Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 23:25
Behavioral task
behavioral1
Sample
JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe
-
Size
1.3MB
-
MD5
70885b3ec9d0f96c662c82849631c434
-
SHA1
1844199f7a28f059977c5c4c16ee7d50c494af73
-
SHA256
cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d
-
SHA512
8e437fb4e2cf8f3a1fdb8755642fbb397f7702a5decdd8ef669031c5aa057d5de16999e99290afea6f4ab1cffeaf7928a53853166e22e568f3adb1ebdf1fa6af
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3088 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3348 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4240 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1028 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4256 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 632 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2480 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4828 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4636 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3084 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 636 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4212 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3780 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3692 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1472 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2420 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1256 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3004 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4760 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 456 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3956 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2304 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3156 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 2816 schtasks.exe 89 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4608 2816 schtasks.exe 89 -
resource yara_rule behavioral2/files/0x0007000000023c7f-10.dat dcrat behavioral2/memory/1440-13-0x0000000000F10000-0x0000000001020000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2192 powershell.exe 3796 powershell.exe 3528 powershell.exe 3924 powershell.exe 2936 powershell.exe 3256 powershell.exe 4520 powershell.exe 5028 powershell.exe 3600 powershell.exe 920 powershell.exe 4836 powershell.exe 5040 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation sysmon.exe -
Executes dropped EXE 14 IoCs
pid Process 1440 DllCommonsvc.exe 2984 sysmon.exe 3080 sysmon.exe 4380 sysmon.exe 4040 sysmon.exe 4776 sysmon.exe 3776 sysmon.exe 1548 sysmon.exe 3576 sysmon.exe 740 sysmon.exe 1588 sysmon.exe 3972 sysmon.exe 1328 sysmon.exe 920 sysmon.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 42 raw.githubusercontent.com 56 raw.githubusercontent.com 41 raw.githubusercontent.com 46 raw.githubusercontent.com 47 raw.githubusercontent.com 58 raw.githubusercontent.com 59 raw.githubusercontent.com 14 raw.githubusercontent.com 27 raw.githubusercontent.com 15 raw.githubusercontent.com 54 raw.githubusercontent.com 60 raw.githubusercontent.com 48 raw.githubusercontent.com 57 raw.githubusercontent.com -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Multimedia Platform\unsecapp.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\29c1c3cc0f7685 DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\conhost.exe DllCommonsvc.exe File created C:\Program Files\Windows NT\TableTextService\en-US\088424020bedd6 DllCommonsvc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\SppExtComObj.exe DllCommonsvc.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\e1ef82546f0b02 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\unsecapp.exe DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\ModemLogs\fontdrvhost.exe DllCommonsvc.exe File created C:\Windows\ModemLogs\5b884080fd4f94 DllCommonsvc.exe File created C:\Windows\Web\Wallpaper\Windows\sppsvc.exe DllCommonsvc.exe File created C:\Windows\Web\Wallpaper\Windows\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\Web\Registry.exe DllCommonsvc.exe File created C:\Windows\Web\ee2ad38f3d4382 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings sysmon.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3084 schtasks.exe 1256 schtasks.exe 2940 schtasks.exe 3156 schtasks.exe 1028 schtasks.exe 4636 schtasks.exe 3692 schtasks.exe 1588 schtasks.exe 3348 schtasks.exe 8 schtasks.exe 4256 schtasks.exe 636 schtasks.exe 2420 schtasks.exe 3956 schtasks.exe 2304 schtasks.exe 4608 schtasks.exe 3088 schtasks.exe 1532 schtasks.exe 3780 schtasks.exe 1592 schtasks.exe 4828 schtasks.exe 4240 schtasks.exe 1472 schtasks.exe 2808 schtasks.exe 1968 schtasks.exe 1932 schtasks.exe 3004 schtasks.exe 4760 schtasks.exe 456 schtasks.exe 2932 schtasks.exe 632 schtasks.exe 2480 schtasks.exe 4212 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1440 DllCommonsvc.exe 1440 DllCommonsvc.exe 1440 DllCommonsvc.exe 1440 DllCommonsvc.exe 1440 DllCommonsvc.exe 3600 powershell.exe 3600 powershell.exe 3256 powershell.exe 3256 powershell.exe 2936 powershell.exe 2936 powershell.exe 2192 powershell.exe 2192 powershell.exe 3528 powershell.exe 3528 powershell.exe 5040 powershell.exe 5040 powershell.exe 5028 powershell.exe 5028 powershell.exe 3796 powershell.exe 3796 powershell.exe 920 powershell.exe 920 powershell.exe 4520 powershell.exe 4520 powershell.exe 4836 powershell.exe 4836 powershell.exe 3924 powershell.exe 3924 powershell.exe 3256 powershell.exe 2192 powershell.exe 3600 powershell.exe 5040 powershell.exe 3796 powershell.exe 5028 powershell.exe 920 powershell.exe 2936 powershell.exe 3528 powershell.exe 4520 powershell.exe 4836 powershell.exe 3924 powershell.exe 2984 sysmon.exe 3080 sysmon.exe 4380 sysmon.exe 4040 sysmon.exe 4776 sysmon.exe 3776 sysmon.exe 1548 sysmon.exe 3576 sysmon.exe 740 sysmon.exe 1588 sysmon.exe 3972 sysmon.exe 1328 sysmon.exe 920 sysmon.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 1440 DllCommonsvc.exe Token: SeDebugPrivilege 3600 powershell.exe Token: SeDebugPrivilege 3256 powershell.exe Token: SeDebugPrivilege 2936 powershell.exe Token: SeDebugPrivilege 2192 powershell.exe Token: SeDebugPrivilege 3528 powershell.exe Token: SeDebugPrivilege 5028 powershell.exe Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 3796 powershell.exe Token: SeDebugPrivilege 920 powershell.exe Token: SeDebugPrivilege 4520 powershell.exe Token: SeDebugPrivilege 4836 powershell.exe Token: SeDebugPrivilege 3924 powershell.exe Token: SeDebugPrivilege 2984 sysmon.exe Token: SeDebugPrivilege 3080 sysmon.exe Token: SeDebugPrivilege 4380 sysmon.exe Token: SeDebugPrivilege 4040 sysmon.exe Token: SeDebugPrivilege 4776 sysmon.exe Token: SeDebugPrivilege 3776 sysmon.exe Token: SeDebugPrivilege 1548 sysmon.exe Token: SeDebugPrivilege 3576 sysmon.exe Token: SeDebugPrivilege 740 sysmon.exe Token: SeDebugPrivilege 1588 sysmon.exe Token: SeDebugPrivilege 3972 sysmon.exe Token: SeDebugPrivilege 1328 sysmon.exe Token: SeDebugPrivilege 920 sysmon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 3248 4996 JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe 84 PID 4996 wrote to memory of 3248 4996 JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe 84 PID 4996 wrote to memory of 3248 4996 JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe 84 PID 3248 wrote to memory of 3604 3248 WScript.exe 86 PID 3248 wrote to memory of 3604 3248 WScript.exe 86 PID 3248 wrote to memory of 3604 3248 WScript.exe 86 PID 3604 wrote to memory of 1440 3604 cmd.exe 88 PID 3604 wrote to memory of 1440 3604 cmd.exe 88 PID 1440 wrote to memory of 3924 1440 DllCommonsvc.exe 124 PID 1440 wrote to memory of 3924 1440 DllCommonsvc.exe 124 PID 1440 wrote to memory of 2936 1440 DllCommonsvc.exe 125 PID 1440 wrote to memory of 2936 1440 DllCommonsvc.exe 125 PID 1440 wrote to memory of 2192 1440 DllCommonsvc.exe 126 PID 1440 wrote to memory of 2192 1440 DllCommonsvc.exe 126 PID 1440 wrote to memory of 920 1440 DllCommonsvc.exe 127 PID 1440 wrote to memory of 920 1440 DllCommonsvc.exe 127 PID 1440 wrote to memory of 3256 1440 DllCommonsvc.exe 128 PID 1440 wrote to memory of 3256 1440 DllCommonsvc.exe 128 PID 1440 wrote to memory of 3600 1440 DllCommonsvc.exe 129 PID 1440 wrote to memory of 3600 1440 DllCommonsvc.exe 129 PID 1440 wrote to memory of 5028 1440 DllCommonsvc.exe 130 PID 1440 wrote to memory of 5028 1440 DllCommonsvc.exe 130 PID 1440 wrote to memory of 3528 1440 DllCommonsvc.exe 131 PID 1440 wrote to memory of 3528 1440 DllCommonsvc.exe 131 PID 1440 wrote to memory of 4520 1440 DllCommonsvc.exe 132 PID 1440 wrote to memory of 4520 1440 DllCommonsvc.exe 132 PID 1440 wrote to memory of 5040 1440 DllCommonsvc.exe 133 PID 1440 wrote to memory of 5040 1440 DllCommonsvc.exe 133 PID 1440 wrote to memory of 3796 1440 DllCommonsvc.exe 134 PID 1440 wrote to memory of 3796 1440 DllCommonsvc.exe 134 PID 1440 wrote to memory of 4836 1440 DllCommonsvc.exe 135 PID 1440 wrote to memory of 4836 1440 DllCommonsvc.exe 135 PID 1440 wrote to memory of 1100 1440 DllCommonsvc.exe 148 PID 1440 wrote to memory of 1100 1440 DllCommonsvc.exe 148 PID 1100 wrote to memory of 3236 1100 cmd.exe 150 PID 1100 wrote to memory of 3236 1100 cmd.exe 150 PID 1100 wrote to memory of 2984 1100 cmd.exe 152 PID 1100 wrote to memory of 2984 1100 cmd.exe 152 PID 2984 wrote to memory of 2616 2984 sysmon.exe 154 PID 2984 wrote to memory of 2616 2984 sysmon.exe 154 PID 2616 wrote to memory of 1256 2616 cmd.exe 156 PID 2616 wrote to memory of 1256 2616 cmd.exe 156 PID 2616 wrote to memory of 3080 2616 cmd.exe 165 PID 2616 wrote to memory of 3080 2616 cmd.exe 165 PID 3080 wrote to memory of 964 3080 sysmon.exe 171 PID 3080 wrote to memory of 964 3080 sysmon.exe 171 PID 964 wrote to memory of 3060 964 cmd.exe 173 PID 964 wrote to memory of 3060 964 cmd.exe 173 PID 964 wrote to memory of 4380 964 cmd.exe 178 PID 964 wrote to memory of 4380 964 cmd.exe 178 PID 4380 wrote to memory of 4604 4380 sysmon.exe 180 PID 4380 wrote to memory of 4604 4380 sysmon.exe 180 PID 4604 wrote to memory of 3916 4604 cmd.exe 182 PID 4604 wrote to memory of 3916 4604 cmd.exe 182 PID 4604 wrote to memory of 4040 4604 cmd.exe 184 PID 4604 wrote to memory of 4040 4604 cmd.exe 184 PID 4040 wrote to memory of 3780 4040 sysmon.exe 186 PID 4040 wrote to memory of 3780 4040 sysmon.exe 186 PID 3780 wrote to memory of 2864 3780 cmd.exe 188 PID 3780 wrote to memory of 2864 3780 cmd.exe 188 PID 3780 wrote to memory of 4776 3780 cmd.exe 190 PID 3780 wrote to memory of 4776 3780 cmd.exe 190 PID 4776 wrote to memory of 3004 4776 sysmon.exe 192 PID 4776 wrote to memory of 3004 4776 sysmon.exe 192 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_cb1fef4694d8e4ea173c464b0f7f23acee7fd8b213e89ff36df383334bd5735d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\en-US\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\Wallpaper\Windows\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YrnC2DVkUT.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3236
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hbGxgnDDQj.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:1256
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zHC6P4FzNT.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:3060
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzuRWOxc20.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:3916
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GzuRWOxc20.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:2864
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zj0hR7WTEZ.bat"15⤵PID:3004
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:1696
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vIn8vbLsXf.bat"17⤵PID:5028
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:1760
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DC0SKfNvdG.bat"19⤵PID:2404
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:1060
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M1TWCJOn7d.bat"21⤵PID:1764
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:888
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:740 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J6RTVEKunr.bat"23⤵PID:5104
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:2984
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nKCzYbro9F.bat"25⤵PID:2092
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:2552
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lZfwAG7KGX.bat"27⤵PID:2800
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:1028
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BGyPdaK1JU.bat"29⤵PID:1056
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:4912
-
-
C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat"31⤵PID:1500
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:1268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4240
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\providercommon\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Web\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\Web\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Users\Public\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\Public\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Users\Public\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\ModemLogs\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\ModemLogs\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Wallpaper\Windows\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\Windows\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2808
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\Web\Wallpaper\Windows\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3156
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD56c47b3f4e68eebd47e9332eebfd2dd4e
SHA167f0b143336d7db7b281ed3de5e877fa87261834
SHA2568c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA5120acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
214B
MD5e576b2908b84d3b5de2d231ee19d1459
SHA108e6b5b8788435c729f1795e8e1b755dad126647
SHA256e4a855d8443854510c3fc7d2c61561ab619097c01ab3018ad2fe2cff134af7ce
SHA512b915f4dfcbe707c03a30ebce424b8e9540715fe72ed202e46a8bcb97acbd158c2fa7df83ac954cff08590166f308dc9620134741d19d52dc011b65a64a443344
-
Filesize
214B
MD584abfffdc02e4046d978e82acf16304f
SHA10410223d75c2984f9674fdd4159954c61ac46cce
SHA2560d029c92021c462150ed621a54369ca89aa4896d39256cff90b7f8c29229731b
SHA5120b7161027707606df358b71a35e3273ebbfb262f61d7e4a99282a7536aeefa6145beda2e09c67597d4f6d48067dffb7c56ba625f9518383f2ea42d22edb5acf4
-
Filesize
214B
MD5ebbe51e81b60c1ca45dedacdaa8b2835
SHA112aa39c182174b30829661dfac82f0a7b56f9250
SHA2563cd3b3198e7084ec117b6244502b9f05e4c9f2e700f9344a0628820814543fd6
SHA512ea2a0af9d0962163ac64e564b06cd72a15e739615199f6d085346c3cf938fbbae5b2fd2382cd95a5b0edc17d96f23d108048905a751434519ab73fdba3e8c9c2
-
Filesize
214B
MD55545255a69f6ca2eda8da90e5c757194
SHA1bae2aba1bac0b841d702f691b316570ed839dda2
SHA25638a16785ed03c314788108d48ea435df6fc7f5cf17d758df2119fb1a212fc33d
SHA512ab3c228046afbadc45e1a7371609e89b543c6e58debc022bbbe44b4bc8465b1a3c5529d23b9cd4c9bdaead8531c973509d435a0519329c6597976c8c1c516d98
-
Filesize
214B
MD50e5f0169e25e12d01e1f10398d0ebd96
SHA1bdc19a0fa4e49d73a36302db2220bd54cac8e8d2
SHA25642779e4524e972f156938737202779db879274620ad0853b3a62e2759140a418
SHA512e61cbb2ece16e2ebdc05b5c15b57cfb4634b5a70134f9cd705e943af991ccf56dac470144ae36d8c86b59e6fcffe56d6a67bba8e70af049d2bc2b431685ed18a
-
Filesize
214B
MD54a07b94e19dfc92fccae1b7b15af05b2
SHA1dd0af0a7b0260e5a38fae0e7a6e659a13ed0c5f7
SHA2566b797cb97553a9e2ed17fbe3f6d87aa1c9c627436e60607758c57abcbe605e0d
SHA512ebdfa9df5ca8c1b7d1e9c444e88d33accc736ff801f31274aedfee2a6dd0be8a2af725c5d529365ec1c44e9fe0680da4c50c9e4150cb32ef2a16397aa86b7b12
-
Filesize
214B
MD5c03f4cd11ab344732f759a04ad65fc16
SHA13596887ddda837ff38c3adb9ff4ef8e0ba44400a
SHA256bab373e052a853c04696b7611963d41c26fb13f5278d5fedc7cf25ee6dacdca7
SHA51246f88c114ecf2a49d2a0b43835f0653bce20af3b46159003a5ff161c644d05fde7924a7b753cbc522fc78b9be913820731de75f128db6c5ead976974be29e557
-
Filesize
214B
MD5f8f012f561e295dd8b1bac54e8d05a95
SHA11f0d5db8e100dc89d69dbb8b877cd7004313bc35
SHA2560f747114d0f5d3d7312b492f0a1daceb271c4880dc6ff5fcea0caa1a5c4478f0
SHA5123e6a48b6a6dcc1896ff5e9dd37df8c953fe990601055ebcc36dac18529aaf3b1b3a44624c830f16c5871c551f7bfcecb569efcd8c578e5795592c573123d665a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
214B
MD54ed54e28bb79221ea4b02867bef8bd43
SHA1b3f9235c8e0149382a550f2667743aee544dde98
SHA256353f2c8fc2f81737e7ad371fe5d492d6fbc45ac950f20ebf9d01795cd928623a
SHA512d5479182752a5a212f6f27e4306a17f28e3ccbbaaf4ae1c348326003cf914966c6e0754f6dbb2d04fa0ef1ddaeb67c22049975e37ce2ea2dc6dae5df35ee9395
-
Filesize
214B
MD50f0441d5ba1f554b54f1db78c23b5a0d
SHA1939bed524301d6a95ff77db0a2f4744b6c37f891
SHA256bc5f042a3da7e169bfc1cfa3899128949d356002d29f96d39e964ba5ab06bb2c
SHA512ea7bef84e638c0f98b9eda6d3f0031597d5dfe2cc676082d4eee88dcfa2ceaa29af3f6b453f5346206b912c99a6108b3695dd6c2647a4d7e4a003c4e3edeaa0b
-
Filesize
214B
MD5e8d59bd704311566f32f2a8962539f3d
SHA1c15dcad174661ee8f35825531d8f984347b1022e
SHA25686a1339d1c4f722ee74af10828adacb976982f6d1e41543fe554fbae92b412bf
SHA51262d4ae729211e31bc590057a94c8ce9d1ef69482e54f58d6f467ee0bbfec68e8c024d1085e27bee8d980abc03600f72666a990027479b9e7580274df52080663
-
Filesize
214B
MD5e57e3e29dc9bf76bd73cbff183995f5d
SHA1fd95b2a239c9f0da9e59155dbd0171556164c105
SHA2567248a673b62f65f68e664621083822be0bdf80d216c3805eb7b7c519d0de1dff
SHA512980ff26a3d0e5203acd8206c113b101a3fa5a6e770610e092c4e3bbe33536e13e526280c61c8094324b982e43226f004769717d4af573ff86520d34167ff2654
-
Filesize
214B
MD5333512b3b33405e97637845e7ee74393
SHA19e1ec0bb0f2f0881a57634ca43c91d9b309a1805
SHA2562d08f28cd1af921d96b0125929c628d2b369aadf1a8a6ba77f2cb0ef4f1c1523
SHA5129acc6f17eec1fa18a8296902005457c5339485b71a121810c786efc7fb2f0b7330f63e78646bcc83a706e433a6203a41ce14f52f0c3534dd3596cd5f92e71bff
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478