Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:16
General
-
Target
c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe
-
Size
1.9MB
-
MD5
edcab28f5aae28489cb2ca6933a2f2be
-
SHA1
8226e84872a864d71d6f23a6927d1b603c53a0b7
-
SHA256
c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4
-
SHA512
240cedf9b820b28c66ce25d8e6591155906302dec4b234c5a697bbd3bdd6eec39874b09110be01883dac74cba494e46be356cd445a1cc16a3b269e720b1cff6a
-
SSDEEP
49152:lD4qFYryHb84s5guM/UpXR/+7SjWnjb8Ydp1:lDC4si4bGmjWnkYdf
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Process spawned unexpected child process 18 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 12 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies registry class 17 IoCs
-
Runs ping.exe 1 TTPs 8 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pnpmyc1o\pnpmyc1o.cmdline"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DDD.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC1D4491B22B8745EC93D75C4980D831E1.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tmsylu2b\tmsylu2b.cmdline"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E2B.tmp" "c:\Windows\System32\CSC4522809AF0EF48ACA1E54E7582AB530.TMP"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\900323d723f1dd1206\SearchApp.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\backgroundTaskHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sihost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\60739cf6f660743813\smss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xM7vGwl5Hu.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PN8AyO50yD.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6ODIA3Zf31.bat"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"7⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JQt66VEtJ1.bat"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost9⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"9⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mkvvIrKbn0.bat"10⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost11⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"11⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1mWG9ArXwW.bat"12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"13⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\psxgKE21Xe.bat"14⤵
-
C:\Windows\system32\chcp.comchcp 6500115⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"15⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SWAv0lnPhs.bat"16⤵
-
C:\Windows\system32\chcp.comchcp 6500117⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"17⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oe8YqT2ALj.bat"18⤵
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost19⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"19⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gtOlnDcdUa.bat"20⤵
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"21⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PN8AyO50yD.bat"22⤵
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"23⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9rsY8ZYMRr.bat"24⤵
-
C:\Windows\system32\chcp.comchcp 6500125⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"25⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ffZdJSdmJf.bat"26⤵
-
C:\Windows\system32\chcp.comchcp 6500127⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost27⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"27⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\psxgKE21Xe.bat"28⤵
-
C:\Windows\system32\chcp.comchcp 6500129⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"29⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\j2RXpaL3EF.bat"30⤵
-
C:\Windows\system32\chcp.comchcp 6500131⤵
-
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"31⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JQt66VEtJ1.bat"32⤵
-
C:\Windows\system32\chcp.comchcp 6500133⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost33⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"33⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A6hgcLYDdm.bat"34⤵
-
C:\Windows\system32\chcp.comchcp 6500135⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost35⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"35⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\A6hgcLYDdm.bat"36⤵
-
C:\Windows\system32\chcp.comchcp 6500137⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost37⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe"37⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\900323d723f1dd1206\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\900323d723f1dd1206\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\900323d723f1dd1206\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\twain_32\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\twain_32\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Windows\twain_32\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\60739cf6f660743813\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\60739cf6f660743813\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\60739cf6f660743813\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4c" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4c" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5edcab28f5aae28489cb2ca6933a2f2be
SHA18226e84872a864d71d6f23a6927d1b603c53a0b7
SHA256c094e156e6d4756e275d2c8a03c7b955d4c45dc77a3d35f9b8bbe54eb11023d4
SHA512240cedf9b820b28c66ce25d8e6591155906302dec4b234c5a697bbd3bdd6eec39874b09110be01883dac74cba494e46be356cd445a1cc16a3b269e720b1cff6a
-
Filesize
1KB
MD5cb4338b342d00bfe6111ffee5cbfc2ed
SHA1fc16673b6833ad3cb00743a32868b859e90aa536
SHA256343ed6661687e81c9615dcaea42fb1a98b70572bb9fe07e16f020108725dbbe9
SHA5124bcea1366b8be00d08eb15cfd78c87e1c8f3aea140a4ea30efb3c0511cd3de21b7ce8c933c7478fb06a356573ecb928e50df23d340fbd9a6e6c156a004d2a77a
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5842369b08704bbddf9de4d90016e58dd
SHA18bc3da656c08abbc14c58201e65b0dc823964bea
SHA256cbf20404c609c0792de4320ac3fa1806269cf5d97420565e3f43d409a11a2808
SHA5128f6cc3419f04b1cb4e6c7986ad9fb8a43fb380fee263937e223d8a5269aec918c2c8cd362ee708de0ded3a533f4cd43624d606f45b37e128bec52ada30c43b42
-
Filesize
944B
MD5737aca23f199ce589dd1e68bc4969b98
SHA18c9cdd6bdf94c5fa42c5b0c29abf0136e4e6fa00
SHA2566aa59e171898b3dd42a36662ef81d349ce5063a705f1261e881269c59e7c742b
SHA512ccc0e6fa798aeb92e6e1a14d6ef3dc23e8e829d5ffd10f11129d0e590820711e29997a761dca77b8e790b06e3c7c0d2059137f40f92543eb8048529b1b4d7817
-
Filesize
944B
MD59e91fa13f902935b683fcbc65dd11c03
SHA19412ddf77a7a551178e3d60b5fcd7d71d7301bb4
SHA256f4a7ba9b96c0fb8d52545e2bed8711131f4be5fa8e01f4db401115be9ffb31bb
SHA5129a6ca2c7b62b1205cb28523e0775a1947d4af569164484b50e5ef4d94412743fddbff17e8e9a99ebe31eef192a3cb06919061242acfb8263bda7d969a8b9e60d
-
Filesize
944B
MD5ffaa33c7940b1713a06a430414e2fed0
SHA1b1ade7d02b641ac9c382fad82cb1d31362fafb91
SHA256a9c2268a32d4b53421c510878be105729a41bb03d01622456369d322e3e35c5e
SHA51261913fe437de06bae8a99a02f3ff35f483d06ddd9593c16f9bb652dde94930ff47f1a07765b2d78ac5108abb65837a66444dc7ff9691ba9c9ceaf85f0ae73f4d
-
Filesize
278B
MD5abc4bf75565126d7802a3ddd62226552
SHA1f9e0c975ba6c72bfa7c55c99be85ef5bd5d55d7d
SHA25691291c614dd34f3d56899de351a182088e19723afe28995ff1a1e951c3768cb9
SHA512008c65050704c699987952055b9f4f2c16267c84571db796eeffe1736e3df63665f945a022728f3dc8a01c2bc82d955faf9591ce74202db105f9a96b7e83db1c
-
Filesize
230B
MD58fd2e7f2417ae6d68914a0fded317dcc
SHA1d7e9945aa0d5f2a7b7a250c71341a2d61e85d2f9
SHA256d98791c15e59db8ed67b8f43839aeec9b59320fdb7c9c27078c1af75cb90a3c4
SHA512b2a1aab367c6c001750dbe8e94e92b7d2502b51cd873e48579041bbc9b4e05a22cc2c9cc6554a20cfe95c0443b42a7ba3938ddef1585e955e17eeafad3462c22
-
Filesize
278B
MD5d766394db417db22770686e6bc1a41ed
SHA1e589d7b80f8e423781e2ec0ed571b504c9c59b24
SHA25638f2bf4ebe4c6f34e5b6c9117f32463cb7eeeea3440aacd759dd067eda37dcdd
SHA512056a7f0cdc92265a4d5d74f2f1abc695104fb3054200d9fd062bf0a447ed22d5f1d88ce21a064f87fa88fb1a5acfa7f86026470249244d4abfcea22ce4fd15fd
-
Filesize
230B
MD566aa1e800f664171e087fa163266481b
SHA14ef8ae3684ce98a5a5d14d5a624fd6cf3820770c
SHA2563485b8ef61becc42c408b49f544ca3e03d8c8e6273dbf2c6469255e0097108d7
SHA512f000c99e273a604cdecd6b7f8018295952eadb12550895c06927ff2889316e2f6a210df083875956bb31cb4ade85e0c159d998cdbd9ab04330d4578aba3f4b12
-
Filesize
230B
MD57284c35554788b01bb5c67175797c030
SHA18575c7b6aaa6007d75da2f68f5ab38485655c4c2
SHA25671e083fcff07eac5da0f85ea9c66323292f10c40cff66ec96aebf0d672b171f1
SHA512fe071e0099e04958c8d8c7c7f225f198a05096acfc88ee898285c1cf9b3d40a17dfcfefbddce3f527fac6e2dc90b1c85e803e11accafb0cef9272df39abb16e1
-
Filesize
278B
MD598cbc40045d3bdfb3b4315ccabe2811b
SHA15fcbed8aea9474bc72127c02da87e564c2f50c0c
SHA256a4c914dc64e56f7e750bab1e3b99401e2c211a9ccc843fcc6d89404f4d0520f4
SHA5125ae2983e8daa82b103362b48658b4c7c789284b45aa0dc2ea3c5f7ea14130716330a1ad98fc9bc3ea5095a16b9ce4aa9e1503188a7dc52016894602496dd0e86
-
Filesize
1KB
MD5ecf8cf85ca8ea8ac1ca5ab8f8d170bdd
SHA133eb8ee14f2211cad29e64abe29a8cf3a5fba03c
SHA256849dd6749605c35545dedda797f9b30697c884dc45d8cda64f6c51935eb21dc0
SHA512d4b0f9cb7ae23cb1db06a3de26efd0d9ec7c30329aa9782945e4ac416c463592655fcb0a8a9823d25536a1d3f0f3c0128a9da790ff18d54d52fb718f60aa2fcc
-
Filesize
1KB
MD52d4a068574daebc0dd99d7586edc196e
SHA1bcc9e9e01070043a5ae51c0d87b915dff97b73c3
SHA256e342cd2f6a46a3656350da79ccd44f8ebe5bce1fd7ddbf26704f324b68c26892
SHA5124e2c99a99d6a9eed2224239339ed6bfd59a71cf248ce91d9526b8516de47b6ffbc16109acd9b9b419adb50ce59c20987ec09752121c0c3b4917d9382d567024f
-
Filesize
278B
MD53c34d4c3bb81d82642660819ceef2595
SHA148bde2cdc1585b8d8befa74fca22b0217a6533ef
SHA256d1b51866da0d30fe31a5c4856f382a1943dbe45dad932ce650e47017515dd197
SHA5120222121b32fb497ed3bce775e094a6735e6515199fb2949a5e337e619a42973def0bc596846ad5f2a77d49b49931d7e51edbc92d538f0c3572ab8315e4bcec93
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
230B
MD5d13a08506d9c989d9201feb05c7bf2af
SHA192eedbf62671b032c7fd34ba58ff7568ef47f63f
SHA256df56b563d1650605a05944db6a87eb4845caaae237f8a825708d937ee256b5d7
SHA512c62b447978f3e3a2ef0d135016bf3e8c0e3319645319ffc449082cd7633e5942ff78fc0de4e3456509eafffaf003022c058595f2cd58234c0da3a7269acdbffc
-
Filesize
278B
MD5da38f5b9f0226c94330622df269520f8
SHA16927ca7cc6c5dc554d345f9a94dcdf045bb6d6e6
SHA2564d18d965e1bed90ed54c805bc9ee8eaac33c279103d37f1e4c3aceff6c698b0b
SHA5121a19589310b356581c5fa9fa5a9285a9cb28c8575f5ea861dc64f15a7f8aad3d55526f3b9157a81349a6516992cec108652dc673d3fabe63922854e6a1e299db
-
Filesize
278B
MD57c0b4c15918346125b602ee734943241
SHA1c944a3071fc9ccd2114d4cee3b10b86d3c25065a
SHA25642a3b14b8bde8ce1222c8d95faac30e3a1d87ad413b1e30950f6c32afc86dd58
SHA5126f1b83e4660963f82cabb8f4ef1f17a8c92b4846d0d4650c9b0b164d6fd0c054f3b10d1b28d4e3058d38e3f5e6db04d4d58418e03d44b51a3284181e9a79cc54
-
Filesize
230B
MD53ecd4556a1384ac2044c28c93a0a84cb
SHA1aad1db5b974b580d214a209aadab0fefc4f9283c
SHA256755f67c78b7834d14d3a4d14c276f2b8c3a6f7953bfa8a65e1e545860d77d6df
SHA5124daf80a9049048eda81d3d481e1a78e3683536b78d5d7f4f3d4efb03a6d29702fd2b3f79c2945ae649922182b5a8c3a4371989bca68b96755b7ffa7a620eec6a
-
Filesize
230B
MD5ab0550d58e5c84c9399762a15e8cb42a
SHA147afc5ac20cd72ef49f3ee4413790dd015c10271
SHA256323ee2cf861ac58869ef166f1029064078af968c72074affbaa373967ef358c8
SHA5126c9a74a6cdde868542fcedcdf8b8a944e27b83b5add001867a9ac4d9ac3606c72956f07798468d0b4a9bf4b8ae3466d0d6104a72473d3dc5d2e3b1ce9191c171
-
Filesize
278B
MD58ed8896de44f56063e571077399bceea
SHA1a7c1e4e5df29e8458fa55d572f232852c924eb9e
SHA256c708c4a4834602971637f51d577f2fd926a203a509e8a61d1f87f895dbb7291c
SHA512f31131203244ebfb631fe698c2c1cceb7b2392f82421d3dacf36eee5852b0716c7fb4723e1804068135120eff82b5b76893092f27202070bdbfef0d99775a91f
-
Filesize
278B
MD5dd7034d3bcbe52d7dca4f65478a47879
SHA10e31dc84974a3e7cbf92cbf67f8c29c12a03c2be
SHA256aebbeb3630fd8ecba0427d693d09ad939544bbbdc41c7641b08ab919f788c278
SHA512c38ff06c0bbef92cac6fa185dd81bff4b8fa809810720f077bb744ee208723fe3544c5ec4414efc683bb2ff971802dbb4a9aa57257ffe4c8e0deb87ff076d2e3
-
Filesize
1KB
MD5b5189fb271be514bec128e0d0809c04e
SHA15dd625d27ed30fca234ec097ad66f6c13a7edcbe
SHA256e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f
SHA512f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e
-
Filesize
438B
MD506c8780a616f1af945a60580e5d37065
SHA136627af34aef3d624d2ae8b61338b3b4e10a1642
SHA2564093678840b4d8773bcd3e6fc47373b5b742249e11a26b3288daad7209ea6aec
SHA512ab4aa554b55fa01457ca6cafc61f4056eea89c43fe5c0b7fddbfc5d9b597e3a7cb53aa324b6a71aa39d276c0963c35d03c88c048e4677b45fd9f49e11675a1bd
-
Filesize
265B
MD567a05d97d0afc619bd7f4ffd05f86f9d
SHA1d40109bd667295f0cac0772d34a1f9d366615580
SHA256cc49ba71427d2c3f9471341c9db70f198cebc3ec0939479c3db7db645e95efd7
SHA512955e5a6254fe20037465bd4aa8819e0ae35e59c57c3522047be78716d38d0c4f499bae4089ef6e862860ecce1718f374d6ad35a6bdf863afb46d10e20a25ec94
-
Filesize
408B
MD545fcd856498d7125ad90c1f79d51a161
SHA160139487edfb7302a19a95ff73385fe381915a74
SHA256ad29e55a05a775083c4707e49e0cdf90b2d52b1890271cbabc3635f4680e1285
SHA51268eabd1f5adfe4330f07fa3d1cba61c9da3a60843e6aaf3ba4d0235dd2405fa0ffbef295ef51dd05af03f163b8b4198318dc9710c3a883e930f326d26bd194d9
-
Filesize
235B
MD56e5325ee2e6c9928a938bf34fdfb9c08
SHA1b21a7af07b0c69c8f72af31e092edc4d603c62a1
SHA25617ac6c3146694890401a2412074e3baecc2a73752d4896b87fd8105eed603a16
SHA51281aac7e36a7873caede58a85cfcd17995ccdf9cbcc928d977b2f3dcc4c4e4a209ee4938dfee67a62e03e3a57196a6684399618382968b15a9b03bc77778fb8b8
-
Filesize
1KB
MD547fa8be984a761eed9ddc12bad4b4f61
SHA147cf543057fea8c63985cc386ececd8fca267242
SHA256fb38cb0ac68d8daffa4648c3467a9fcb37e7a362be2e9344fadcecbdda53fd86
SHA51215d8e622b9bab40fce8e7b3d8cc8495ae6198b48f955421d3066576f02461eb28824bba9bb95f3de88af67843f133607eb0cc3c799bf906409f73da2a8953963
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
136KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
48KB
-
Filesize
320KB
-
Filesize
96KB
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
56KB
-
Filesize
10.8MB
-
Filesize
428KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
1.9MB