexplore.exe 129 PID 1920 wrote to memory of 3764 1920 iexplore.exe 129 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\blockcomponentbroker.exe"C:\Users\Admin\AppData\Local\Temp\blockcomponentbroker.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Program Files (x86)\Google\TextInputHost.exe"C:\Program Files (x86)\Google\TextInputHost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Windows\apppatch\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:716
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\apppatch\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\apppatch\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Documents\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Documents\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Documents\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1212
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3464
-
C:\Windows\System32\SystemSettingsBroker.exeC:\Windows\System32\SystemSettingsBroker.exe -Embedding1⤵PID:2092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:2080
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\Desktop\RestartMount.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RestartMount.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
315KB
MD554a9243a4fb9ac14e2b20d9e572d92ca
SHA1a9a04900fcdb00eaeb1ddb785052416fe098f8d3
SHA256c2bd0a38a4cb588ce6810b40e587b0bc019d1806e963ead76a27e13de707787e
SHA512cdcb15c7b4a20149fb42ef58afe69267542c68cc514d386479952c5e7061b78a8c8d366ea66f64adf914e6b59bd899f3424dc81a086b694165d6f449ec771aac