Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 01:05
Behavioral task
behavioral1
Sample
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
Resource
win10v2004-20240611-en
General
-
Target
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe
-
Size
1.7MB
-
MD5
6a8dc0383ff9426d3cd10e686ea8af6e
-
SHA1
bee7864ec1d04b30f37d46da8e7ec5fe240ae3fc
-
SHA256
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa
-
SHA512
f0d96a682995d5d8e965aea6efc041ea26d57b50de7e8d8c36d03a5b74c68321574ac955a7be70d1436cdeba94dacee41e0269308e799770aa064a0d7d29ddfa
-
SSDEEP
24576:WwtlgjpoyMl1W9Rl/3XF9R95g9f53Lv+6gJUHGHhuf9QkGuW+4HcWb1JB4nS:xtyotW9RN+f53i1JUHG4xGuDkcY1JB
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 16 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\", \"C:\\Windows\\SKB\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\", \"C:\\Users\\Default\\NetHood\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\", \"C:\\Windows\\SKB\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\", \"C:\\Windows\\SKB\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\", \"C:\\Users\\Default\\NetHood\\SppExtComObj.exe\", \"C:\\Users\\Default User\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\", \"C:\\Windows\\SKB\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\", \"C:\\Users\\Default\\NetHood\\SppExtComObj.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\", \"C:\\Windows\\SKB\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\", \"C:\\Users\\Default\\NetHood\\SppExtComObj.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\", \"C:\\Windows\\SKB\\backgroundTaskHost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\", \"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\", \"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\", \"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\", \"C:\\Users\\Admin\\Saved Games\\winlogon.exe\", \"C:\\Users\\Public\\taskhostw.exe\", \"C:\\Windows\\SKB\\backgroundTaskHost.exe\", \"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\", \"C:\\Users\\Default\\NetHood\\SppExtComObj.exe\", \"C:\\Users\\Default User\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4816 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3128 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1284 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4492 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 724 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4472 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3408 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2468 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2336 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4748 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4976 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4984 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3232 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 556 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2440 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5108 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1464 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1360 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2192 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 384 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4188 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4440 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3664 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3264 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4620 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4424 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2928 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4396 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1560 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1376 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2952 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1216 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3396 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2252 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4240 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4036 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 372 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2472 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1688 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 768 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 4496 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5092 4496 schtasks.exe -
Processes:
resource yara_rule behavioral2/memory/4764-1-0x00000000009F0000-0x0000000000BA2000-memory.dmp dcrat C:\Windows\Temp\Crashpad\reports\taskhostw.exe dcrat C:\Windows\SKB\backgroundTaskHost.exe dcrat -
Detects executables packed with SmartAssembly 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4764-7-0x0000000002D00000-0x0000000002D10000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4764-12-0x000000001B730000-0x000000001B73C000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly behavioral2/memory/4764-14-0x000000001B7A0000-0x000000001B7AC000-memory.dmp INDICATOR_EXE_Packed_SmartAssembly -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 372 powershell.exe 1420 powershell.exe 4832 powershell.exe 2716 powershell.exe 2592 powershell.exe 3004 powershell.exe 3468 powershell.exe 4348 powershell.exe 2960 powershell.exe 3168 powershell.exe 532 powershell.exe 2472 powershell.exe 4240 powershell.exe 5088 powershell.exe 4444 powershell.exe 3452 powershell.exe 3632 powershell.exe -
Drops file in Drivers directory 1 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Executes dropped EXE 1 IoCs
Processes:
fontdrvhost.exepid process 5740 fontdrvhost.exe -
Adds Run key to start application 2 TTPs 32 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\SKB\\backgroundTaskHost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Recovery\\WindowsRE\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Internet Explorer\\SIGNUP\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\SystemResources\\ShellComponents.Switcher\\pris\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Public\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default User\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Public\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Default\\NetHood\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Default\\NetHood\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\Temp\\Crashpad\\reports\\taskhostw.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files\\Windows Sidebar\\Gadgets\\backgroundTaskHost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\Package Cache\\RuntimeBroker.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Users\\Default User\\explorer.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Google\\Chrome\\Application\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\dotnet\\shared\\Microsoft.NETCore.App\\dwm.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Admin\\Saved Games\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Windows\\SKB\\backgroundTaskHost.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Admin\\Saved Games\\winlogon.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\"" 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Drops file in Program Files directory 17 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\backgroundTaskHost.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Google\Chrome\Application\SppExtComObj.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Internet Explorer\SIGNUP\9e8d7a4ca61bd9 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\RCX7B79.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Internet Explorer\SIGNUP\RuntimeBroker.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Windows Sidebar\Gadgets\backgroundTaskHost.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\fontdrvhost.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Internet Explorer\SIGNUP\RuntimeBroker.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX5D92.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\RCX63A0.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RCX69BD.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Google\Chrome\Application\e1ef82546f0b02 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Windows Sidebar\Gadgets\eddb19405b7ce1 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6cb0b6c459d5d3 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dwm.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\Google\Chrome\Application\SppExtComObj.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dwm.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Drops file in Windows directory 8 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process File opened for modification C:\Windows\SKB\backgroundTaskHost.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Windows\SystemResources\ShellComponents.Switcher\pris\RuntimeBroker.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Windows\SystemResources\ShellComponents.Switcher\pris\9e8d7a4ca61bd9 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Windows\SKB\backgroundTaskHost.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File created C:\Windows\SKB\eddb19405b7ce1 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Windows\SystemResources\ShellComponents.Switcher\pris\RCX619B.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Windows\SystemResources\ShellComponents.Switcher\pris\RuntimeBroker.exe 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe File opened for modification C:\Windows\SKB\RCX70D5.tmp 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 724 schtasks.exe 3232 schtasks.exe 4396 schtasks.exe 4472 schtasks.exe 4188 schtasks.exe 3856 schtasks.exe 2928 schtasks.exe 2952 schtasks.exe 4036 schtasks.exe 5092 schtasks.exe 2468 schtasks.exe 2336 schtasks.exe 4620 schtasks.exe 3396 schtasks.exe 2440 schtasks.exe 1360 schtasks.exe 2192 schtasks.exe 3264 schtasks.exe 1216 schtasks.exe 4048 schtasks.exe 3128 schtasks.exe 3408 schtasks.exe 1464 schtasks.exe 2564 schtasks.exe 4792 schtasks.exe 768 schtasks.exe 4492 schtasks.exe 4748 schtasks.exe 4976 schtasks.exe 3664 schtasks.exe 1560 schtasks.exe 372 schtasks.exe 2924 schtasks.exe 2252 schtasks.exe 4816 schtasks.exe 1284 schtasks.exe 4984 schtasks.exe 4440 schtasks.exe 4424 schtasks.exe 1376 schtasks.exe 3916 schtasks.exe 2472 schtasks.exe 556 schtasks.exe 5108 schtasks.exe 636 schtasks.exe 384 schtasks.exe 4240 schtasks.exe 1688 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe 2960 powershell.exe 2960 powershell.exe 2716 powershell.exe 2716 powershell.exe 1420 powershell.exe 1420 powershell.exe 4832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exefontdrvhost.exedescription pid process Token: SeDebugPrivilege 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe Token: SeDebugPrivilege 532 powershell.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 4832 powershell.exe Token: SeDebugPrivilege 3468 powershell.exe Token: SeDebugPrivilege 2472 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeDebugPrivilege 4240 powershell.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeDebugPrivilege 5088 powershell.exe Token: SeDebugPrivilege 372 powershell.exe Token: SeDebugPrivilege 4348 powershell.exe Token: SeDebugPrivilege 3168 powershell.exe Token: SeDebugPrivilege 3632 powershell.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeDebugPrivilege 3004 powershell.exe Token: SeDebugPrivilege 5740 fontdrvhost.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.execmd.exedescription pid process target process PID 4764 wrote to memory of 3452 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3452 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 1420 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 1420 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 532 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 532 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2960 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2960 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2592 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2592 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2716 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2716 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4832 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4832 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3168 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3168 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 5088 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 5088 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4240 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4240 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3632 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3632 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4348 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4348 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3468 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3468 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 372 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 372 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3004 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 3004 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2472 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 2472 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4444 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4444 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe powershell.exe PID 4764 wrote to memory of 4744 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe cmd.exe PID 4764 wrote to memory of 4744 4764 258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe cmd.exe PID 4744 wrote to memory of 5980 4744 cmd.exe w32tm.exe PID 4744 wrote to memory of 5980 4744 cmd.exe w32tm.exe PID 4744 wrote to memory of 5740 4744 cmd.exe fontdrvhost.exe PID 4744 wrote to memory of 5740 4744 cmd.exe fontdrvhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe"C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\SppExtComObj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\taskhostw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemResources\ShellComponents.Switcher\pris\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dwm.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\Crashpad\reports\taskhostw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sysmon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\backgroundTaskHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\winlogon.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\taskhostw.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\backgroundTaskHost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\NetHood\SppExtComObj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\explorer.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\SIGNUP\RuntimeBroker.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xyd6dclV7W.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵
-
C:\Recovery\WindowsRE\fontdrvhost.exe"C:\Recovery\WindowsRE\fontdrvhost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemResources\ShellComponents.Switcher\pris\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SystemResources\ShellComponents.Switcher\pris\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemResources\ShellComponents.Switcher\pris\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\dotnet\shared\Microsoft.NETCore.App\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Windows\Temp\Crashpad\reports\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\reports\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\Crashpad\reports\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\Gadgets\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Gadgets\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Saved Games\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Saved Games\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Users\Public\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Public\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Public\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\SKB\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\SKB\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Windows\SKB\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Package Cache\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Package Cache\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\NetHood\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\NetHood\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\NetHood\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\SIGNUP\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ydiig1q.zjw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\xyd6dclV7W.batFilesize
202B
MD5cd0d558bb7fdbbd784715c3ca71420c6
SHA1076af2b2ac401cd5a7617f8c2b07f10e4888c7d9
SHA2567430729bf94d2a1d89720068c108fd381dd3b19c041c6d6a2eb410bcbeefafeb
SHA5128ea0186f4e08a65bcbeb4a7b458a2d9a16ed74e513ba0e69cac450af4b723fcaa049920ee1b1caf4595e11ebbc728a6da1d711582c7cc15a3a814e2d3237fcbc
-
C:\Windows\SKB\backgroundTaskHost.exeFilesize
1.7MB
MD588ef323607d17940040b9d6d64e6906e
SHA11ee763ffdc1cd29442987f3d6af98197ca32f274
SHA256fa51be597760814a4a8f31c76b35aa16bded91feb8d3b6767f34c78619bf9257
SHA512a78ca8540b800ba3e7db74f3b50040d69613ac532146de15a960ade3295dbd63c963393ebf0a5a78e366f8484168e44d9bda843a5e2859137947c64dc23e96a6
-
C:\Windows\Temp\Crashpad\reports\taskhostw.exeFilesize
1.7MB
MD56a8dc0383ff9426d3cd10e686ea8af6e
SHA1bee7864ec1d04b30f37d46da8e7ec5fe240ae3fc
SHA256258424cd8a701639a5ba89800e9e425463ab6219ce8435a37ea3c28b9b181ffa
SHA512f0d96a682995d5d8e965aea6efc041ea26d57b50de7e8d8c36d03a5b74c68321574ac955a7be70d1436cdeba94dacee41e0269308e799770aa064a0d7d29ddfa
-
memory/2960-188-0x000001B2A8ED0000-0x000001B2A8EF2000-memory.dmpFilesize
136KB
-
memory/4764-6-0x0000000002CF0000-0x0000000002CF8000-memory.dmpFilesize
32KB
-
memory/4764-13-0x000000001B740000-0x000000001B74C000-memory.dmpFilesize
48KB
-
memory/4764-16-0x000000001B7D0000-0x000000001B7D8000-memory.dmpFilesize
32KB
-
memory/4764-15-0x000000001B7C0000-0x000000001B7CE000-memory.dmpFilesize
56KB
-
memory/4764-18-0x000000001C100000-0x000000001C10C000-memory.dmpFilesize
48KB
-
memory/4764-21-0x00007FFC718A0000-0x00007FFC72361000-memory.dmpFilesize
10.8MB
-
memory/4764-22-0x00007FFC718A0000-0x00007FFC72361000-memory.dmpFilesize
10.8MB
-
memory/4764-14-0x000000001B7A0000-0x000000001B7AC000-memory.dmpFilesize
48KB
-
memory/4764-10-0x000000001B720000-0x000000001B728000-memory.dmpFilesize
32KB
-
memory/4764-170-0x00007FFC718A0000-0x00007FFC72361000-memory.dmpFilesize
10.8MB
-
memory/4764-12-0x000000001B730000-0x000000001B73C000-memory.dmpFilesize
48KB
-
memory/4764-17-0x000000001B7E0000-0x000000001B7EE000-memory.dmpFilesize
56KB
-
memory/4764-5-0x000000001B750000-0x000000001B7A0000-memory.dmpFilesize
320KB
-
memory/4764-0-0x00007FFC718A3000-0x00007FFC718A5000-memory.dmpFilesize
8KB
-
memory/4764-9-0x0000000002D10000-0x0000000002D1C000-memory.dmpFilesize
48KB
-
memory/4764-8-0x000000001B700000-0x000000001B716000-memory.dmpFilesize
88KB
-
memory/4764-7-0x0000000002D00000-0x0000000002D10000-memory.dmpFilesize
64KB
-
memory/4764-4-0x0000000002CD0000-0x0000000002CEC000-memory.dmpFilesize
112KB
-
memory/4764-3-0x0000000002CC0000-0x0000000002CCE000-memory.dmpFilesize
56KB
-
memory/4764-2-0x00007FFC718A0000-0x00007FFC72361000-memory.dmpFilesize
10.8MB
-
memory/4764-1-0x00000000009F0000-0x0000000000BA2000-memory.dmpFilesize
1.7MB