Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:12
General
-
Target
6f723cd9002531ad31487e588d1132bc.exe
-
Size
1.1MB
-
MD5
6f723cd9002531ad31487e588d1132bc
-
SHA1
c794aab74ea0c76d1c077ca87d175014bc76f0f5
-
SHA256
c9206100b2d07324c79a83cb515893a79d39a1de3a6dac7a72a7b167c41b6910
-
SHA512
198154faa272369a965747852699d562c43622f9fbe94daf2cd4d62c63e64f7c542904e582f074f57843fb35e5db500149ee58c1826d733688e54eb6da6ad5a2
-
SSDEEP
12288:qmc4TfAkdN7TPPl2Eh8Nv6L1FMCubuoGTeh46qTnnCPQeB89hNuD1hOp1i3l10gR:qh4TbLUEhZL/GspeYhkc9Soh2SfwJ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 22 IoCs
-
Process spawned unexpected child process 22 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 48 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 15 IoCs
-
Adds Run key to start application 2 TTPs 44 IoCs
-
Checks whether UAC is enabled 1 TTPs 32 IoCs
-
Drops file in System32 directory 33 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 48 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Drops file in Drivers directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\spoolsv.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\alg\smss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\networkmap\taskhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\rgb9rast\smss.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Application Data\6f723cd9002531ad31487e588d1132bc.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xSIOjU0uCj.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\bdaplgin\lsass.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Music\Idle.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\wininit.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Admin\6f723cd9002531ad31487e588d1132bc.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\ntshrui\csrss.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\api-ms-win-core-delayload-l1-1-0\taskhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"4⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twunk_32\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\6f723cd9002531ad31487e588d1132bc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\RpcPing\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\JavaScriptCollectionAgent\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\PerfLogs\Admin\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\IcCoinstall\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe"5⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6f723cd9002531ad31487e588d1132bc.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System32\twext\spoolsv.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\wininit.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Application Data\explorer.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\it-IT\WmiPrvSE.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\OSPPSVC.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"6⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\06a7529b-174e-4980-843b-92d64bb3cf76.vbs"7⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"8⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\419a70de-3e56-4420-93d0-ad21d42098a4.vbs"9⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"10⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\38d6084c-4627-40be-a7f6-42e15408fd36.vbs"11⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"12⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed06c5b0-0bde-406b-b416-a43eb8cb4fa5.vbs"13⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"14⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b7afdfb1-b275-4a16-87ec-35ff40bd2d58.vbs"15⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"16⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\137d12c0-234d-47e1-aa6e-0f9fec845250.vbs"17⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"18⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b62947bd-7a33-493a-bc9d-bcc4588ecc7b.vbs"19⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"20⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25508098-5433-4619-a8f0-5222965040ef.vbs"21⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"22⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d68b635a-c0d7-4061-91a1-33a9031d960d.vbs"23⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"24⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bc02473-410c-487d-bb67-d06be2be0262.vbs"25⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"26⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\affab3f3-9a6b-490e-9dd6-9be4fcb17041.vbs"27⤵
-
C:\ProgramData\Application Data\explorer.exe"C:\ProgramData\Application Data\explorer.exe"28⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6f78bb6f-9b12-444c-8fa7-7acc20aad863.vbs"29⤵
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\477bdde9-064c-49be-b41d-95510dddec70.vbs"29⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\177efa1f-d3dd-4d5c-9f11-12fcb3053eb5.vbs"27⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4fb9fad5-6417-434f-92b7-502001843a4b.vbs"25⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b0a11494-be0d-4a1d-8797-5a3ef3a9c893.vbs"23⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54a35ad5-d0ea-41c8-b206-6ab6d5211507.vbs"21⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c0dfcfeb-2f7f-4c9f-a8f6-53a3168a54b3.vbs"19⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\27843b6f-f95e-4b2e-ac28-a31c7a858b53.vbs"17⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\18290c86-2e50-47d3-a898-59b8d56e07a9.vbs"15⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c43a5aaf-094a-437c-970d-ed5b7b090508.vbs"13⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\802cfcfe-b9be-46e1-9a26-393e32b884e7.vbs"11⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7074b769-ae4a-4aa2-a1ca-ed987fbc2f4c.vbs"9⤵
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1adbefc5-ee7c-44ef-a89b-48c23e81bd19.vbs"7⤵
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\alg\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\networkmap\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\rgb9rast\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "6f723cd9002531ad31487e588d1132bc" /sc ONLOGON /tr "'C:\ProgramData\Application Data\6f723cd9002531ad31487e588d1132bc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\bdaplgin\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Music\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "6f723cd9002531ad31487e588d1132bc" /sc ONLOGON /tr "'C:\PerfLogs\Admin\6f723cd9002531ad31487e588d1132bc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\ntshrui\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\api-ms-win-core-delayload-l1-1-0\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\twunk_32\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "6f723cd9002531ad31487e588d1132bc" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\6f723cd9002531ad31487e588d1132bc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\RpcPing\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\System32\JavaScriptCollectionAgent\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\PerfLogs\Admin\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\IcCoinstall\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-458878355-1110160431709094861-138038636-106003542-568451625950389316-1996133132"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\twext\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Tasks\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\ProgramData\Application Data\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\it-IT\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\TAPI\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD56f723cd9002531ad31487e588d1132bc
SHA1c794aab74ea0c76d1c077ca87d175014bc76f0f5
SHA256c9206100b2d07324c79a83cb515893a79d39a1de3a6dac7a72a7b167c41b6910
SHA512198154faa272369a965747852699d562c43622f9fbe94daf2cd4d62c63e64f7c542904e582f074f57843fb35e5db500149ee58c1826d733688e54eb6da6ad5a2
-
Filesize
720B
MD5ad4d74c5bcf15503a515e7422accf042
SHA17cdecec277cc1f598040602b0dc7c30b659e5fe5
SHA2569eea1b7eeaea433e08bb91ff95703371519104ed38ffb554ec6ebf8f980aa51b
SHA512fe0ce5609f6fea369486dedc226afa3a0a162c4d2e325d963505aaa3242e47fcb35149ffa2f17e9c21f0614ded8552f4ccc8a31358fe8763e9ae9b53b70e1fa9
-
Filesize
720B
MD51f58c72dca0aec41f691b856a59fcaf7
SHA1f7bab408bbc143ca7536ca1ea48d77e2960722f8
SHA256cbde481a67821a2a469aff52f4d7a397e813b896fd778a54911155499d315d8f
SHA5123ef5e27ca6d66e8da948556ad66da109208a57d78f92501c97f69e56e66a1d58c6a7c1d2273a68ab45ea409d68ddfd9b3425e1f4d05e1fc80ad31abdc25536c7
-
Filesize
496B
MD51fa047c7b4381a41a5bf78fb834ba3c1
SHA1b45daf4b2a67cafc0326c96ec0694206ea1852ae
SHA256763318eab5a184ae9c5b0cb4b443674b6acfb2fbf0d6d9a7884a73fcb0fbf2e6
SHA51277f3507ab0151f3b760a03be38f82a300ac7cc894ca339f5aa3730aaabf6e3063328a7b14cfef812a63b40a66397b74c05453a0e51c06116bb7fd08297e3a993
-
Filesize
720B
MD5db320bccfc9433b791e87cb81f5f2890
SHA12580925ed058f4178842ae8fbb77365546dff4e9
SHA256b58d31be501345275cc8bce5fac8fcdf59e195cfb9ca159b8fab2893bce3aa6c
SHA51284dcd7890d88de8f47d8ecc7301e60eb91d589568d08ee90d8564625b8b02770fb241ff8db9f3f83cd5165801be276cbd0b6e9358a426848f5d4cbd3fa1d2ce9
-
Filesize
720B
MD52ea83c6288b32de718c4ed734c0ac95f
SHA1c83564fb88d58df685147ca0f32fbe6493183448
SHA256c16aec8201d9db48a58d28f141afc7a415e8504990cb6a7ae3bafdcdd39dac8a
SHA512cb616a686672021d3db39ff196c1a1bb096c03180e0304aceecb662704b1829736d2e9ae0092caddcb8103b96ef13995bf72a3f63ba1a50a9b88970f4732c5da
-
Filesize
720B
MD55a0c7afeb6863357edb39e4a8359e5dd
SHA180a0723499f0e20639af340ae1fcd006d3e22339
SHA256a6c3c3c876ae1186cab8c049c93a0e1267e9a4c81aaf8def5cdd3930842a5cae
SHA5127ac17c80379aeccff2fd259f773e3a70fca4fa0116c7a6c7fdcca982f2aaeb6ff0280e1878c8beb277d3d08629bddffff8529b7ad7b8e1896f0ed81fb4c55b6c
-
Filesize
720B
MD5a905fd97c5fac0dbf4be86359c08242f
SHA18b2413adf2d9d8c191840200d7b3e94651901bb9
SHA2560b106c333c9fb568423308266957e8800aa77de4f3574e8bcf3fab8372a0fd79
SHA5125d9f6850c02c036143858644a426f5f34cdf9dadeadf1bbd47b0ab2951b1a835f7d4ae89326ec6bf0815ed60c165d6da41964ad12b192e2e3e8cdc4df01ccd00
-
Filesize
719B
MD5270a104dd379692d0365f7be90eaf9d4
SHA1cf8b5709d0ccab0083c6db3bea208026537c01c6
SHA2565a5c91f0d2e954de249fc29b7e349bd0772b1fdfca5d56bf6570f5800256fe3b
SHA5128f7ba4f1779f1a073e42442966698a038235becd5ac1ea2a7b877b4e510d126c23be8e28b28b585e2c38f436acba347336f81ac68e2883fa6e67d4948630e38e
-
Filesize
504B
MD5e02e227a88cc86898b146248b914528a
SHA1f0879f8d4325dbd8f32c48b93169b69dcfb77423
SHA256e37350600d9f9617c9c11f0fe204c54602348bac34860643898d8473239ccfe1
SHA5128a94de28f6b0da4807b4b801167e43ee2fed9d0d329e86689d04c8936b3bc36b23ccb91189feafc2ea3018373e13963c7f97be7a2b210dc6eac9494a6235c9b4
-
Filesize
512B
MD58256bd8a5a8deec77ce6d25e6a28340a
SHA1707316a33618748ba3db2546dee3ec155d23d1a7
SHA256affa799ef1824ed3187e49c5ad8a20fc7fc4bb23d97bc89dd78477c01cb59c61
SHA512c749784862e885dab7b25314137a74ca23756cf4ffc56655dd102e7ad33fec4c3119fbaad9b336c21b53c0b35a9203fc67a56815370a61acbca49072eace3fa1
-
Filesize
412B
MD5afc52ebb9dad4837985ae2e1feed6bdc
SHA1d7f0ca924df9b94e2051a5c7bca0ec5f86234f19
SHA256885a792431f35fc939f8e604a91072ef7226010c6e8ac92f614c484b149a1b13
SHA5122d841b4a1d015e184fa85e9e64435eb03c1e221180dddb2f7baeac6db524f7c423dfa3a226c88aa8a116e09df2e64b226cd9ffc8007ceef8ebac2011ad8d9af7
-
Filesize
234B
MD5a1be1c1d8eb29af9b37943206bb9b51d
SHA161fdfed8d86d5ffbb0e4daebb12a24fc709454c3
SHA25615d644a2579a5373ab7edabb60352dd92c08568626e4c09cab399b2d9e7fd68c
SHA512bece421c32292f4b5de639371c25eb303c04397fe7e79d94257c474609b9417419d53a2cf4e2fb9e5dd5523bbe6f058a11f8dca32478dc72f20b960e036a2bfa
-
Filesize
7KB
MD594970104983dc934166561a865e6964c
SHA17a8523c3db2f0771eb6aa07cd2b2c1b719e0804f
SHA25606cd1c0aa7035c79ec313b9fa8794ad9234d480e91a51dc81ab4f51628b11244
SHA51295940a672d65d02513853b13d8928dede8c0650a082d0b45656eb614da6f467ece38aafb596b122632db0c06317eb784d14384f10cec1af51a60d3e74a2d5acc
-
Filesize
7KB
MD56b738ebfc2de68434650d0c49737e4e3
SHA183aa9f0148787bfcdf414d0a2076c3f307cb3b23
SHA256e91c52bc0bbc47b524158dde683202c630f98ec724853fb19b51ffdbd2f095fa
SHA512cfe18c22cdd35013b3395c5f4bdb4b84431324156813b0e9bb943b132a7d39fe8a7167e64e41b2f89d3256787426f6bfa18b19223d1d02523921850edab802f3
-
Filesize
7KB
MD52a7f79d80d36cbf2b999146c56d27d6c
SHA10777def7ad30180d23053b3bdaf00abfb27b1051
SHA256ce30b10545c044f561cdbf36a77eb7d2117390bd35b3af79e65b166f4cd0b7f8
SHA5121c53d7ade716359dbe746ab848f0f8f8011ea35554e3a66081544060f50a9f275b93c9e31c328a23314d30cd012692e5e5ca42766eb3026f0da9ff02849bba15
-
Filesize
7KB
MD58e404a809505f239230497e89369d7ae
SHA12abb41f6826f3f201f80f46529173adf353e3548
SHA256ddce3973bc4660b4d3851a70847106664e397f2e0d69f1cec84fe9f8eb3535c6
SHA512b54ebefbc3b6608d73fc4a5de521795da6a2faebc6293b68d0c1a00fce5f649e456db8f3e760d11b9eef56346794455c0b73eaf00ebd316f06a97ce3fcd02677
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
72KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
9.9MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
48KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
1.1MB
-
Filesize
72KB