Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 22:48
Behavioral task
behavioral1
Sample
JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe
-
Size
1.3MB
-
MD5
7e7e0230eecd94e3f3bd1cb11519fc7f
-
SHA1
5c7c9c010f0e8d7b2e55813d5b0e1d2bbff6a299
-
SHA256
49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0
-
SHA512
eb72fb90bb47e7d4b1d6411c1d5cd095802ebd3a89e5e03bd491ee9a33ef501c5e239c604997638dbde5b06f6162453e0f20ea9208e763c4ccc2c577aa9563c0
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4036 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4444 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4944 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1312 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1620 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2948 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2596 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3204 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4004 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3512 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 652 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 556 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4780 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3564 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4736 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2512 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4904 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2732 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2908 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4196 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3176 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 668 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2472 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5020 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3012 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2620 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2356 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2796 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3740 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1880 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 428 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2332 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3696 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2896 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4300 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3488 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1568 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4476 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1488 4748 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3184 4748 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0031000000023b5b-10.dat dcrat behavioral2/memory/4456-13-0x0000000000F10000-0x0000000001020000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1964 powershell.exe 1348 powershell.exe 1088 powershell.exe 3940 powershell.exe 1156 powershell.exe 1336 powershell.exe 960 powershell.exe 4940 powershell.exe 4564 powershell.exe 2780 powershell.exe 2264 powershell.exe 3008 powershell.exe 4224 powershell.exe 4540 powershell.exe 4788 powershell.exe 1108 powershell.exe 4724 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe -
Executes dropped EXE 14 IoCs
pid Process 4456 DllCommonsvc.exe 944 RuntimeBroker.exe 1552 RuntimeBroker.exe 628 RuntimeBroker.exe 4664 RuntimeBroker.exe 1812 RuntimeBroker.exe 3208 RuntimeBroker.exe 2232 RuntimeBroker.exe 404 RuntimeBroker.exe 4772 RuntimeBroker.exe 1708 RuntimeBroker.exe 3096 RuntimeBroker.exe 1852 RuntimeBroker.exe 768 RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 47 raw.githubusercontent.com 55 raw.githubusercontent.com 56 raw.githubusercontent.com 45 raw.githubusercontent.com 46 raw.githubusercontent.com 54 raw.githubusercontent.com 15 raw.githubusercontent.com 34 raw.githubusercontent.com 39 raw.githubusercontent.com 57 raw.githubusercontent.com 58 raw.githubusercontent.com 14 raw.githubusercontent.com 17 raw.githubusercontent.com 53 raw.githubusercontent.com -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe DllCommonsvc.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\7a0fd90576e088 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\lsass.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\6203df4a6bafc7 DllCommonsvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\TextInputHost.exe DllCommonsvc.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\22eafd247d37c3 DllCommonsvc.exe File created C:\Windows\Prefetch\ReadyBoot\dllhost.exe DllCommonsvc.exe File opened for modification C:\Windows\Prefetch\ReadyBoot\dllhost.exe DllCommonsvc.exe File created C:\Windows\Prefetch\ReadyBoot\5940a34987c991 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2896 schtasks.exe 4444 schtasks.exe 1312 schtasks.exe 2596 schtasks.exe 3564 schtasks.exe 2796 schtasks.exe 2332 schtasks.exe 3512 schtasks.exe 2908 schtasks.exe 1932 schtasks.exe 3012 schtasks.exe 3488 schtasks.exe 1488 schtasks.exe 4036 schtasks.exe 404 schtasks.exe 668 schtasks.exe 3696 schtasks.exe 2356 schtasks.exe 1568 schtasks.exe 2568 schtasks.exe 2512 schtasks.exe 4904 schtasks.exe 3176 schtasks.exe 1880 schtasks.exe 1960 schtasks.exe 3204 schtasks.exe 4780 schtasks.exe 2620 schtasks.exe 3184 schtasks.exe 556 schtasks.exe 5020 schtasks.exe 2412 schtasks.exe 3740 schtasks.exe 652 schtasks.exe 1936 schtasks.exe 2732 schtasks.exe 4196 schtasks.exe 636 schtasks.exe 1620 schtasks.exe 2948 schtasks.exe 4004 schtasks.exe 2472 schtasks.exe 428 schtasks.exe 4300 schtasks.exe 4944 schtasks.exe 4736 schtasks.exe 1968 schtasks.exe 4476 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4456 DllCommonsvc.exe 4564 powershell.exe 4564 powershell.exe 4540 powershell.exe 4540 powershell.exe 3940 powershell.exe 3940 powershell.exe 960 powershell.exe 960 powershell.exe 1348 powershell.exe 1348 powershell.exe 1088 powershell.exe 1088 powershell.exe 3008 powershell.exe 3008 powershell.exe 1156 powershell.exe 1156 powershell.exe 4788 powershell.exe 4788 powershell.exe 4724 powershell.exe 4724 powershell.exe 4940 powershell.exe 1108 powershell.exe 4940 powershell.exe 1108 powershell.exe 1964 powershell.exe 1964 powershell.exe 1336 powershell.exe 1336 powershell.exe 4224 powershell.exe 4224 powershell.exe 2264 powershell.exe 2264 powershell.exe 3940 powershell.exe 2780 powershell.exe 2780 powershell.exe 944 RuntimeBroker.exe 944 RuntimeBroker.exe 4564 powershell.exe 1156 powershell.exe 4540 powershell.exe 1108 powershell.exe 960 powershell.exe 3008 powershell.exe 1348 powershell.exe 1088 powershell.exe 2264 powershell.exe 2780 powershell.exe 4940 powershell.exe 1964 powershell.exe 4788 powershell.exe 4724 powershell.exe 1336 powershell.exe 4224 powershell.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 4456 DllCommonsvc.exe Token: SeDebugPrivilege 4540 powershell.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeDebugPrivilege 960 powershell.exe Token: SeDebugPrivilege 1348 powershell.exe Token: SeDebugPrivilege 1088 powershell.exe Token: SeDebugPrivilege 3008 powershell.exe Token: SeDebugPrivilege 2264 powershell.exe Token: SeDebugPrivilege 4724 powershell.exe Token: SeDebugPrivilege 4788 powershell.exe Token: SeDebugPrivilege 4940 powershell.exe Token: SeDebugPrivilege 1108 powershell.exe Token: SeDebugPrivilege 1964 powershell.exe Token: SeDebugPrivilege 1336 powershell.exe Token: SeDebugPrivilege 4224 powershell.exe Token: SeDebugPrivilege 944 RuntimeBroker.exe Token: SeDebugPrivilege 2780 powershell.exe Token: SeDebugPrivilege 1552 RuntimeBroker.exe Token: SeDebugPrivilege 628 RuntimeBroker.exe Token: SeDebugPrivilege 4664 RuntimeBroker.exe Token: SeDebugPrivilege 1812 RuntimeBroker.exe Token: SeDebugPrivilege 3208 RuntimeBroker.exe Token: SeDebugPrivilege 2232 RuntimeBroker.exe Token: SeDebugPrivilege 404 RuntimeBroker.exe Token: SeDebugPrivilege 4772 RuntimeBroker.exe Token: SeDebugPrivilege 1708 RuntimeBroker.exe Token: SeDebugPrivilege 3096 RuntimeBroker.exe Token: SeDebugPrivilege 1852 RuntimeBroker.exe Token: SeDebugPrivilege 768 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 516 3736 JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe 83 PID 3736 wrote to memory of 516 3736 JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe 83 PID 3736 wrote to memory of 516 3736 JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe 83 PID 516 wrote to memory of 3628 516 WScript.exe 85 PID 516 wrote to memory of 3628 516 WScript.exe 85 PID 516 wrote to memory of 3628 516 WScript.exe 85 PID 3628 wrote to memory of 4456 3628 cmd.exe 87 PID 3628 wrote to memory of 4456 3628 cmd.exe 87 PID 4456 wrote to memory of 2780 4456 DllCommonsvc.exe 138 PID 4456 wrote to memory of 2780 4456 DllCommonsvc.exe 138 PID 4456 wrote to memory of 960 4456 DllCommonsvc.exe 139 PID 4456 wrote to memory of 960 4456 DllCommonsvc.exe 139 PID 4456 wrote to memory of 4540 4456 DllCommonsvc.exe 140 PID 4456 wrote to memory of 4540 4456 DllCommonsvc.exe 140 PID 4456 wrote to memory of 1964 4456 DllCommonsvc.exe 141 PID 4456 wrote to memory of 1964 4456 DllCommonsvc.exe 141 PID 4456 wrote to memory of 1156 4456 DllCommonsvc.exe 142 PID 4456 wrote to memory of 1156 4456 DllCommonsvc.exe 142 PID 4456 wrote to memory of 4564 4456 DllCommonsvc.exe 144 PID 4456 wrote to memory of 4564 4456 DllCommonsvc.exe 144 PID 4456 wrote to memory of 4224 4456 DllCommonsvc.exe 146 PID 4456 wrote to memory of 4224 4456 DllCommonsvc.exe 146 PID 4456 wrote to memory of 3940 4456 DllCommonsvc.exe 147 PID 4456 wrote to memory of 3940 4456 DllCommonsvc.exe 147 PID 4456 wrote to memory of 4788 4456 DllCommonsvc.exe 148 PID 4456 wrote to memory of 4788 4456 DllCommonsvc.exe 148 PID 4456 wrote to memory of 3008 4456 DllCommonsvc.exe 149 PID 4456 wrote to memory of 3008 4456 DllCommonsvc.exe 149 PID 4456 wrote to memory of 1108 4456 DllCommonsvc.exe 151 PID 4456 wrote to memory of 1108 4456 DllCommonsvc.exe 151 PID 4456 wrote to memory of 1088 4456 DllCommonsvc.exe 153 PID 4456 wrote to memory of 1088 4456 DllCommonsvc.exe 153 PID 4456 wrote to memory of 1348 4456 DllCommonsvc.exe 154 PID 4456 wrote to memory of 1348 4456 DllCommonsvc.exe 154 PID 4456 wrote to memory of 4724 4456 DllCommonsvc.exe 158 PID 4456 wrote to memory of 4724 4456 DllCommonsvc.exe 158 PID 4456 wrote to memory of 4940 4456 DllCommonsvc.exe 160 PID 4456 wrote to memory of 4940 4456 DllCommonsvc.exe 160 PID 4456 wrote to memory of 1336 4456 DllCommonsvc.exe 162 PID 4456 wrote to memory of 1336 4456 DllCommonsvc.exe 162 PID 4456 wrote to memory of 2264 4456 DllCommonsvc.exe 163 PID 4456 wrote to memory of 2264 4456 DllCommonsvc.exe 163 PID 4456 wrote to memory of 944 4456 DllCommonsvc.exe 171 PID 4456 wrote to memory of 944 4456 DllCommonsvc.exe 171 PID 944 wrote to memory of 796 944 RuntimeBroker.exe 174 PID 944 wrote to memory of 796 944 RuntimeBroker.exe 174 PID 796 wrote to memory of 2388 796 cmd.exe 176 PID 796 wrote to memory of 2388 796 cmd.exe 176 PID 796 wrote to memory of 1552 796 cmd.exe 178 PID 796 wrote to memory of 1552 796 cmd.exe 178 PID 1552 wrote to memory of 4268 1552 RuntimeBroker.exe 180 PID 1552 wrote to memory of 4268 1552 RuntimeBroker.exe 180 PID 4268 wrote to memory of 2280 4268 cmd.exe 182 PID 4268 wrote to memory of 2280 4268 cmd.exe 182 PID 4268 wrote to memory of 628 4268 cmd.exe 186 PID 4268 wrote to memory of 628 4268 cmd.exe 186 PID 628 wrote to memory of 3680 628 RuntimeBroker.exe 195 PID 628 wrote to memory of 3680 628 RuntimeBroker.exe 195 PID 3680 wrote to memory of 4504 3680 cmd.exe 197 PID 3680 wrote to memory of 4504 3680 cmd.exe 197 PID 3680 wrote to memory of 4664 3680 cmd.exe 203 PID 3680 wrote to memory of 4664 3680 cmd.exe 203 PID 4664 wrote to memory of 1336 4664 RuntimeBroker.exe 205 PID 4664 wrote to memory of 1336 4664 RuntimeBroker.exe 205 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_49a4781e6ef37dba7b2fdd3f5ccefbb54768c9423c3b68e7fcc3de55806ef9e0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Application Data\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1088
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Package Cache\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:2388
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FEON83D8AI.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2280
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Fb5uY85DH.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4504
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7QXgceCiI.bat"12⤵PID:1336
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4344
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1812 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"14⤵PID:3088
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4928
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3208 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Q0tVgmHuxR.bat"16⤵PID:2640
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:1440
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2232 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9EGxcg3vT.bat"18⤵PID:892
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:3328
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:404 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"20⤵PID:1960
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:3524
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9BpIS9nw5f.bat"22⤵PID:3372
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4880
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iYTmIkWLiw.bat"24⤵PID:3404
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4780
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3096 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat"26⤵PID:3508
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:3624
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7QXgceCiI.bat"28⤵PID:4264
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4024
-
-
C:\Users\All Users\Application Data\RuntimeBroker.exe"C:\Users\All Users\Application Data\RuntimeBroker.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7FnFm4j3ls.bat"30⤵PID:1104
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Recent\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Admin\Recent\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Recent\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Application Data\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4736
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Photo Viewer\fr-FR\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2908
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Defender\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3176
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\providercommon\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Templates\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Package Cache\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4476
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Package Cache\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5ecceac16628651c18879d836acfcb062
SHA1420502b3e5220a01586c59504e94aa1ee11982c9
SHA25658238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9
SHA512be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
944B
MD528d4235aa2e6d782751f980ceb6e5021
SHA1f5d82d56acd642b9fc4b963f684fd6b78f25a140
SHA2568c66720f953e82cfbd8f00543c42c0cf77c3d97787ec09cb3e1e2ba5819bd638
SHA512dba1bd6600f5affcfdc33a59e7ac853ee5fdfafb8d1407a1768728bd4f66ef6b49437214716b7e33e3de91d7ce95709050a3dab4354dd62acaf1de28107017a2
-
Filesize
218B
MD5d1127453e928643a13b1c78dbed6d8e7
SHA1711189ab08c8d87e847fde3efcbbe7992c2c3d71
SHA2569f0471ecbc67813f0ab4b0744e426b1af9a0437793503eab2979a8db6d674020
SHA51225349b5cafc28a0b82cd0c3386a09db9d6e63200985bea94b1339d6a91f5d7b088d77950542b1f69d6ac43445ff0beddd8711a73b2b522524e579a13bdd62f0d
-
Filesize
218B
MD58ab666ba40130b801f4b6aeadc1a6ea4
SHA1a810fd9da87e5a0ea704038be9e14caa595da74f
SHA256822705a2b9082069a8d06b5162133b58fbbf6e90b8653b40ff8002175c5676bb
SHA51239ab851c6819ca7b1d7ce2b8f36d970bd1fa895e1dfc8dfd4d2096bbe0d36ad7e92f6a641c980e01986c71cc7a6e31cae19fe676798672a45cfa4e88a596eadf
-
Filesize
218B
MD558a48d1b08e7d088848b60d994912500
SHA1fb43198a516f9c441c899c2f47c1e3870a82e40e
SHA256b49b8fc4eec35d58afd094cfaaba70d718bdcdcb9b8dd0ca63c50d57e7b1cbc8
SHA512abba91c95b4f9a7f04550f3c72ef3169c871751c701981712f8b877f37884fb42d3275820b8f792bbdce14492201b2012f07a00157e002e1aac5bba0cb21e41a
-
Filesize
218B
MD5b7d399829bb477e7c7a45f147785b26a
SHA14714b83492f2546e3a0db64fa325662c868358ec
SHA2567c6c3595d87ce1754df8b862d56a7b1e77fb673893d94e0ec9a479acfe637022
SHA51206167c229672d29e8d795c58cbbe9774bf90cb591bd00ba1eea11513097f24468e1711526925637f9bd01660bbedc28e88e0a2a5cd29204c8ba3a8cf11ac69ab
-
Filesize
218B
MD50becf75b6ef92e0b157cd6d18a22727d
SHA131388ef5f38733b6f7e9438e4070d87f4e57804e
SHA256e5528791e4682318084fe5dfa98d5276c84181a52faac73f7d2aa371acb275e0
SHA512278cc5fe3b742f4dc4741479f08f91b8dfab87b6ea1e092e97639a0146aeb1c4a07f60f1121ebf5bdcc9db4426e4bd3ce55e0aac8cfd8ac22de56852ab032938
-
Filesize
218B
MD512fdc447eba85c6192674a8e30fa0c24
SHA14fe8e7dc31bc9c14a92488cae6a955d7d09f8bee
SHA256c8e135366eaeba50ff8f4380a6e7e7dec2bf7050a8bff7811b71872ad6f39e64
SHA512b79dc85c810093c48eb4a975e0fd1dc1a75743ab7767ac8bf401b7eeb483e6b010441de8cb34d35eff69b54612bf0564baef360127f4b97d772f3139ff3620c5
-
Filesize
218B
MD566b656697a903c5a3d2edd0bbb751016
SHA1ec5dd7d0894289a6bcc8aea105d5d8b22da73ccd
SHA256f860996a01555fc0895b00b327f870e17fe3007ad6138aa315110aedf2b15411
SHA5123d57de7ade88d9c5aec9f8c0a68be442cebff2ef0746c5aee171666880d022d0704ac1b59d2e469e9fdc908e34b364019f5626f5db3ad762d542e5aea39d2960
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
218B
MD527b9b65954a9920f4dd36cb69d255d41
SHA13cd6270fa9fc2a67bbf0dc91745f686132458eda
SHA256d1f6ad4fb1849c63856ecdf293a11f854d175a2e1db38bb5bbba301e7369cb1f
SHA5126bf27a33306d7533eb3e11806bbc93e7fd780db229802eedde215722c1e0d48a6f6aed49ec7b0f93bdd6954bb7e8a9040ae553a8704faa0d00aa86fab8988f3e
-
Filesize
218B
MD55f0e3ac1ac9db349e5b8992df195db2c
SHA1deabd9796c068064fee92632fc172a82d62cb1f7
SHA2563c6fffdfb7885b08b28bb7470cca9cc28a3d99b6de58bc604d6acfd07de1d3db
SHA51272d64d69e4988eaaf9322a7b288cbcd5a0bce74be38ad9f663682abe75012c1ff178a967eaf8f142f0e3a0bdd5b4985e32aa2ceeebdd5fd5d7c21800d423ae0d
-
Filesize
218B
MD59ef4fde69933319bb79839979e876c47
SHA1dd01b6b6cd4b06c57f0c905b130424372f1407c3
SHA2568f957b4582bc19d636d792f2d44b00930613c3948da7e653341ac4797cb1b3e6
SHA5129d04a6a7507b0e5ffacdbb0f28b2fe77746ca84ad3d36a8f3e3fd594681d65f41381d420662503bad9bc6b8512a4f4d2cd1cd8459507a116e5e6b9610ee4863b
-
Filesize
218B
MD50937fad32f5994b8921378e13cab7c33
SHA17ed77b819984e008fa07e60b6ea0fe4ca853595f
SHA256c90a366dce29c503319e6fb89f2ed0e91c7aec41346f93a9495483b0f83010e3
SHA512de6b234b1a7c194f9848cd72b7e9054894379ce2bd2fe3289e8be3162f357a206f11769e6c3a4e8db705f6944eb709f445935a85632a1790c501b035b4f3c1f7
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478