f8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a

Analysis

max time kernel
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xf8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a.exe
Size 1.7MB
Sample260416-bfj74sgt21
SHA256 f8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a
MD5 503dd60ebf8d7a07668a40b5073ad8dd
SHA1 f1f64ea327dd9f6d65b0f2fd1b140c6d2f4b8099
SHA512 1627724e051b26b9162b0dc5ac17afc73f8e67752bb6b3328f4981b65b2ded4a9c10834caf8bfe1f31fb89bccf90614e527e10cb28a6a132241fc227156996a3
SSDEEP 49152:8kQzAMIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sca:86UuRD9JdOR4m+lmY/4rx8ca
TLSH
T1058523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4344	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4168	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1000	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3404	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3112	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4740	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6056	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5924	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7760	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9092	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8132	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10008	3116	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7232	3116	schtasks.exe	80

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/2272-5237-0x00000000063B0000-0x00000000063C0000-memory.dmp	SmartAssembly
behavioral2/memory/2272-5241-0x00000000068B0000-0x00000000068BA000-memory.dmp	SmartAssembly
behavioral2/memory/2272-5246-0x0000000006990000-0x000000000699C000-memory.dmp	SmartAssembly
behavioral2/memory/2272-5249-0x00000000072B0000-0x00000000072BC000-memory.dmp	SmartAssembly
behavioral2/memory/2272-5247-0x00000000069C0000-0x00000000069CA000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xf8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
232	schtasks.exe
4168	schtasks.exe
4400	schtasks.exe
10008	schtasks.exe
3404	schtasks.exe
2948	schtasks.exe
4892	schtasks.exe
3136	schtasks.exe
4832	schtasks.exe
1444	schtasks.exe
4660	schtasks.exe
1272	schtasks.exe
2764	schtasks.exe
1288	schtasks.exe
3096	schtasks.exe
4596	schtasks.exe
3628	schtasks.exe
4920	schtasks.exe
4308	schtasks.exe
3100	schtasks.exe
4740	schtasks.exe
7760	schtasks.exe
1496	schtasks.exe
2860	schtasks.exe
4840	schtasks.exe
2404	schtasks.exe
4036	schtasks.exe
1000	schtasks.exe
6056	schtasks.exe
8132	schtasks.exe
3660	schtasks.exe
2632	schtasks.exe
4632	schtasks.exe
2996	schtasks.exe
2172	schtasks.exe
3020	schtasks.exe
4344	schtasks.exe
3416	schtasks.exe
3112	schtasks.exe
5924	schtasks.exe
9092	schtasks.exe
7232	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	xf8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a.exe

C:\Users\Admin\AppData\Local\Temp\xf8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a.exe
"C:\Users\Admin\AppData\Local\Temp\xf8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\AppReadiness\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\AppReadiness\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Windows\AppReadiness\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Documents\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Common Files\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Pictures\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\AppReadiness\services.exe
"C:\Windows\AppReadiness\services.exe"
1⤵
PID:3300

C:\Users\Public\Documents\fontdrvhost.exe
"C:\Users\Public\Documents\fontdrvhost.exe"
1⤵
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Pictures\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3112

C:\Users\Default\Pictures\csrss.exe
"C:\Users\Default\Pictures\csrss.exe"
1⤵
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Windows\SKB\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4596

C:\Recovery\WindowsRE\fontdrvhost.exe
"C:\Recovery\WindowsRE\fontdrvhost.exe"
1⤵
PID:3356

C:\Program Files (x86)\Windows Mail\dwm.exe
"C:\Program Files (x86)\Windows Mail\dwm.exe"
1⤵
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\SKB\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4400

C:\Users\Default User\Registry.exe
"C:\Users\Default User\Registry.exe"
1⤵
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\SKB\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4740

C:\Program Files (x86)\Adobe\lsass.exe
"C:\Program Files (x86)\Adobe\lsass.exe"
1⤵
PID:1392

C:\Windows\twain_32\Registry.exe
"C:\Windows\twain_32\Registry.exe"
1⤵
PID:5508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6056

C:\Program Files (x86)\Common Files\Idle.exe
"C:\Program Files (x86)\Common Files\Idle.exe"
1⤵
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Uninstall Information\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8132

C:\Program Files (x86)\Windows Mail\sppsvc.exe
"C:\Program Files (x86)\Windows Mail\sppsvc.exe"
1⤵
PID:424

C:\Windows\SKB\wininit.exe
"C:\Windows\SKB\wininit.exe"
1⤵
PID:9644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sppsvc.exe

Path C:\Program Files (x86)\Windows Mail\sppsvc.exe
Size 768KB
SHA256 8637c438a27c20300c53ce534d308629baf6581131eb39e473dc791cb86957cd
MD5 f23549ecfed36f3957158d0752f12cd2
SHA1 7b335feb77ff48054efa7ff658c4125ec08b493c
SHA512 18376234bc04febddf0dcc13bf52f5598307b7b57f5638ea1ab36649bae6df38527d50e04f0693408e6b2bdec864735f1fac582650ce6bed393e2eb6436d463b
SSDEEP 12288:Ah1Lk70znvjcgUgAgux61IP20vhe/ShQnvgTRPxX3VOKGHYxi2yqJT+gLa4rvxnk:8k70zrcbgBukmO0ZthkvMjHVOKG4s0T+
TLSH
T108F412117180D2B3C9FB117088D5CB359A3675710B6AB5EBBAD96BB62F102E0B7321CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wininit.exe

Path C:\Windows\SKB\wininit.exe
Size 1.1MB
SHA256 3f8d8adf6dcd229f6a09a72d6146d87ade5754d5573b6d794c3b9050dca21336
MD5 15d6f2cd2f9913825fc29fa6f7552a94
SHA1 d23855588d61f5c22d7985e22b30238e83822c68
SHA512 99a0a315ab3845ecf60523cfcc8227a221855b7b4ae8fd3b7e67740a4fd3d6720774fb6f5d92646991a77774cd51fe4934120bfa674fe28848779ceb17d402c5
SSDEEP 24576:8k70zrcbgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJo:8kQzAMIwMtuvMDVPG4JdXeR4aT6LQ+D
TLSH
T1734523157180D373C5F7013189D1CB746A2675B20F76A5EFB6AC6BA62F202F0B7261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Registry.exe

Path C:\Windows\twain_32\Registry.exe
Size 1.7MB
SHA256 f8bda873fda2fc4f6e80abebcb1bf1fd4ba78fe702f0ef3c17691bd645f2054a
MD5 503dd60ebf8d7a07668a40b5073ad8dd
SHA1 f1f64ea327dd9f6d65b0f2fd1b140c6d2f4b8099
SHA512 1627724e051b26b9162b0dc5ac17afc73f8e67752bb6b3328f4981b65b2ded4a9c10834caf8bfe1f31fb89bccf90614e527e10cb28a6a132241fc227156996a3
SSDEEP 49152:8kQzAMIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3sca:86UuRD9JdOR4m+lmY/4rx8ca
TLSH
T1058523097181D333C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB665C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-0-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

memory/2272-1-0x0000000005680000-0x00000000058FC000-memory.dmp

Download

memory/2272-2-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

memory/2272-3-0x0000000005900000-0x0000000005EA6000-memory.dmp

Download

memory/2272-4-0x0000000005400000-0x000000000567A000-memory.dmp

Download

memory/2272-8-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-10-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-14-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-36-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-46-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-42-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-54-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-52-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-50-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-48-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-40-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-38-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-45-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-34-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-32-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-30-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-28-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-26-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-24-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-22-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-20-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-18-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-12-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-16-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-6-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-5-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-60-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-64-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-78-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-76-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-90-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-104-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-120-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-118-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-114-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-112-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-110-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-108-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-106-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-116-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-102-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-100-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-98-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-96-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-94-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-92-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-89-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-86-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-84-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-82-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-80-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-74-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-72-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-70-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-66-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-62-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-68-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-58-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-56-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-126-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-130-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-129-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-124-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-122-0x0000000005400000-0x0000000005674000-memory.dmp

Download

memory/2272-1043-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

memory/2272-1425-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

memory/2272-5233-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

memory/2272-5234-0x0000000002B70000-0x0000000002B8C000-memory.dmp

Download

memory/2272-5237-0x00000000063B0000-0x00000000063C0000-memory.dmp

Download

memory/2272-5236-0x0000000002C00000-0x0000000002C08000-memory.dmp

Download

memory/2272-5241-0x00000000068B0000-0x00000000068BA000-memory.dmp

Download

memory/2272-5242-0x00000000068E0000-0x00000000068EC000-memory.dmp

Download

memory/2272-5243-0x00000000068F0000-0x0000000006902000-memory.dmp

Download

memory/2272-5240-0x0000000006490000-0x00000000064A0000-memory.dmp

Download

memory/2272-5239-0x00000000063F0000-0x00000000063F8000-memory.dmp

Download

memory/2272-5244-0x0000000006A00000-0x0000000006F2C000-memory.dmp

Download

memory/2272-5246-0x0000000006990000-0x000000000699C000-memory.dmp

Download

memory/2272-5245-0x0000000006980000-0x000000000698C000-memory.dmp

Download

memory/2272-5251-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

memory/2272-5252-0x00000000073A0000-0x00000000073AC000-memory.dmp

Download

memory/2272-5255-0x0000000007510000-0x0000000007576000-memory.dmp

Download

memory/2272-5250-0x00000000072C0000-0x0000000007352000-memory.dmp

Download

memory/2272-5249-0x00000000072B0000-0x00000000072BC000-memory.dmp

Download

memory/2272-5247-0x00000000069C0000-0x00000000069CA000-memory.dmp

Download

memory/2272-5248-0x00000000069E0000-0x00000000069E8000-memory.dmp

Download

memory/2272-5238-0x0000000006470000-0x0000000006486000-memory.dmp

Download

memory/2272-5235-0x0000000002BA0000-0x0000000002BF0000-memory.dmp

Download

memory/2272-6719-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

memory/2272-6889-0x00000000053F0000-0x0000000005400000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads