Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:17
General
-
Target
d61876ddede62df51f22178f3f3810d3.exe
-
Size
1.1MB
-
MD5
d61876ddede62df51f22178f3f3810d3
-
SHA1
f61526c97f574e637c624293249c612894a3706e
-
SHA256
db703d6a45db327d773c77238bed0a9905bb2c2a049bd4467fc43ab0df12e735
-
SHA512
4b909d0c38361a5daa93b89c84182f48bb3f0352d72a40917700e0de83cd9ef7ae399487b50cb2bb44a1066aac91750b5aac44c2c681f20d4848f609800dbfa4
-
SSDEEP
12288:6mc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:6h4TbLUEhZL/GspeYhkc9Soh2SfwJ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 7 IoCs
-
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 39 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 12 IoCs
-
Adds Run key to start application 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 26 IoCs
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 13 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 39 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d61876ddede62df51f22178f3f3810d3.exe"C:\Users\Admin\AppData\Local\Temp\d61876ddede62df51f22178f3f3810d3.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\d61876ddede62df51f22178f3f3810d3.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\MultiDigiMon\fontdrvhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\900323d723f1dd1206\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\C_1250\SppExtComObj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\S-1-5-21-1062200478-553497403-3857448183-1000\upfc.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Documents and Settings\TextInputHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe"C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc1bb4b2-b1e8-494e-8c08-5e4851b31c86.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe4⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f34ab373-b4ee-49e7-a295-9f440c769618.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe6⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1de6497e-6405-4f53-9446-e8f2110341fa.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe8⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c3d50a8-fa54-4768-8727-191fd9926c68.vbs"9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe10⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\825c0196-f821-44c5-95fe-92f93e258f60.vbs"11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe12⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\470a26e0-16cb-42ee-b890-4e58930cf084.vbs"13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe14⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4c7491c3-5be0-400c-b362-fe7893696b87.vbs"15⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe16⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\75bdc77a-1cbc-4224-b627-c100c5e6bb34.vbs"17⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe18⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d1753ee-4c5d-49df-a241-2cc76b30f0aa.vbs"19⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe20⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\817f379a-5980-4853-8c46-268545ee862b.vbs"21⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe22⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2987956b-f62f-4934-a76a-38a5318ebb31.vbs"23⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe24⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\97167f9c-8cff-4d66-b316-b2e3b87cd305.vbs"25⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe26⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c662a25d-cc46-4d7e-8392-2324701cfe41.vbs"27⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe28⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c2cf2ae-5ed4-4a99-a73a-1427a5b7ce22.vbs"29⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe30⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8e842007-99d5-46b5-91d1-ed2749586aaf.vbs"31⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe32⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\74ed8106-97c5-4f71-800c-fc9ae7b16290.vbs"33⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe34⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2669ab02-c864-4a86-8942-7ccb0067e224.vbs"35⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe36⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c6582c24-46d2-422d-b8c5-72b9771b61b5.vbs"37⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe38⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e0274884-12c8-49ed-aa44-bf323cc0465d.vbs"39⤵
-
C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exeC:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe40⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1f5cfd35-24a7-4244-a147-04e61e1b1c22.vbs"41⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ea8af6e3-cc4c-4f3d-a2d7-f5321a35fa7b.vbs"41⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c10f085-f744-4ec6-ba25-a445ee62e5e3.vbs"39⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3beea001-25b2-4d01-9e7f-bb4dea0ea5af.vbs"37⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e462c693-0242-480f-9e89-7113c98a763c.vbs"35⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ff64a53c-d084-46c8-9a93-faa10110ed96.vbs"33⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d50f9625-1b63-4268-8639-0ff7110de730.vbs"31⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2d20ed77-ee28-42f3-9e94-b90c31b22890.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3edd7957-ac6f-4143-a506-e3dd69036e06.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6577efda-9b9b-4404-8abe-239c98d58f5a.vbs"25⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5a383f8b-b825-4c73-b8d7-7d3dbcfde7a3.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcb9cf6f-defe-4e98-ae2f-0b615f08f97a.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\667cef68-55e6-45b0-9579-86711f6ad015.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ba5b5740-ccfe-4003-84b0-c84024788303.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\41638e5b-bf0e-4856-92bb-80be7a5cf938.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\77ec7aee-7eed-4a6a-aa24-b5b8b98088dc.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d9bc7e6-dec1-4093-84e6-09a43578fd57.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e913869c-b38a-4833-8843-d75e0bd342b0.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a220690e-7449-416a-8ee4-e509338227d9.vbs"7⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\acc791a5-abc7-44d1-8972-764b812d6b03.vbs"5⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ebdbcff9-1097-49b3-939b-65f46e2875c3.vbs"3⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\MultiDigiMon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\900323d723f1dd1206\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\System32\C_1250\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\ProgramData\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\S-1-5-21-1062200478-553497403-3857448183-1000\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\HeadphoneSystemToastIcon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Documents and Settings\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5e3196c875759f12b19de76e7989c1ade
SHA12a9c952b123b87c988caf9bf64fc5fd777b5c876
SHA2565f2b6782f01575ba7a1e68e3d46995679700b506293536afdb7b43cdd80628ed
SHA5125493bb1c8af856285f9ba79aa8a58763861bbaf2f4abac7248761cc5bce77f9e132bf108f4e13b2ff95042647e5384e74167ed4301f8d59e308bbce1f93eb5d6
-
Filesize
944B
MD5abc61b7a532b5a8ab5bede2f413c1a71
SHA182ed1d78231b408bd8c072b7e08ac0aec0c43a7e
SHA25643027d7e917d7dc6caa6621eec3187dbfb8c2d3d02f3e0b4c8cf0a37505c9a51
SHA5122ebe7180da937c44f332dfec8e1b0e5a6b00a8825555829ad6a631d7e54252d3254b9c544370717042cc6c118b83f21f09798d5891d3919363c69439af956adf
-
Filesize
944B
MD5ff4a967012d041f24f777799e626cce4
SHA1cd1d31edfe04a9b39f8b2732376ba466c8a66346
SHA2562bb6758e5d9612b5d554149ea754704ae992db5f1848a060f50e08ffbfc85d4e
SHA51245a214acf08c71fbc4946a624d1ff4d95f08c508bd157990447addd9556c75dbba2dfd41c42cd22c14f0dd92b2685775bb04b8c561d34d793564e07edc922421
-
Filesize
944B
MD593771c301aacc738330a66a7e48b0c1b
SHA1f7d7ac01f1f13620b1642d1638c1d212666abbae
SHA2565512157a9ea31f455e244922910fcdb2b8116288d968b0e5e26c91b266d4de7c
SHA512a51f43e335c8c6da130866115ee6d890f808379548b129e20e563c5ee0234cca186ecde4fd6bc609f0eba6e32b10d080f4f67483461cdd58ef0a60db78324309
-
Filesize
944B
MD544ae12563d9f97ac1136baee629673df
SHA138790549497302c43bd3ff6c5225e8c7054829e2
SHA256b09202e29f036511a075523ebcaecef0a43ceeb4f2c8029e5c7931a8e2e72beb
SHA51207cf8ed791245485aae4ee05cd6b77eb0a36c8a839da6eae1554dc0487559c270241733ae8ed184c8d38a956452a2255169a3adeb40a0da1d9e2e487864a35e7
-
Filesize
738B
MD5ff0386c8cc2555bb56c16526f9539614
SHA1bea9832b0615dedff50d361c0519c40e518ab8cb
SHA256eb82882c388957136483f403ff0b81deee9a7fbe35dd9ce8ba8ce939643adb4c
SHA512acb52477dd0ed0967d95ea474ea49dc872d33cdf5d509cdd344ce56b582caf0a635e7807a494721c9dc5b2b5d760ce72dc08e66dcc274c9ae15b7b0d5c8df12a
-
Filesize
737B
MD52ca53039050b46d71c80e23bb4e5c65d
SHA173826c15e7ef552b525b02a7277512a62eae041d
SHA2566b65675c977f0d6b76e060c42c5842554a82293a703cc44a7514fcd7a6298408
SHA512120bd3d8ddeb2f10398edb9fe2d01d1b51e02b9e27979b0b380ea5a8943c3fdbfb6aa9ed0b99456652b2703c3bc5dfb4fe8ff11d1c6f9ce37662b7dea148f22d
-
Filesize
738B
MD551e1baa1082f91cddb426160dab7bf7a
SHA1ec32c7c49fd4c6b5ae81c74568a810940a492063
SHA256fb97f9cc9d37eb5354f8a1c8eb666915d6d9e16387cff093ed7348f50e7bd3e7
SHA51272ff1d24ffd806290076fc1bc14ce080f9f682c55c9d8ba66d5304e753a0822c102f65d55672dc2ec71ef2db9b72669a6bd5684b2b70ae707d387a7a44f3c745
-
Filesize
738B
MD5ae1110174ae329e81adc4680b6142eb0
SHA18914eab85da18f29ae16d5308746629b704a0883
SHA2562f5df31456414844bfaf2e5498956fe647b541e1d5075e5d77e3db5a2067ce9c
SHA512736bba826e7efc0c2315ba77663595d41cc44ce453e63852fd160d66ec5302eccf2b2642a59a8df307230f1afedcddbb3a81e9d237605fc4bfeedcbc0164551c
-
Filesize
738B
MD544a0af7b579ca1fb57e42d17ab0a7c11
SHA1a480c284c447921195b99eb7265cee130b1f9789
SHA25668d5c4915c18318303c07b27d97e26b6ba8bde2fb94c69234258c7a46a7b53ca
SHA5126c317953010a2bef417c5b1d095ff14006a7a068887c0c15349b9b16d03599c68e545ff31b505e861386e34c66d8a280abdef7d61042904a30131b1a77c548b2
-
Filesize
738B
MD5f45284e6e89dec140f4eb1c4ebe82ff5
SHA1b9ca7433b042350f28da121fe3b31c8a58a81945
SHA256f58c42040ee9deadfe1933a5eecb0f25a23b007a89385e0a520b7451fe672fcb
SHA5121c15bdb4e0f55114fecab017ba024bcdac82c93a0180841c138bb692a645da6f9f31429dfbe69211a667d6c625e1e81f59629ba6c97941204e1cd0bb14278da7
-
Filesize
738B
MD5b2d590ab476744bdd15bb8f9d43d7b61
SHA13c8c5f073ace910993a362a8bfd8ca4d9d7d63f0
SHA256395909dc942081dc5e88c0bd2e2193379e3193651ac088d2955f8eb6b7655c5b
SHA5127f0cde566ceec21b2852974ad424373da6e0e2bd7490ce01fec3be2fbb064a4166402cf2cdfe6e94df6e361bcf6c64558478041200893d8c1f228497826477a4
-
Filesize
738B
MD54be7165ea7a3b6383646c83e4bb0c006
SHA1c5a0d987937a238a29bbfbdc6ed0df56e2e58d39
SHA256f04b2a9f426ae6a5531f0b72fcea3f12ebe7b05886843987de0b10d2c59ab149
SHA512f1e744dc5799d70be21c2c048806c7c69a4d3e91a09b665a5393032241a800b17e87749bbf2c56de81e3e82482f738ae0453f15ef2a8aad9a03d4bb1768383ab
-
Filesize
738B
MD55db2b9a640d09a7999d7078d1a2acc7a
SHA1a2a36db331e5b1852e23613460cf4234bf10bd4d
SHA256f3ea162216556cab2582f70843e63100bff166246cb8dcf04ff69b51f176c359
SHA5127acbd53dd3a5bec14298b27ea34348dcd54af66c3f289e985154ae3cee6861140d1093a2c51de686c9f9690334710e88a1542450466439f31c724da7e36b5240
-
Filesize
738B
MD5a5bc609b69298ee1613833df466ae24b
SHA17869e2feda4b663b934e8fccfef4d0308d90c5c2
SHA25640ab4c476ca5c0ba7cf3fcdd3136d2ede6b0285a24a4de55d089f01a84eab5a5
SHA51230986f8900f99205e84c99e39c4030ec31695e92eef6714e6935036609fe15479ee3ecf939b2cd7d027770ca99aa2ba50e7233f10c0da735d041253659181561
-
Filesize
738B
MD50952beff2c83e128a77ea4b9c7e04a55
SHA17bac5990efbde2331e849036a4e9551208850706
SHA256edcb7f78892cf07202ecd7fcd1d845fe4e6a0e5423b836883a717019b05a9301
SHA51278073fca39013eacc101438113972e3696224fe68d44253a156fc84675358baafa6d4c4c3919e3398995cd067769bd86e5a15d5d004ba67eaaef7f96b417ec01
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
738B
MD506a18fb5a817f838612a4c829ae34708
SHA174ba1263841d1c7b972e156a09373f7b945b8cb7
SHA2564518594af118ddfce6be3ab62d41a6fdcb35243a85da53dbc39d301937aa8904
SHA512f3f5b96d6560eb9b7d2aeddfd824268c1ce163b7ec2fadf5b81b689cc1003628439330e87e3873824981aa2efa12269d7890e3b57e0457d7d087a6eb0abbaa93
-
Filesize
738B
MD5d3ff83e6f9ec995d7f9ff6a36a57747b
SHA105ff30b3462bef5938bcdcb6d698551c84e7a557
SHA2564d63adccf17b4d81fd2ae61df9eba3119db169f19c5b6fba77cf6a532154bc34
SHA5123484b695cec1c1ffc1f4d801b9ffedf6bd0b43cc5b7369c4b523a8d3e9751f45896afd34e357af6451193326946f7326a4256ca94aa54a5ff03afaf66a82afbe
-
Filesize
514B
MD57c3554ac23f8e6fc036cf9b3df49795b
SHA10680c88e3b43627581ea00269939dc7def1e6b39
SHA2560957157df8afe06d33af0d7cb5fba8392137fdadc713e19aef39a8c8cb834a3e
SHA5123cb859938562e3b9c4125c629d0cd2605dee3a6e9d7c5e18e45dcf0b1e7e8ac7a19d0fe773371968fa86da861c1d79f10c7bf8608f1523ecadecc9e362dee4d3
-
Filesize
738B
MD5ad870b665317602288ca054be09f9248
SHA11de0ecb0238ff88457c4727d835ed5ffa8b8d7c9
SHA25605d43453f40f210babe3015b22b8afd96ecaa197ead5792dcb38d5c2334002c1
SHA5126fc74aa0af1cb20f65960bb0835fb9b2a0c65ec29e5c9166e16efe6d0967ca15287038b62301703cc9217b75f1b4403bb9c551743c33a77b3c9953dcb20e9476
-
Filesize
1.1MB
MD5d61876ddede62df51f22178f3f3810d3
SHA1f61526c97f574e637c624293249c612894a3706e
SHA256db703d6a45db327d773c77238bed0a9905bb2c2a049bd4467fc43ab0df12e735
SHA5124b909d0c38361a5daa93b89c84182f48bb3f0352d72a40917700e0de83cd9ef7ae399487b50cb2bb44a1066aac91750b5aac44c2c681f20d4848f609800dbfa4
-
Filesize
1.1MB
MD599fc1cc551260e36cf07f772a6ea1efd
SHA11ac1680d668233d3e9bec9cf4f4a651834759f35
SHA256f622166626e548db839803fdcb2ed8f8b655c293f9e80a7424277ba1f60478dc
SHA51287b5708ab7b8f98efddf7128278786ab6ed99d4d779635f983637705723a56d300ee4c3f8c5badae2ed9385ea1353a2c673fc0751b8594ee60cab6bf4e1aa82f
-
Filesize
136KB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.1MB