Overview
overview
10Static
static
106ea09dc024...bf.exe
windows7-x64
16ea09dc024...bf.exe
windows10-2004-x64
16ea800eee1...83.exe
windows7-x64
36ea800eee1...83.exe
windows10-2004-x64
36ec1c209b1...da.exe
windows7-x64
106ec1c209b1...da.exe
windows10-2004-x64
106f0c3386f1...bf.exe
windows7-x64
96f0c3386f1...bf.exe
windows10-2004-x64
76f456ca531...05.exe
windows7-x64
76f456ca531...05.exe
windows10-2004-x64
86f46a58808...0c.exe
windows7-x64
106f46a58808...0c.exe
windows10-2004-x64
106f6b7ee9a4...db.exe
windows7-x64
106f6b7ee9a4...db.exe
windows10-2004-x64
106f723cd900...bc.exe
windows7-x64
106f723cd900...bc.exe
windows10-2004-x64
106f7e5a7572...05.exe
windows7-x64
106f7e5a7572...05.exe
windows10-2004-x64
106f8921f285...3e.exe
windows7-x64
106f8921f285...3e.exe
windows10-2004-x64
106f8a4cd4e0...0e.exe
windows7-x64
106f8a4cd4e0...0e.exe
windows10-2004-x64
106f9568a7c5...ba.exe
windows7-x64
106f9568a7c5...ba.exe
windows10-2004-x64
106f9d1b3820...e0.exe
windows7-x64
36f9d1b3820...e0.exe
windows10-2004-x64
36faa2d85ae...9b.exe
windows7-x64
106faa2d85ae...9b.exe
windows10-2004-x64
106fd711c9c2...c6.exe
windows7-x64
106fd711c9c2...c6.exe
windows10-2004-x64
106fe5c591a1...4a.exe
windows7-x64
106fe5c591a1...4a.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:12
Static task
static1
Behavioral task
behavioral1
Sample
6ea09dc024349dc98b36f4ace0dd0fbf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6ea09dc024349dc98b36f4ace0dd0fbf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
6ea800eee1fc82ad358d35a7fde8ccd12b93a783300c4a97f7b8a7abcc7d7383.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
6ea800eee1fc82ad358d35a7fde8ccd12b93a783300c4a97f7b8a7abcc7d7383.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
6ec1c209b158ca6a09569dab997a10da.exe
Resource
win7-20250207-en
Behavioral task
behavioral6
Sample
6ec1c209b158ca6a09569dab997a10da.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
6f0c3386f12f5dee87b51bce9d5ac5500d5f173dd6c541b97aaac3bcd4abb9bf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
6f456ca5318d53c7577e67e641dbb36c8380514e08a7c4dd8ba88f15cebded05.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
6f456ca5318d53c7577e67e641dbb36c8380514e08a7c4dd8ba88f15cebded05.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
6f46a588081210caf9fc5f69f68daa1eb869bfb5658baaa201c7d9f466e3a00c.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
6f46a588081210caf9fc5f69f68daa1eb869bfb5658baaa201c7d9f466e3a00c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
6f6b7ee9a4b8c657931ecaacd04849db.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
6f6b7ee9a4b8c657931ecaacd04849db.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
6f723cd9002531ad31487e588d1132bc.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
6f723cd9002531ad31487e588d1132bc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
6f7e5a757226029c4770683df8125105.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
6f7e5a757226029c4770683df8125105.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
6f8921f28520259dde636ae0740e643e.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
6f8921f28520259dde636ae0740e643e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
6f8a4cd4e0092c7cf850cf6434225de4ade9b7eb92d8110bb7cbec7fdc29c10e.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
6f8a4cd4e0092c7cf850cf6434225de4ade9b7eb92d8110bb7cbec7fdc29c10e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
6f9568a7c563f84e4331fd0954d9ad321f41199035067dca004e1c927c1989ba.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
6f9568a7c563f84e4331fd0954d9ad321f41199035067dca004e1c927c1989ba.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
6f9d1b3820144f3c5df2673cd155bfe0.exe
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
6f9d1b3820144f3c5df2673cd155bfe0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
6faa2d85ae06f7888287bec8ae3e079b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
6faa2d85ae06f7888287bec8ae3e079b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
6fd711c9c2d9499442df85e477e670c6.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
6fd711c9c2d9499442df85e477e670c6.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
6fe5c591a1fbdd543b030912700b164a.exe
Resource
win7-20250207-en
General
-
Target
6ec1c209b158ca6a09569dab997a10da.exe
-
Size
5.9MB
-
MD5
6ec1c209b158ca6a09569dab997a10da
-
SHA1
1edc7c6f32e6b4ebc5faf5a522ed5992fc73bedf
-
SHA256
44c8df0ee91d3ab2825961ab81fed1370c75c034ef717b2baa192c2430eb65a3
-
SHA512
821d17198941051e5bd354fe5ea3fded5e196cd41b900714f9d68bb25baecca306160c695790649d7f3a48bdacb2ec7d9eebd6a184e756501dcdc726d98fd857
-
SSDEEP
98304:RyeUxPQ0JMLyWIvqrhH05I8TderKjHDFUh9HkEXJfw4v:RyeU11Rvqmu8TWKnF6N/1wq
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 42 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 408 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4424 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3720 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5236 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1928 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2780 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2128 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 244 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3688 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3272 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3312 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3248 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3328 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2084 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2160 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3336 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5244 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1428 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4388 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1460 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 216 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5528 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3120 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1632 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3628 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4104 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5868 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5456 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4980 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3752 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3216 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5124 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1976 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1068 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5128 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 896 1956 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 448 1956 schtasks.exe 89 -
UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6ec1c209b158ca6a09569dab997a10da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6ec1c209b158ca6a09569dab997a10da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6ec1c209b158ca6a09569dab997a10da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TextInputHost.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1376 powershell.exe 5056 powershell.exe 5516 powershell.exe 5776 powershell.exe 5836 powershell.exe 5364 powershell.exe 508 powershell.exe 764 powershell.exe 1932 powershell.exe 2552 powershell.exe 5324 powershell.exe 3816 powershell.exe 888 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 6ec1c209b158ca6a09569dab997a10da.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation TextInputHost.exe Key value queried \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation 6ec1c209b158ca6a09569dab997a10da.exe -
Executes dropped EXE 3 IoCs
pid Process 3264 TextInputHost.exe 5724 TextInputHost.exe 232 TextInputHost.exe -
Checks whether UAC is enabled 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6ec1c209b158ca6a09569dab997a10da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6ec1c209b158ca6a09569dab997a10da.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TextInputHost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 3264 TextInputHost.exe 3264 TextInputHost.exe 5724 TextInputHost.exe 5724 TextInputHost.exe 232 TextInputHost.exe 232 TextInputHost.exe -
Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\6203df4a6bafc7 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\RCX7ACA.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\edge_BITS_4428_1323226884\RCX84B5.tmp 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Internet Explorer\fr-FR\services.exe 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\RCX78A5.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Microsoft Office\root\Office15\RCX7B48.tmp 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Windows Media Player\Visualizations\9e8d7a4ca61bd9 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\services.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Internet Explorer\fr-FR\c5b4cb5e9653cc 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\RCX78B5.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\RCX7D6D.tmp 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\9e8d7a4ca61bd9 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\edge_BITS_4428_1323226884\sihost.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\edge_BITS_4428_1323226884\66fc9ff0ee96c2 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RCX71B9.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RCX71CA.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Windows Media Player\Visualizations\RCX73DE.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Windows Media Player\Visualizations\RCX73EF.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\edge_BITS_4428_1323226884\sihost.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Program Files\Microsoft Office\root\Office15\0a1fd5f707cd16 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\RCX7D5C.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Program Files\edge_BITS_4428_1323226884\RCX8533.tmp 6ec1c209b158ca6a09569dab997a10da.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Fonts\RuntimeBroker.exe 6ec1c209b158ca6a09569dab997a10da.exe File created C:\Windows\Fonts\9e8d7a4ca61bd9 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Windows\Fonts\RCX8290.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Windows\Fonts\RCX82A1.tmp 6ec1c209b158ca6a09569dab997a10da.exe File opened for modification C:\Windows\Fonts\RuntimeBroker.exe 6ec1c209b158ca6a09569dab997a10da.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings 6ec1c209b158ca6a09569dab997a10da.exe Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings TextInputHost.exe Key created \REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings TextInputHost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2396 schtasks.exe 3120 schtasks.exe 4104 schtasks.exe 5124 schtasks.exe 896 schtasks.exe 2040 schtasks.exe 408 schtasks.exe 5236 schtasks.exe 1460 schtasks.exe 3216 schtasks.exe 1068 schtasks.exe 2084 schtasks.exe 5456 schtasks.exe 2428 schtasks.exe 3336 schtasks.exe 3752 schtasks.exe 1976 schtasks.exe 5128 schtasks.exe 2128 schtasks.exe 244 schtasks.exe 3688 schtasks.exe 3312 schtasks.exe 3328 schtasks.exe 3628 schtasks.exe 4980 schtasks.exe 3272 schtasks.exe 1428 schtasks.exe 4388 schtasks.exe 5528 schtasks.exe 4424 schtasks.exe 3720 schtasks.exe 1876 schtasks.exe 5244 schtasks.exe 216 schtasks.exe 1632 schtasks.exe 5868 schtasks.exe 2316 schtasks.exe 1928 schtasks.exe 2780 schtasks.exe 3248 schtasks.exe 2160 schtasks.exe 448 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 2476 6ec1c209b158ca6a09569dab997a10da.exe 764 powershell.exe 764 powershell.exe 3816 powershell.exe 3816 powershell.exe 508 powershell.exe 508 powershell.exe 5364 powershell.exe 5364 powershell.exe 2552 powershell.exe 2552 powershell.exe 5776 powershell.exe 5776 powershell.exe 1932 powershell.exe 1932 powershell.exe 5056 powershell.exe 5056 powershell.exe 1376 powershell.exe 1376 powershell.exe 888 powershell.exe 888 powershell.exe 5324 powershell.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 2476 6ec1c209b158ca6a09569dab997a10da.exe Token: SeDebugPrivilege 764 powershell.exe Token: SeDebugPrivilege 3816 powershell.exe Token: SeDebugPrivilege 508 powershell.exe Token: SeDebugPrivilege 5364 powershell.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 5776 powershell.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeDebugPrivilege 1376 powershell.exe Token: SeDebugPrivilege 888 powershell.exe Token: SeDebugPrivilege 5324 powershell.exe Token: SeDebugPrivilege 5836 powershell.exe Token: SeDebugPrivilege 5516 powershell.exe Token: SeDebugPrivilege 3264 TextInputHost.exe Token: SeDebugPrivilege 5724 TextInputHost.exe Token: SeDebugPrivilege 232 TextInputHost.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2476 wrote to memory of 5056 2476 6ec1c209b158ca6a09569dab997a10da.exe 135 PID 2476 wrote to memory of 5056 2476 6ec1c209b158ca6a09569dab997a10da.exe 135 PID 2476 wrote to memory of 2552 2476 6ec1c209b158ca6a09569dab997a10da.exe 136 PID 2476 wrote to memory of 2552 2476 6ec1c209b158ca6a09569dab997a10da.exe 136 PID 2476 wrote to memory of 1932 2476 6ec1c209b158ca6a09569dab997a10da.exe 137 PID 2476 wrote to memory of 1932 2476 6ec1c209b158ca6a09569dab997a10da.exe 137 PID 2476 wrote to memory of 1376 2476 6ec1c209b158ca6a09569dab997a10da.exe 138 PID 2476 wrote to memory of 1376 2476 6ec1c209b158ca6a09569dab997a10da.exe 138 PID 2476 wrote to memory of 764 2476 6ec1c209b158ca6a09569dab997a10da.exe 139 PID 2476 wrote to memory of 764 2476 6ec1c209b158ca6a09569dab997a10da.exe 139 PID 2476 wrote to memory of 508 2476 6ec1c209b158ca6a09569dab997a10da.exe 140 PID 2476 wrote to memory of 508 2476 6ec1c209b158ca6a09569dab997a10da.exe 140 PID 2476 wrote to memory of 888 2476 6ec1c209b158ca6a09569dab997a10da.exe 141 PID 2476 wrote to memory of 888 2476 6ec1c209b158ca6a09569dab997a10da.exe 141 PID 2476 wrote to memory of 5364 2476 6ec1c209b158ca6a09569dab997a10da.exe 142 PID 2476 wrote to memory of 5364 2476 6ec1c209b158ca6a09569dab997a10da.exe 142 PID 2476 wrote to memory of 5836 2476 6ec1c209b158ca6a09569dab997a10da.exe 143 PID 2476 wrote to memory of 5836 2476 6ec1c209b158ca6a09569dab997a10da.exe 143 PID 2476 wrote to memory of 5776 2476 6ec1c209b158ca6a09569dab997a10da.exe 144 PID 2476 wrote to memory of 5776 2476 6ec1c209b158ca6a09569dab997a10da.exe 144 PID 2476 wrote to memory of 3816 2476 6ec1c209b158ca6a09569dab997a10da.exe 145 PID 2476 wrote to memory of 3816 2476 6ec1c209b158ca6a09569dab997a10da.exe 145 PID 2476 wrote to memory of 5516 2476 6ec1c209b158ca6a09569dab997a10da.exe 146 PID 2476 wrote to memory of 5516 2476 6ec1c209b158ca6a09569dab997a10da.exe 146 PID 2476 wrote to memory of 5324 2476 6ec1c209b158ca6a09569dab997a10da.exe 147 PID 2476 wrote to memory of 5324 2476 6ec1c209b158ca6a09569dab997a10da.exe 147 PID 2476 wrote to memory of 700 2476 6ec1c209b158ca6a09569dab997a10da.exe 161 PID 2476 wrote to memory of 700 2476 6ec1c209b158ca6a09569dab997a10da.exe 161 PID 700 wrote to memory of 5688 700 cmd.exe 163 PID 700 wrote to memory of 5688 700 cmd.exe 163 PID 700 wrote to memory of 3264 700 cmd.exe 168 PID 700 wrote to memory of 3264 700 cmd.exe 168 PID 3264 wrote to memory of 5680 3264 TextInputHost.exe 173 PID 3264 wrote to memory of 5680 3264 TextInputHost.exe 173 PID 3264 wrote to memory of 1800 3264 TextInputHost.exe 174 PID 3264 wrote to memory of 1800 3264 TextInputHost.exe 174 PID 5680 wrote to memory of 5724 5680 WScript.exe 189 PID 5680 wrote to memory of 5724 5680 WScript.exe 189 PID 5724 wrote to memory of 4864 5724 TextInputHost.exe 192 PID 5724 wrote to memory of 4864 5724 TextInputHost.exe 192 PID 5724 wrote to memory of 1292 5724 TextInputHost.exe 193 PID 5724 wrote to memory of 1292 5724 TextInputHost.exe 193 PID 4864 wrote to memory of 232 4864 WScript.exe 196 PID 4864 wrote to memory of 232 4864 WScript.exe 196 PID 232 wrote to memory of 1160 232 TextInputHost.exe 200 PID 232 wrote to memory of 1160 232 TextInputHost.exe 200 PID 232 wrote to memory of 4584 232 TextInputHost.exe 201 PID 232 wrote to memory of 4584 232 TextInputHost.exe 201 -
System policy modification 1 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 6ec1c209b158ca6a09569dab997a10da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 6ec1c209b158ca6a09569dab997a10da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6ec1c209b158ca6a09569dab997a10da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" TextInputHost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" TextInputHost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec1c209b158ca6a09569dab997a10da.exe"C:\Users\Admin\AppData\Local\Temp\6ec1c209b158ca6a09569dab997a10da.exe"1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2476 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/2f3e0199fccb3f72e8a39924edc6a781/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/34c553de294c1d56d0a800105b/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:764
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:508
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3816
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5324
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6nXiVaNJ1D.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:5688
-
-
C:\Users\All Users\Desktop\TextInputHost.exe"C:\Users\All Users\Desktop\TextInputHost.exe"3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3264 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60e15f07-6b62-4fab-b473-a94bf2fbf671.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\All Users\Desktop\TextInputHost.exe"C:\Users\All Users\Desktop\TextInputHost.exe"5⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5724 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\12635a9b-688f-4024-ba38-fa1fa472e902.vbs"6⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\All Users\Desktop\TextInputHost.exe"C:\Users\All Users\Desktop\TextInputHost.exe"7⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:232 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\25f308d6-7eb1-4010-8287-06a1fa38cd7e.vbs"8⤵PID:1160
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\365c6072-b3d6-416f-8901-c8318400088d.vbs"8⤵PID:4584
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9d6b7df8-d9f5-4c32-bd22-c53574d34f0f.vbs"6⤵PID:1292
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bae110b3-eb0f-4644-826d-69e78183ab5c.vbs"4⤵PID:1800
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "6ec1c209b158ca6a09569dab997a10da6" /sc MINUTE /mo 11 /tr "'C:\34c553de294c1d56d0a800105b\6ec1c209b158ca6a09569dab997a10da.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "6ec1c209b158ca6a09569dab997a10da" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\6ec1c209b158ca6a09569dab997a10da.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "6ec1c209b158ca6a09569dab997a10da6" /sc MINUTE /mo 6 /tr "'C:\34c553de294c1d56d0a800105b\6ec1c209b158ca6a09569dab997a10da.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Visualizations\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4980
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\root\Office15\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\fr-FR\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\fr-FR\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Desktop\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3120
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Desktop\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\Fonts\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Program Files\edge_BITS_4428_1323226884\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1928
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\edge_BITS_4428_1323226884\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\edge_BITS_4428_1323226884\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\34c553de294c1d56d0a800105b\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\2f3e0199fccb3f72e8a39924edc6a781\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Documents\My Pictures\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Default\Documents\My Pictures\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Documents\My Pictures\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3336
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD505b158c5f5613e1f3468a43a9e5c9a5c
SHA1438306456acf01fa1094e6d57d5289b226d5ae69
SHA256256f41ea4e57ae212cb270692c3c7162b0d3696052c0c67fa780e2ddefff230b
SHA512aedcd0dbf74a8ca6988a4f7e130bf8caa3afc738dc34ad9991862a89723067e0a31315ecc9ef5e97f51263c4048653ccb8182a8b2fed70f8bddff95fbaca8094
-
Filesize
5.9MB
MD5d95f96274ccaa414f95ebe3d8fe39214
SHA10a473a830f57a367254aeae1225729f48eff1b7d
SHA2560802264670d9dd1a188ff2a8006c92ab065856ee28c0ded3addb65f73da64de2
SHA5125b72ac209052a6d7c101811ad23c3adb79007564695a962f05cbcee7d644a9ad6dc291638a931f9561481997280565a5f2b465d8766d3eba2edb75a91904b97b
-
Filesize
5.9MB
MD56ec1c209b158ca6a09569dab997a10da
SHA11edc7c6f32e6b4ebc5faf5a522ed5992fc73bedf
SHA25644c8df0ee91d3ab2825961ab81fed1370c75c034ef717b2baa192c2430eb65a3
SHA512821d17198941051e5bd354fe5ea3fded5e196cd41b900714f9d68bb25baecca306160c695790649d7f3a48bdacb2ec7d9eebd6a184e756501dcdc726d98fd857
-
Filesize
5.9MB
MD5b9f348a7f966c82eb739cf755f955ef7
SHA1524f25fe128e77e8b31025015e998c7e6753e658
SHA256ef2a3de9c1adbcc857a97468d9b900e60a893e38be49bd620fa3de81d3f00302
SHA512578a376f7f0a88456068bcae1419dd596864563fb1b2b68c370da5f0b81db7022aca82e41093b3030216e6ac808e19cc98514d07de0776d5807accbd750379e9
-
Filesize
1KB
MD5229da4b4256a6a948830de7ee5f9b298
SHA18118b8ddc115689ca9dc2fe8c244350333c5ba8b
SHA2563d63b4a66e80ed97a8d74ea9dee7645942aafbd4abf1b31afed1027e5967fe11
SHA5123a4ec8f720000a32bb1555b32db13236a73bb6e654e35b4de8bdb0fc0de535584bc08ebe25c7066324e86faa33e8f571a11cc4e5ef00be78e2993e228f615224
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5b8c2d72f155bf26dd2ac91a9c57f0aef
SHA119a5ebf872b8c332bbd596dac8b7a36c80a19b54
SHA256069d7d614ebb7c3dff8dd6d7215be9da1524637352c09171e36441967a0ca9d5
SHA5128b246bedacc4063e39ac28678be372a52d1b07e2ed0db5ee1e4cf8e9d481836fa6d3e3138d1caa8e6ef692cea1ad42592e24bbef426746ad0227fdeff149caf7
-
Filesize
944B
MD5c79cf713064165d9921621736789b679
SHA14d8b3c69ddab8dd528496de06ce7e6e6c2758389
SHA2566de25d006efb9912c4460725c3ff494adc8585749971235d743dae6cb568068e
SHA51222dbec206c054253a245c7eac9cbfa4d62b49a11b02adea88b6dc8e1ee4243d46e8f61efa5374d43260ff686dbd3c769b7e14bbc6d5fb2f8999f258a904a04a5
-
Filesize
944B
MD508bb0c2688fc08624e11a31024e29947
SHA1dab0789759282767104987fa06d6acd5ed8bc616
SHA256d96effa05d39e4fb1e83f96a753616c0a26559acaa8415d7087a41ca091f42c4
SHA51230afdd978294eded7257fe8bb3538fd491572ad265498a8764d1a09d7255ad3b352ec3384770f50f97e180b0107eb24318d164c3751256c330a3478e4366999a
-
Filesize
944B
MD544ae12563d9f97ac1136baee629673df
SHA138790549497302c43bd3ff6c5225e8c7054829e2
SHA256b09202e29f036511a075523ebcaecef0a43ceeb4f2c8029e5c7931a8e2e72beb
SHA51207cf8ed791245485aae4ee05cd6b77eb0a36c8a839da6eae1554dc0487559c270241733ae8ed184c8d38a956452a2255169a3adeb40a0da1d9e2e487864a35e7
-
Filesize
944B
MD55f3d606f9a5f1201bfc1f01c54e842c4
SHA1f1917e50b557b135953ecbe63e1fc1e675b541f1
SHA256dcc09d3b5b17ef60cb35e4148230306cdcd68d18d18a39fd5fe220c34997a32a
SHA512d85e1e1b4a552a8cdd21c4195a2ea082d3fcb40907d2a6a0ceb297f32defd1fba17d3b54dc954c26b3b731bc179bee5cfc011de3c667af47cdbe289b30fdfb38
-
Filesize
944B
MD5672e8b21617ca3b368c6c154913fcfff
SHA1cb3dab8c008b5fba2af958ce2c416c01baa6a98b
SHA256b6ce484f4dcfab37c7fac91278a1d66c8b122865f12511634b8c5eac3fc081ec
SHA51298b45d5545237042c9d4e99e6aa2d514bb643c80cccd1f79ca8e6412a7949fc235f2f6a5fc12a7f772e1af2343ab2e2fb863d161f1d0da3326e636c52513c7ad
-
Filesize
720B
MD55ded796a54d9e16874f3243ebebae750
SHA18dbbdcda5da6bc0979e0646c84e602c175bd4e4c
SHA256b8ec7d89b834553657b5468668ff64345e684829dd40af9639a401398e69fe9a
SHA5125e16025fc228662c240d747c55cc7cc327356a7a0107d7d6a00e77e34b1a498e01237d8121f9ab49ba9c844d1905ca028bccee5b37e339bfb1ca36b5b21db24d
-
Filesize
719B
MD5aa369859da4e576d9c2c81c0406b769b
SHA199746f97507d9535f5ebbde6720afb9175039f72
SHA2561f5fefbb4485908d46b9cb0c15c800966b0d3771ee45e249ad697d803ad47517
SHA5120b294975161014c8bb6f4ac3453875dbc4c763860b78b0088707b573e76d21639c6300019f7c4578b7b9d733e4e0aed1af7e19bf952a8b3daa00cc093d66f7da
-
Filesize
720B
MD583c5b0f3bfceea90146e29dd67f75101
SHA168d095505f16189e56dbddbce4b66f6685306219
SHA2569fc2e509ebc7f23dcdd19db14624ca0133018c0a764398d378e0bae60d9c6780
SHA51255176f016b8c81c60290a0682c7fcac93fb0df9a0a9fbf6b1f10384a7267d1d062bd5a140194c73aa51f2c95dce6f4666f157e32945280ef2b056bb279cc25f6
-
Filesize
209B
MD56a30d790b85d8e574d2ea6f09ee95c85
SHA19e20e2879791e9130af97bf4d352bfac8b6330f2
SHA25656f1001074fdc4ad94eea5df6eb16a9c7b818ae1a3191f32e081caab5b463004
SHA5123a5a48ae74e52dfadde69ea4aad0a448bbb39225e8afb17a29de775df4be9d48fc13d735bf5f825e346e9b85637bb41d1b99694b0d345cf9b995ffb2a78a3595
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
496B
MD563c744a257142a94706a307de3f7f2de
SHA1201610a07c9db2df61e65b01fa041a6633b51f8d
SHA256e1b4d02da29499098bbdae22ab9b39088ec2b85d981b40b49e9cc0cfcf13b7fe
SHA512056ba4edad9715a58a20f72bb6850d666a303b70e35c7843bc4285160c03f0b50781fc3c3644d4cc8b1a4d2efc2c83181f6f52bace3bd2fa3cb85f79c09f9478