504bc40526a2f3d41202001b8c1b75810cb014c9cdccdd72a77ac045407554be

Analysis

max time kernel
18s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_a66628480aa44f9639536890016907a0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Size 1.7MB
Sample260522-3h37jsay4x
SHA256 504bc40526a2f3d41202001b8c1b75810cb014c9cdccdd72a77ac045407554be
MD5 a66628480aa44f9639536890016907a0
SHA1 6b31dfba0b6b8c9aa4bce59fea2ffe8756ecb969
SHA512 6402bc5a15545b885fda9d1641cd0f2b4891088280615b08245b7ce28fd889daf7a27030ada823a1d4028c4aeaa491c1e0860028151b9f2d8de44414db87877e
SSDEEP 49152:8kQTAMIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scO:8aUuRD9JdOR4m+lmY/4rx8cO
TLSH
T1E48523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence

Malware Config

Signatures

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	416	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1384	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3176	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4392	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4948	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4084	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1344	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5104	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5184	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5784	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5908	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6176	3724	schtasks.exe	80
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4244	3724	schtasks.exe	80

Detects executables packed with SmartAssembly 5 IoCs

resource	yara_rule
behavioral2/memory/5112-5232-0x0000000005340000-0x0000000005350000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5112-5241-0x00000000068C0000-0x00000000068CC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5112-5244-0x00000000071F0000-0x00000000071FC000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5112-5242-0x0000000006910000-0x000000000691A000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly
behavioral2/memory/5112-5236-0x00000000067E0000-0x00000000067EA000-memory.dmp	INDICATOR_EXE_Packed_SmartAssembly

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7872	powershell.exe
7336	powershell.exe
4100	powershell.exe
7284	powershell.exe
6040	powershell.exe
6796	powershell.exe
6252	powershell.exe
4624	powershell.exe
9116	powershell.exe
6024	powershell.exe
5664	powershell.exe

SmartAssembly .NET packer 5 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/5112-5232-0x0000000005340000-0x0000000005350000-memory.dmp	SmartAssembly
behavioral2/memory/5112-5241-0x00000000068C0000-0x00000000068CC000-memory.dmp	SmartAssembly
behavioral2/memory/5112-5244-0x00000000071F0000-0x00000000071FC000-memory.dmp	SmartAssembly
behavioral2/memory/5112-5242-0x0000000006910000-0x000000000691A000-memory.dmp	SmartAssembly
behavioral2/memory/5112-5236-0x00000000067E0000-0x00000000067EA000-memory.dmp	SmartAssembly

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_a66628480aa44f9639536890016907a0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1692	schtasks.exe
1084	schtasks.exe
1384	schtasks.exe
4952	schtasks.exe
4392	schtasks.exe
1004	schtasks.exe
3012	schtasks.exe
2684	schtasks.exe
4948	schtasks.exe
3368	schtasks.exe
5184	schtasks.exe
6176	schtasks.exe
4256	schtasks.exe
1700	schtasks.exe
1812	schtasks.exe
952	schtasks.exe
2912	schtasks.exe
5908	schtasks.exe
4244	schtasks.exe
2168	schtasks.exe
4132	schtasks.exe
3100	schtasks.exe
3176	schtasks.exe
1192	schtasks.exe
1812	schtasks.exe
4084	schtasks.exe
1344	schtasks.exe
5784	schtasks.exe
1972	schtasks.exe
4132	schtasks.exe
3432	schtasks.exe
5104	schtasks.exe
416	schtasks.exe
3620	schtasks.exe
596	schtasks.exe
4068	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	2026-05-22_a66628480aa44f9639536890016907a0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_a66628480aa44f9639536890016907a0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_a66628480aa44f9639536890016907a0_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:9116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6252
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7336
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7872
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\30gAlkPi8f.bat"
  2⤵
  PID:7360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1384

C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe
"C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe"
1⤵
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Recovery\WindowsRE\winlogon.exe
"C:\Recovery\WindowsRE\winlogon.exe"
1⤵
PID:588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5104

C:\Recovery\WindowsRE\lsass.exe
"C:\Recovery\WindowsRE\lsass.exe"
1⤵
PID:504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\ImmersiveControlPanel\Settings\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\Settings\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\ImmersiveControlPanel\Settings\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5908

C:\Recovery\WindowsRE\explorer.exe
"C:\Recovery\WindowsRE\explorer.exe"
1⤵
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\it-IT\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6176

C:\Windows\LiveKernelReports\fontdrvhost.exe
"C:\Windows\LiveKernelReports\fontdrvhost.exe"
1⤵
PID:6712

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhostw.exe
"C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\taskhostw.exe"
1⤵
PID:6200

C:\Program Files (x86)\MSBuild\Microsoft\fontdrvhost.exe
"C:\Program Files (x86)\MSBuild\Microsoft\fontdrvhost.exe"
1⤵
PID:5804

C:\Windows\ImmersiveControlPanel\Settings\RuntimeBroker.exe
"C:\Windows\ImmersiveControlPanel\Settings\RuntimeBroker.exe"
1⤵
PID:7176

C:\Program Files (x86)\Microsoft\sppsvc.exe
"C:\Program Files (x86)\Microsoft\sppsvc.exe"
1⤵
PID:4976

C:\Program Files (x86)\Windows Photo Viewer\it-IT\fontdrvhost.exe
"C:\Program Files (x86)\Windows Photo Viewer\it-IT\fontdrvhost.exe"
1⤵
PID:5288

C:\Users\Default User\RuntimeBroker.exe
"C:\Users\Default User\RuntimeBroker.exe"
1⤵
PID:9000

C:\Recovery\WindowsRE\taskhostw.exe
"C:\Recovery\WindowsRE\taskhostw.exe"
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Default User\RuntimeBroker.exe
Size 1.2MB
SHA256 ad460cb6b5b2776b6734a9198550eee511d403df81b6c41b4c12612ceb429a73
MD5 299156c37c751a9626c83e30cce875d6
SHA1 6afa3fb57e6951e75b34e378da96df3dbc91422c
SHA512 234ac675eaecb0c4c55d93ac27d94330ee5644f89d4d81bfd27803e63ace26ed0efa75ce3b3d73195c0d6a93f41625e9bb45eff2510eec0b1b7c9c7aa86fb337
SSDEEP 24576:8k70TrcbgBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJ4sytPX8:8kQTAMIwMtuvMDVPG4JdXeR4aT6LQ+dE
TLSH
T1C85523197080D373C6B701318AD5CB615A2671710B7AA6DFF7ACABA62F102F4B7271C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeClickToRun.exe

Path C:\Windows\GameBarPresenceWriter\OfficeClickToRun.exe
Size 1.7MB
SHA256 504bc40526a2f3d41202001b8c1b75810cb014c9cdccdd72a77ac045407554be
MD5 a66628480aa44f9639536890016907a0
SHA1 6b31dfba0b6b8c9aa4bce59fea2ffe8756ecb969
SHA512 6402bc5a15545b885fda9d1641cd0f2b4891088280615b08245b7ce28fd889daf7a27030ada823a1d4028c4aeaa491c1e0860028151b9f2d8de44414db87877e
SSDEEP 49152:8kQTAMIwMtuvMDVPG4JdXeR4aT6LQ+d3mY/4qxTsx3scO:8aUuRD9JdOR4m+lmY/4rx8cO
TLSH
T1E48523097181D373C2FB003085C58FB55A2566224F7566EFFBE89B662F202F4BB661C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-26121-0x0000000004CC0000-0x0000000004CF6000-memory.dmp

Download

memory/5112-0-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-1-0x0000000005350000-0x00000000055CC000-memory.dmp

Download

memory/5112-2-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-3-0x00000000055D0000-0x0000000005B76000-memory.dmp

Download

memory/5112-4-0x0000000005B80000-0x0000000005DFA000-memory.dmp

Download

memory/5112-8-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-6-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-14-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-38-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-36-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-50-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-74-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-80-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-78-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-113-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-110-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-130-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-128-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-126-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-124-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-122-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-120-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-118-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-116-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-108-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-106-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-104-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-102-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-100-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-98-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-96-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-114-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-94-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-92-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-90-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-88-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-86-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-84-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-82-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-76-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-66-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-64-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-62-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-60-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-72-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-70-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-68-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-58-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-56-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-54-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-52-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-48-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-46-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-44-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-42-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-40-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-30-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-28-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-26-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-24-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-22-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-20-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-34-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-32-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-18-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-16-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-12-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-10-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-5-0x0000000005B80000-0x0000000005DF4000-memory.dmp

Download

memory/5112-1851-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-2151-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-2466-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-5228-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-5232-0x0000000005340000-0x0000000005350000-memory.dmp

Download

memory/5112-5235-0x0000000006920000-0x0000000006930000-memory.dmp

Download

memory/5112-5234-0x0000000006150000-0x0000000006158000-memory.dmp

Download

memory/5112-5233-0x00000000067C0000-0x00000000067D6000-memory.dmp

Download

memory/5112-5231-0x0000000004C70000-0x0000000004C78000-memory.dmp

Download

memory/5112-5238-0x0000000006820000-0x0000000006832000-memory.dmp

Download

memory/5112-5239-0x0000000006940000-0x0000000006E6C000-memory.dmp

Download

memory/5112-5240-0x00000000068B0000-0x00000000068BC000-memory.dmp

Download

memory/5112-5241-0x00000000068C0000-0x00000000068CC000-memory.dmp

Download

memory/5112-5247-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-5246-0x00000000072C0000-0x00000000072CC000-memory.dmp

Download

memory/5112-5245-0x0000000007200000-0x0000000007292000-memory.dmp

Download

memory/5112-5250-0x0000000007450000-0x00000000074B6000-memory.dmp

Download

memory/5112-5244-0x00000000071F0000-0x00000000071FC000-memory.dmp

Download

memory/5112-5243-0x00000000068F0000-0x00000000068F8000-memory.dmp

Download

memory/5112-5242-0x0000000006910000-0x000000000691A000-memory.dmp

Download

memory/5112-5237-0x0000000006810000-0x000000000681C000-memory.dmp

Download

memory/5112-5236-0x00000000067E0000-0x00000000067EA000-memory.dmp

Download

memory/5112-5230-0x0000000004C10000-0x0000000004C60000-memory.dmp

Download

memory/5112-5229-0x0000000004BE0000-0x0000000004BFC000-memory.dmp

Download

memory/5112-7475-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/5112-7852-0x0000000002900000-0x0000000002910000-memory.dmp

Download

memory/7872-26977-0x0000000005AB0000-0x00000000060DA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads