Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 22:01

General

  • Target

    JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe

  • Size

    1.3MB

  • MD5

    b9b44c07c3f43d735fd8ce9d90e32cfa

  • SHA1

    e119216e3abfa510fbd3eb8a6cf72153a054ffbc

  • SHA256

    364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341

  • SHA512

    b285303ea67facf0cee1ad524cbcf2241ee842431470e24639d2f26551324599ceb0edd7bda03204819af7bce26f90ec837810830ac0e38fc047b717a136b95d

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 14 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_364532c577bd7b6231ab88362d4377d2c665ea92f07de32746fe5a0bd4046341.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:632
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\wsearchidxpi\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2424
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4052
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-493223053-2004649691-1575712786-1000\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4936
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\BrowserCore\en-US\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4268
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4160
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\Idle.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4628
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:372
          • C:\Users\Default\Cookies\Idle.exe
            "C:\Users\Default\Cookies\Idle.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1808
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:452
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:364
                • C:\Users\Default\Cookies\Idle.exe
                  "C:\Users\Default\Cookies\Idle.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:996
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2992
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:2272
                      • C:\Users\Default\Cookies\Idle.exe
                        "C:\Users\Default\Cookies\Idle.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1456
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GUMorhJGzB.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2968
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:3736
                            • C:\Users\Default\Cookies\Idle.exe
                              "C:\Users\Default\Cookies\Idle.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3972
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GUMorhJGzB.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4700
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:3312
                                  • C:\Users\Default\Cookies\Idle.exe
                                    "C:\Users\Default\Cookies\Idle.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:4656
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4972
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:1120
                                        • C:\Users\Default\Cookies\Idle.exe
                                          "C:\Users\Default\Cookies\Idle.exe"
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:3632
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat"
                                            16⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:5112
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              17⤵
                                                PID:3852
                                              • C:\Users\Default\Cookies\Idle.exe
                                                "C:\Users\Default\Cookies\Idle.exe"
                                                17⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:2856
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat"
                                                  18⤵
                                                    PID:5088
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      19⤵
                                                        PID:4168
                                                      • C:\Users\Default\Cookies\Idle.exe
                                                        "C:\Users\Default\Cookies\Idle.exe"
                                                        19⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2224
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat"
                                                          20⤵
                                                            PID:5076
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              21⤵
                                                                PID:4512
                                                              • C:\Users\Default\Cookies\Idle.exe
                                                                "C:\Users\Default\Cookies\Idle.exe"
                                                                21⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1296
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HfroAScfQF.bat"
                                                                  22⤵
                                                                    PID:1524
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      23⤵
                                                                        PID:2292
                                                                      • C:\Users\Default\Cookies\Idle.exe
                                                                        "C:\Users\Default\Cookies\Idle.exe"
                                                                        23⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1504
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"
                                                                          24⤵
                                                                            PID:4980
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              25⤵
                                                                                PID:2168
                                                                              • C:\Users\Default\Cookies\Idle.exe
                                                                                "C:\Users\Default\Cookies\Idle.exe"
                                                                                25⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:5096
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat"
                                                                                  26⤵
                                                                                    PID:4508
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      27⤵
                                                                                        PID:2024
                                                                                      • C:\Users\Default\Cookies\Idle.exe
                                                                                        "C:\Users\Default\Cookies\Idle.exe"
                                                                                        27⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:4316
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OTxxDhnLNa.bat"
                                                                                          28⤵
                                                                                            PID:2196
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              29⤵
                                                                                                PID:1748
                                                                                              • C:\Users\Default\Cookies\Idle.exe
                                                                                                "C:\Users\Default\Cookies\Idle.exe"
                                                                                                29⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Modifies registry class
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3108
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"
                                                                                                  30⤵
                                                                                                    PID:1088
                                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                      31⤵
                                                                                                        PID:4984
                                                                                                      • C:\Users\Default\Cookies\Idle.exe
                                                                                                        "C:\Users\Default\Cookies\Idle.exe"
                                                                                                        31⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2832
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\INF\wsearchidxpi\RuntimeBroker.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3368
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\INF\wsearchidxpi\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4988
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\INF\wsearchidxpi\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3180
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3176
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:5084
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\fr-FR\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3676
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-493223053-2004649691-1575712786-1000\lsass.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2160
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-493223053-2004649691-1575712786-1000\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3276
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\S-1-5-21-493223053-2004649691-1575712786-1000\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3908
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\unsecapp.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2224
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1892
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Security\BrowserCore\en-US\unsecapp.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4436
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3220
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1512
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4984
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Cookies\Idle.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2988
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Cookies\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:660
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Cookies\Idle.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3608
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\providercommon\sppsvc.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1812
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2156
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1716

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

                                            Filesize

                                            1KB

                                            MD5

                                            baf55b95da4a601229647f25dad12878

                                            SHA1

                                            abc16954ebfd213733c4493fc1910164d825cac8

                                            SHA256

                                            ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                            SHA512

                                            24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                            Filesize

                                            2KB

                                            MD5

                                            d85ba6ff808d9e5444a4b369f5bc2730

                                            SHA1

                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                            SHA256

                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                            SHA512

                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            944B

                                            MD5

                                            bd5940f08d0be56e65e5f2aaf47c538e

                                            SHA1

                                            d7e31b87866e5e383ab5499da64aba50f03e8443

                                            SHA256

                                            2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                            SHA512

                                            c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            944B

                                            MD5

                                            77d622bb1a5b250869a3238b9bc1402b

                                            SHA1

                                            d47f4003c2554b9dfc4c16f22460b331886b191b

                                            SHA256

                                            f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                            SHA512

                                            d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            944B

                                            MD5

                                            cadef9abd087803c630df65264a6c81c

                                            SHA1

                                            babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                            SHA256

                                            cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                            SHA512

                                            7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            944B

                                            MD5

                                            59d97011e091004eaffb9816aa0b9abd

                                            SHA1

                                            1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                            SHA256

                                            18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                            SHA512

                                            d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                          • C:\Users\Admin\AppData\Local\Temp\12JaEZR6zX.bat

                                            Filesize

                                            198B

                                            MD5

                                            b6649bbf1f01da84ea102a4b592cc5a2

                                            SHA1

                                            ed9b7d88aaecd69e4988f5f24fbe19ea0a40e208

                                            SHA256

                                            b577156f42ab03051140f2f7cdc1b0c0dd834db933417365a82d49f8ffbc21c9

                                            SHA512

                                            73fabf24f177f38f8802ec8224ad9453f60f9275aab437979c2779998f1deafee8606c7e4c2aeecc1829ed4e8323822dfe4237521b7ff4d2707e208aabab412a

                                          • C:\Users\Admin\AppData\Local\Temp\GUMorhJGzB.bat

                                            Filesize

                                            198B

                                            MD5

                                            c78bd25def9cba673f4e75a5db202959

                                            SHA1

                                            65bde2798919e27796d18097c7cf73f7aa082481

                                            SHA256

                                            5fd6bc8c0585493f804b0ef0301dd9487437945f4144888495fc538f43769c46

                                            SHA512

                                            c6025bfac6f94d9f6052d83f8a6d3a9ccdc2d8435c6dad6df61a28d39be3ec8d55673587871a00f77d0e16db57100cb5ffb7c57e26b6d36cb34423306264ac4d

                                          • C:\Users\Admin\AppData\Local\Temp\HfroAScfQF.bat

                                            Filesize

                                            198B

                                            MD5

                                            400feba89b64759d7382afcc49218d76

                                            SHA1

                                            eb6b5f987f3c2f448e5af555e78c66fd0de1608f

                                            SHA256

                                            bd35d6f270f01fc7ff4666abfe14db8f03ff68d7c2f08135f81a7c7e2bf7ffc0

                                            SHA512

                                            855c40117a959d14d11a107b74026013576eb19e17b40aa861bd2f2df1401fccd1e507bee7a71254aec876f0677673c171ca2a612a6f82b7a9e783c1cfcece52

                                          • C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat

                                            Filesize

                                            198B

                                            MD5

                                            23e029d204a36bc0837a384e03649081

                                            SHA1

                                            35df959f55d633fd813885ef4ea8a3cf87da2811

                                            SHA256

                                            f47b5beba6b0d352ec028cf3dae32cab114645909f89a463c39067c593923969

                                            SHA512

                                            f322f98a6f497f7073a09e763d34083b90cbd95643cfac7e0e224f170f40f355c5f1ef26ebf2418558a9e5605f3ce1b0c323a63ae1cdc5dfe06ac54ac557edd1

                                          • C:\Users\Admin\AppData\Local\Temp\OTxxDhnLNa.bat

                                            Filesize

                                            198B

                                            MD5

                                            343e254bf886aad4025bc02073251846

                                            SHA1

                                            5912d6a08473bc94c081d6d56b3c1b100fc22129

                                            SHA256

                                            678de474da7f97496b0b15652559a95a87008480a36589d0a2c5e8f1a3489020

                                            SHA512

                                            b38a01b814bf473addfc5c0e67a02e12bd5c82827b9cc56d8436c0cad5a6894c12168efe1910e4c2d989ca9b2f1644b7ce15c034fb9bc204e16a758d0f8101f8

                                          • C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat

                                            Filesize

                                            198B

                                            MD5

                                            97afc005feba8453a9b0ec95e48664e2

                                            SHA1

                                            bf8b5fd773cd883e48f96dcffe01af39a637279f

                                            SHA256

                                            698cc09fd2e11572b75fa501828f4410d8f89e3b45bc73e29d2860337217eca3

                                            SHA512

                                            2b6327aa2ff950502e2314630f2cf3b4db0e6ee5fb2b2f60718978f8c9a32951497d91f34538510a87ffb8e3f93cc90cbb68a0f9988ba2f9d305605f008336a4

                                          • C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat

                                            Filesize

                                            198B

                                            MD5

                                            9b9c023b1899cb804ea14aeb8c86f619

                                            SHA1

                                            fd88c25038883cf723d80d50ed2fb429d1c9821c

                                            SHA256

                                            87250adaa076f17e2acbef684ce80df70df32a6f234bfb570c6da734eb30e510

                                            SHA512

                                            9a106a013dd97487f4c93b26936e152c027b4493f25e7830bf1a2e26fbe877f27c7af4562e0e923085b655256e28c3ae72c0adec4ec224ed8b588bc25bc92975

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5yosqtwq.5oi.ps1

                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          • C:\Users\Admin\AppData\Local\Temp\eQ9EwglUAP.bat

                                            Filesize

                                            198B

                                            MD5

                                            95858f0e2f4431712af0ec0e4e05e131

                                            SHA1

                                            8ee4aed728d36cb3c5afcf1ab1e1d3959bf9d80c

                                            SHA256

                                            b0acbb2c243e7458845ddca35e3f181bf78ded0cfd295e964f1f7795119da9a7

                                            SHA512

                                            32b376bdd5bd8fc3b45c6e9732daf7f7a6e08e38adf638cc77376a5eb25bd7ce89efda3ca549f7df2238933e0248de0a133581f7377acd3cae1893df3c43bbd8

                                          • C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat

                                            Filesize

                                            198B

                                            MD5

                                            dbe748fa7799b3589b664d7b27ba02a0

                                            SHA1

                                            43ca556e5166fc9839d6741c9848bdf8e6a19c90

                                            SHA256

                                            5e347fca6cf2cb393560dea75013aded15e0eb35bdaee7d50684fb551dc2bbeb

                                            SHA512

                                            09e026c997df49b21ff0960b06d5ee095e753c1bf640be2cad7328bc281998db0cc9439cc922e488fe25b8759873742f06ef73a012ed3ced665912fc42858c20

                                          • C:\Users\Admin\AppData\Local\Temp\iIDKKqsGny.bat

                                            Filesize

                                            198B

                                            MD5

                                            676af5bc3f03cba1d3f6814c6ca5d01c

                                            SHA1

                                            b9cc2f28df83d0123a5957c9e6a2d8165a7f81b5

                                            SHA256

                                            c2a8b4eba70d07590bac44ebb360d40ebd9c84662058b5955ef7ddbca8f71373

                                            SHA512

                                            e306f6cd930479103e90c29c150fd64e675257e3784e2b7e86e17263ad539cc7278913ded448638d32a2d08383f78ba1f217e3e037d8164369c4fbecfc3674bc

                                          • C:\Users\Admin\AppData\Local\Temp\voEVGuhWUp.bat

                                            Filesize

                                            198B

                                            MD5

                                            54f2cfa081ee30c3e62e3e586783fbea

                                            SHA1

                                            61476bd5dae20a95876b8300359f54a9654a5dbd

                                            SHA256

                                            8a8b8fe89898aae6a460c50befc52497294d0cff52b8166dc929faad3686e96d

                                            SHA512

                                            d2d4ea4b9a4a54b9157c2292c10bc9cd41320839dcb4162ec7e59012917b042b5440b903e7c23e1719c04a625430eda71b6a043735f6111617005f33cdf10702

                                          • C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat

                                            Filesize

                                            198B

                                            MD5

                                            52e5c76fc1267f8c420aae3c261e7685

                                            SHA1

                                            47964bd3776040718acdb2e23d3e494ba4a190f7

                                            SHA256

                                            c9333cb08be290a21a4591655d90f0bed9e128db0abb90bf30973e543d3e8d6d

                                            SHA512

                                            2f36899ea55370f7ea15d420851c4cb2568821c4a228e426cb1823b5fe0f38ded934f7b2d76d0e777d63fb73bb3723ae49f4ff00b9fb20b81f40b75a741ecf2d

                                          • C:\providercommon\1zu9dW.bat

                                            Filesize

                                            36B

                                            MD5

                                            6783c3ee07c7d151ceac57f1f9c8bed7

                                            SHA1

                                            17468f98f95bf504cc1f83c49e49a78526b3ea03

                                            SHA256

                                            8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                            SHA512

                                            c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                          • C:\providercommon\DllCommonsvc.exe

                                            Filesize

                                            1.0MB

                                            MD5

                                            bd31e94b4143c4ce49c17d3af46bcad0

                                            SHA1

                                            f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                            SHA256

                                            b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                            SHA512

                                            f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                          • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                            Filesize

                                            197B

                                            MD5

                                            8088241160261560a02c84025d107592

                                            SHA1

                                            083121f7027557570994c9fc211df61730455bb5

                                            SHA256

                                            2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                            SHA512

                                            20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                          • memory/996-140-0x0000000001290000-0x00000000012A2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/1296-185-0x0000000002E60000-0x0000000002E72000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2224-178-0x0000000001700000-0x0000000001712000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2424-49-0x000001EC34200000-0x000001EC34222000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/2792-15-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/2792-16-0x0000000002880000-0x000000000288C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/2792-14-0x0000000000FB0000-0x0000000000FC2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/2792-13-0x0000000000590000-0x00000000006A0000-memory.dmp

                                            Filesize

                                            1.1MB

                                          • memory/2792-12-0x00007FFE16C23000-0x00007FFE16C25000-memory.dmp

                                            Filesize

                                            8KB

                                          • memory/2792-17-0x0000000002890000-0x000000000289C000-memory.dmp

                                            Filesize

                                            48KB

                                          • memory/2832-216-0x00000000010B0000-0x00000000010C2000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/3972-153-0x00000000011C0000-0x00000000011D2000-memory.dmp

                                            Filesize

                                            72KB