dcrat | ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe
Size

1.3MB
MD5

e232528ddd6aa6256f1480cc472cc002
SHA1

778b038f3f1f5be1b6340c5f18d409a581a9834b
SHA256

ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be
SHA512

2b07cf4503081e7ca467d048f2c74fe5211371b36623fcc45a44127dc9d5fda93b10e02b2df854f28f8337dfd73e304c71c94858b26d4006771024c6626fd937
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	100	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4380	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4500	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3324	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2672	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1232	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	5100	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	5100	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023ca0-10.dat	dcrat
behavioral2/memory/2364-13-0x0000000000150000-0x0000000000260000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2352	powershell.exe
1384	powershell.exe
2992	powershell.exe
3600	powershell.exe
1944	powershell.exe
3168	powershell.exe
3952	powershell.exe
1624	powershell.exe
1348	powershell.exe
3880	powershell.exe
4348	powershell.exe
3588	powershell.exe
4356	powershell.exe
1356	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	smss.exe

Executes dropped EXE 16 IoCs

pid	Process
2364	DllCommonsvc.exe
2760	smss.exe
3712	smss.exe
4212	smss.exe
1928	smss.exe
4792	smss.exe
2712	smss.exe
2896	smss.exe
5008	smss.exe
3632	smss.exe
4524	smss.exe
1148	smss.exe
1628	smss.exe
4000	smss.exe
728	smss.exe
4956	smss.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
50	raw.githubusercontent.com
54	raw.githubusercontent.com
15	raw.githubusercontent.com
23	raw.githubusercontent.com
47	raw.githubusercontent.com
52	raw.githubusercontent.com
53	raw.githubusercontent.com
14	raw.githubusercontent.com
39	raw.githubusercontent.com
43	raw.githubusercontent.com
51	raw.githubusercontent.com
44	raw.githubusercontent.com
22	raw.githubusercontent.com
37	raw.githubusercontent.com
38	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\7a0fd90576e088	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Schema\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ja-JP\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\TAPI\sihost.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Windows\IME\es-ES\csrss.exe	DllCommonsvc.exe
File created	C:\Windows\IME\es-ES\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Windows\INF\RemoteAccess\0407\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\INF\RemoteAccess\0407\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Windows\TAPI\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\Registry.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\smss.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\69ddcba757bf72	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	smss.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3280	schtasks.exe
3172	schtasks.exe
2568	schtasks.exe
4024	schtasks.exe
2012	schtasks.exe
2204	schtasks.exe
1700	schtasks.exe
3224	schtasks.exe
4012	schtasks.exe
4240	schtasks.exe
3500	schtasks.exe
3808	schtasks.exe
2300	schtasks.exe
2672	schtasks.exe
4132	schtasks.exe
2060	schtasks.exe
4436	schtasks.exe
100	schtasks.exe
3324	schtasks.exe
856	schtasks.exe
4812	schtasks.exe
3616	schtasks.exe
4960	schtasks.exe
5080	schtasks.exe
4708	schtasks.exe
2788	schtasks.exe
996	schtasks.exe
868	schtasks.exe
1772	schtasks.exe
1668	schtasks.exe
3796	schtasks.exe
2968	schtasks.exe
2744	schtasks.exe
1232	schtasks.exe
1512	schtasks.exe
2976	schtasks.exe
4380	schtasks.exe
4500	schtasks.exe
3460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
2364	DllCommonsvc.exe
3952	powershell.exe
3952	powershell.exe
1356	powershell.exe
1356	powershell.exe
3588	powershell.exe
3588	powershell.exe
1384	powershell.exe
1384	powershell.exe
1348	powershell.exe
1348	powershell.exe
2352	powershell.exe
2352	powershell.exe
3880	powershell.exe
3880	powershell.exe
2992	powershell.exe
2992	powershell.exe
4356	powershell.exe
4356	powershell.exe
1624	powershell.exe
1624	powershell.exe
3600	powershell.exe
3600	powershell.exe
1944	powershell.exe
1944	powershell.exe
4348	powershell.exe
4348	powershell.exe
3168	powershell.exe
3168	powershell.exe
1356	powershell.exe
3880	powershell.exe
3952	powershell.exe
3952	powershell.exe
3588	powershell.exe
1348	powershell.exe
2352	powershell.exe
4348	powershell.exe
2992	powershell.exe
1944	powershell.exe
1624	powershell.exe
1384	powershell.exe
4356	powershell.exe
3600	powershell.exe
3168	powershell.exe
2760	smss.exe
3712	smss.exe
4212	smss.exe
1928	smss.exe
4792	smss.exe
2712	smss.exe
2896	smss.exe
5008	smss.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	DllCommonsvc.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	2760	smss.exe
Token: SeDebugPrivilege	3712	smss.exe
Token: SeDebugPrivilege	4212	smss.exe
Token: SeDebugPrivilege	1928	smss.exe
Token: SeDebugPrivilege	4792	smss.exe
Token: SeDebugPrivilege	2712	smss.exe
Token: SeDebugPrivilege	2896	smss.exe
Token: SeDebugPrivilege	5008	smss.exe
Token: SeDebugPrivilege	3632	smss.exe
Token: SeDebugPrivilege	4524	smss.exe
Token: SeDebugPrivilege	1148	smss.exe
Token: SeDebugPrivilege	1628	smss.exe
Token: SeDebugPrivilege	4000	smss.exe
Token: SeDebugPrivilege	728	smss.exe
Token: SeDebugPrivilege	4956	smss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1280	1948	JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe	83
PID 1948 wrote to memory of 1280	1948	JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe	83
PID 1948 wrote to memory of 1280	1948	JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe	83
PID 1280 wrote to memory of 1268	1280	WScript.exe	85
PID 1280 wrote to memory of 1268	1280	WScript.exe	85
PID 1280 wrote to memory of 1268	1280	WScript.exe	85
PID 1268 wrote to memory of 2364	1268	cmd.exe	87
PID 1268 wrote to memory of 2364	1268	cmd.exe	87
PID 2364 wrote to memory of 3168	2364	DllCommonsvc.exe	129
PID 2364 wrote to memory of 3168	2364	DllCommonsvc.exe	129
PID 2364 wrote to memory of 3880	2364	DllCommonsvc.exe	130
PID 2364 wrote to memory of 3880	2364	DllCommonsvc.exe	130
PID 2364 wrote to memory of 2992	2364	DllCommonsvc.exe	131
PID 2364 wrote to memory of 2992	2364	DllCommonsvc.exe	131
PID 2364 wrote to memory of 4348	2364	DllCommonsvc.exe	132
PID 2364 wrote to memory of 4348	2364	DllCommonsvc.exe	132
PID 2364 wrote to memory of 1384	2364	DllCommonsvc.exe	133
PID 2364 wrote to memory of 1384	2364	DllCommonsvc.exe	133
PID 2364 wrote to memory of 2352	2364	DllCommonsvc.exe	134
PID 2364 wrote to memory of 2352	2364	DllCommonsvc.exe	134
PID 2364 wrote to memory of 3952	2364	DllCommonsvc.exe	135
PID 2364 wrote to memory of 3952	2364	DllCommonsvc.exe	135
PID 2364 wrote to memory of 1356	2364	DllCommonsvc.exe	139
PID 2364 wrote to memory of 1356	2364	DllCommonsvc.exe	139
PID 2364 wrote to memory of 1348	2364	DllCommonsvc.exe	140
PID 2364 wrote to memory of 1348	2364	DllCommonsvc.exe	140
PID 2364 wrote to memory of 4356	2364	DllCommonsvc.exe	142
PID 2364 wrote to memory of 4356	2364	DllCommonsvc.exe	142
PID 2364 wrote to memory of 1944	2364	DllCommonsvc.exe	144
PID 2364 wrote to memory of 1944	2364	DllCommonsvc.exe	144
PID 2364 wrote to memory of 3588	2364	DllCommonsvc.exe	145
PID 2364 wrote to memory of 3588	2364	DllCommonsvc.exe	145
PID 2364 wrote to memory of 1624	2364	DllCommonsvc.exe	146
PID 2364 wrote to memory of 1624	2364	DllCommonsvc.exe	146
PID 2364 wrote to memory of 3600	2364	DllCommonsvc.exe	147
PID 2364 wrote to memory of 3600	2364	DllCommonsvc.exe	147
PID 2364 wrote to memory of 4924	2364	DllCommonsvc.exe	156
PID 2364 wrote to memory of 4924	2364	DllCommonsvc.exe	156
PID 4924 wrote to memory of 4792	4924	cmd.exe	159
PID 4924 wrote to memory of 4792	4924	cmd.exe	159
PID 4924 wrote to memory of 2760	4924	cmd.exe	165
PID 4924 wrote to memory of 2760	4924	cmd.exe	165
PID 2760 wrote to memory of 4416	2760	smss.exe	168
PID 2760 wrote to memory of 4416	2760	smss.exe	168
PID 4416 wrote to memory of 1492	4416	cmd.exe	170
PID 4416 wrote to memory of 1492	4416	cmd.exe	170
PID 4416 wrote to memory of 3712	4416	cmd.exe	176
PID 4416 wrote to memory of 3712	4416	cmd.exe	176
PID 3712 wrote to memory of 2588	3712	smss.exe	178
PID 3712 wrote to memory of 2588	3712	smss.exe	178
PID 2588 wrote to memory of 2268	2588	cmd.exe	180
PID 2588 wrote to memory of 2268	2588	cmd.exe	180
PID 2588 wrote to memory of 4212	2588	cmd.exe	182
PID 2588 wrote to memory of 4212	2588	cmd.exe	182
PID 4212 wrote to memory of 380	4212	smss.exe	184
PID 4212 wrote to memory of 380	4212	smss.exe	184
PID 380 wrote to memory of 4992	380	cmd.exe	186
PID 380 wrote to memory of 4992	380	cmd.exe	186
PID 380 wrote to memory of 1928	380	cmd.exe	191
PID 380 wrote to memory of 1928	380	cmd.exe	191
PID 1928 wrote to memory of 5012	1928	smss.exe	193
PID 1928 wrote to memory of 5012	1928	smss.exe	193
PID 5012 wrote to memory of 644	5012	cmd.exe	195
PID 5012 wrote to memory of 644	5012	cmd.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ab6a565ec6c3b0bd1ecd2a061db936ada4b963602abfbf3755b8bf13230570be.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Favorites\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\es-ES\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Configuration\Schema\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\INF\RemoteAccess\0407\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Mp9X14fxO.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4924
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4792
      - C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1492
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2268
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4992
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:644
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat"
        15⤵
        
        PID:4420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1560
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Nc51i3GWIc.bat"
        17⤵
        
        PID:3208
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1400
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2896
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat"
        19⤵
        
        PID:1164
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1612
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat"
        21⤵
        
        PID:4016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4544
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat"
        23⤵
        
        PID:1240
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2844
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat"
        25⤵
        
        PID:3012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2760
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1148
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat"
        27⤵
        
        PID:4364
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2624
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat"
        29⤵
        
        PID:2816
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4960
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat"
        31⤵
        
        PID:4992
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:4036
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:728
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat"
        33⤵
        
        PID:4368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:2352
        
        C:\Windows\DigitalLocker\en-US\smss.exe
        
        "C:\Windows\DigitalLocker\en-US\smss.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Favorites\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\Favorites\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\IME\es-ES\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\IME\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Windows\IME\es-ES\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\DigitalLocker\en-US\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\providercommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\ja-JP\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Windows\INF\RemoteAccess\0407\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\INF\RemoteAccess\0407\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Windows\INF\RemoteAccess\0407\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\TAPI\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\TAPI\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Windows\TAPI\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows\Performance\WinSAT\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\Performance\WinSAT\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\2tBWjDxv5U.bat

Filesize
204B

MD5
73ed5742f73739e6c4b26e3a17e2bf19

SHA1
3afebd88fc64711899d499b0f2b78e0371618b16

SHA256
c4a626a85fd44f50a1d58645c47602aca2263c17b15a29e3bfd9778f2fc647df

SHA512
666e868237c60061c9f2c6cdefca5890f5cca80dcfc1c81fa9403b431760424c027ce79c291880955efaec3635488d4c4c227b82cb8db1276d22497690a32a1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3npectBbsF.bat

Filesize
204B

MD5
24e29b7c765173aacb2c9d7fe8ce6051

SHA1
c4cac2c8fb9dbc812207aff741422684a841e538

SHA256
5eb44c1912ffb804d79ba5b5a4a72ce21eb259553c9da5e4ef2354e80c3b2e4e

SHA512
2584eba8339505f8b456e1b1a7bbf8fe76b917973402eae305cfb70724d7d8e82a2bc6e862b871e63bc7dac75f9e1e2b13460c0be02e489a5b5106b56c020271

Download Submit
C:\Users\Admin\AppData\Local\Temp\8Mp9X14fxO.bat

Filesize
204B

MD5
f3f85b8631398ea0af6db5f406502056

SHA1
fa4d6016ee7eedf66fda3283fc2d41ea3c0f6d31

SHA256
2c2030d9bd0c4500cc3e5c6d54c3e2e4003325dc97a60e3af7a0f7e4f9121074

SHA512
bae5f3f9b4dc5858abe1945b3019b70d53d3b4b647b8cf71c31f9a65373e069b8f4cbfaf32c9a4602296beec3a4adf476b32525c5240f1399fcbb7c31e4c894a

Download Submit
C:\Users\Admin\AppData\Local\Temp\BcIiUXCUMc.bat

Filesize
204B

MD5
b8bb1f9c62f9daafaca217d79c20a2b0

SHA1
db6eefddade0d00d2079ce3ccd2b985f48b4e043

SHA256
d43fb1e1086ba5e749650d9a88b4b76e688ee453493ddee2cf2c160d64855e36

SHA512
f95d52334156a48059a58c3af4b201c5310648557be8aead8e21964e18abaea67ce8a114c207fd88eb0c36536a5aa9c1a9aaef1b6ab299088d14ac727fb9e9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CooinIVsng.bat

Filesize
204B

MD5
bd7845e57a3c9b4d78074ef735911d34

SHA1
a99300ce3e54b268d518c50d976a8afe15afd4a1

SHA256
b710a9c122169a86a12edbd5a876cc4002e460dc30763963b6edca72a0f53ba5

SHA512
c3be3cb3637e504b7ec78721641bb770a80b2210b962eb6aab659f734a014cca4d8d2aefbc56c946980ee47115a99e9e4a4c8b6b280c221b0429a8c411cf6672

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gozseo6rLH.bat

Filesize
204B

MD5
1b16838a4b390eb0a9f7207d7f18a2f5

SHA1
6ecf82d8431df9e40831c96a08eaff174abe1fd0

SHA256
239d9353dc394d817b4f21d649abcd5af2f88eb178a53c3597ce789a1c6e3cb3

SHA512
e9f3ce93b24e755f1f07ab5ecc82fb91b4287104a5d0e1a39d6998a855aa40ac9429462cc5734c132bf5b1f625ec44bc62ec933eb35154ecb0389e69264d483b

Download Submit
C:\Users\Admin\AppData\Local\Temp\JbtrqXgYk1.bat

Filesize
204B

MD5
4e7faa3dbfa1fa721618fad33da79ba0

SHA1
40a46aa025ec73b935c69b24572dd50991a6c714

SHA256
6ca6dbf7eb898186fb3cdf9e2f3a41fe121ff569783299b0a0e78fadb7919311

SHA512
04834f605acdea6fddba7ead605f9309d2d765da0abba46561963b431f54c14d96763801032c2d985bf006db19f59f59ce68bc43ae90cba24fea44a6b34a387b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lg3y2yDdyq.bat

Filesize
204B

MD5
887a3460b318a2c5372d2ab82512f34d

SHA1
e3c2b4b433e6e3e04275d1846fef3544fac5d5ae

SHA256
692341876d055fb333c98391c066f0ce9277b3c3622db700fd6206bb15da9c11

SHA512
8ba9bd3988e775747c46ee58d39629c3a8d12168e2cfb24d5d5e2c84ac7ed54e0c5262bae3b81bd3327418a229fb63ff4e53a4a0dc462aeaa2c24fa7b40c9ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nc51i3GWIc.bat

Filesize
204B

MD5
3e228989e866535602be83cc183af5b8

SHA1
dbaa8e07d939e29f55500a3f9154676255c9f6cc

SHA256
306be34d6f4f6e66e881aefad63512df36b0062b26c99de936b8e4d582388067

SHA512
60713a46ccbaa9be12bcb1c0f00840bbd6e663993c96c1ca6065bbfd449f57e8ddcf7632c1f6d1e43905d9be42fbff31bcf23122fc5e0d3b62512a614b59043a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TK13bru719.bat

Filesize
204B

MD5
0b397af8e516b829b1072bf34c8023f4

SHA1
e8e3d2a964260c75840458c94d569b5587c8a3c6

SHA256
db4ab327639044989dc6d27b3db496c2cbe88b0b72bbe8408e67915104ff56a9

SHA512
d41af21c5b0a54a57a414a53727f70cca80921baa5afaa0b382c730e4b4d1121bcd9e81460a0b6e6608439bb746d3090c0e08f05442efbebaecb0e546adccb66

Download Submit
C:\Users\Admin\AppData\Local\Temp\UWW2tbEWSD.bat

Filesize
204B

MD5
1e9f122e820a19ab412db77fe96e45b5

SHA1
9b87fbf002176edbac672b90ca9fb89ac468acba

SHA256
22d143870217706681a2cacfd6b3adbbf7221d496a99387e6f88e5b45465d2e7

SHA512
a43d01da3f99189f0ec43c2a736d9bf71c0a3eabbe3c338f0b9b31a391aeb7a5711e3e6d654fdb971a45f2b16d3c744d8aff02c5c51570c13a4a0db81515b234

Download Submit
C:\Users\Admin\AppData\Local\Temp\XIQ15LoDrx.bat

Filesize
204B

MD5
2411ee8a4bef23696e57cdacbc3aba33

SHA1
0c5f17f22bc23dc7d3388e4f9382fdaa3cb835d7

SHA256
3f205f7a6a8a528deeb47e16c64fc781a19267e73119741cf4c30828f11a2e00

SHA512
123a2c103fb59cf383c623716fc887fa19e19cb84a62b6b0dead1a21c18b286abf21172315fddadf71b64396a4490c7ca10145088241acca18fbfb68dc91e470

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxavskh2.ihz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fH1ASKIIFN.bat

Filesize
204B

MD5
eebe9cc7e6aa2777196655dbc97625b0

SHA1
740ffba4e05842e614564a123183e6746748a596

SHA256
9f45c1c67513150fda46be5a62617da1a01a70e3e76244013d0bd84be10955f9

SHA512
698f9c3273bda520dc01a3e7049977a8e6526ed8176cbf55fe8ebe61a15a4bcc8dbc34930ed206157738f6496d260f20e18d3719a3ec72fdfc84df6d1558d871

Download Submit
C:\Users\Admin\AppData\Local\Temp\wzkVYe0vvu.bat

Filesize
204B

MD5
8f4ca5fe0942235170157e9540962ccf

SHA1
8377d5550ae68e2cb518c6035c5b2a8a20aa8bf4

SHA256
05e59b50c3e9b66716256e93e692d64f78f3154e40f6b6b01ef85f2121807f09

SHA512
0443da92558b9e8c69812f7eb5bea9877c47950bc0d6528686692b60d7b585eed6f7f3b40763bf6fa6aa12a9ea78f01dd0004891b3deef2fb159973d495845ad

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/2364-16-0x000000001AD60000-0x000000001AD6C000-memory.dmp

Filesize
48KB

Download
memory/2364-12-0x00007FFEB3643000-0x00007FFEB3645000-memory.dmp

Filesize
8KB

Download
memory/2364-13-0x0000000000150000-0x0000000000260000-memory.dmp

Filesize
1.1MB

Download
memory/2364-14-0x0000000002430000-0x0000000002442000-memory.dmp

Filesize
72KB

Download
memory/2364-15-0x000000001AD70000-0x000000001AD7C000-memory.dmp

Filesize
48KB

Download
memory/2364-17-0x000000001AD80000-0x000000001AD8C000-memory.dmp

Filesize
48KB

Download
memory/2760-209-0x000000001C710000-0x000000001C722000-memory.dmp

Filesize
72KB

Download
memory/2896-249-0x000000001B5F0000-0x000000001B602000-memory.dmp

Filesize
72KB

Download
memory/3712-218-0x000000001AFF0000-0x000000001B002000-memory.dmp

Filesize
72KB

Download
memory/3952-49-0x0000025DF6DF0000-0x0000025DF6E12000-memory.dmp

Filesize
136KB

Download