dcrat | 93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe
Size

1.3MB
MD5

3024727d167ae961994e1db234cab15d
SHA1

c26321975d3dee53539a723dc177bc1e707e568a
SHA256

93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620
SHA512

58590453cd98d083a0baf12d68ae13ad293f3dfa75d3bad4178bba106c6624855a380fc42311de0856461ece312a1c2ef00e283a8dd302ac263a62313722ac17
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4444	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3244	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4868	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4620	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	460	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3628	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2456	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3576	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1676	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3688	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	2356	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	2356	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b96-10.dat	dcrat
behavioral2/memory/4716-13-0x00000000006F0000-0x0000000000800000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2308	powershell.exe
3588	powershell.exe
2684	powershell.exe
3968	powershell.exe
4072	powershell.exe
3204	powershell.exe
60	powershell.exe
2056	powershell.exe
1984	powershell.exe
4044	powershell.exe
3960	powershell.exe
4884	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	fontdrvhost.exe

Executes dropped EXE 15 IoCs

pid	Process
4716	DllCommonsvc.exe
2520	fontdrvhost.exe
4548	fontdrvhost.exe
4252	fontdrvhost.exe
3596	fontdrvhost.exe
1416	fontdrvhost.exe
2344	fontdrvhost.exe
2600	fontdrvhost.exe
2608	fontdrvhost.exe
916	fontdrvhost.exe
1068	fontdrvhost.exe
3688	fontdrvhost.exe
1188	fontdrvhost.exe
1032	fontdrvhost.exe
1472	fontdrvhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
51	raw.githubusercontent.com
44	raw.githubusercontent.com
54	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
34	raw.githubusercontent.com
40	raw.githubusercontent.com
39	raw.githubusercontent.com
52	raw.githubusercontent.com
24	raw.githubusercontent.com
38	raw.githubusercontent.com
53	raw.githubusercontent.com
55	raw.githubusercontent.com

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\ModifiableWindowsApps\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\5b884080fd4f94	DllCommonsvc.exe
File opened for modification	C:\Program Files\Crashpad\reports\Registry.exe	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\reports\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Crashpad\reports\Registry.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Mail\csrss.exe	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Panther\setup.exe\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\PrintDialog\Assets\cmd.exe	DllCommonsvc.exe
File created	C:\Windows\PrintDialog\Assets\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Windows\Panther\setup.exe\Idle.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	fontdrvhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4868	schtasks.exe
1300	schtasks.exe
2456	schtasks.exe
1516	schtasks.exe
4732	schtasks.exe
4620	schtasks.exe
1004	schtasks.exe
3576	schtasks.exe
4252	schtasks.exe
4116	schtasks.exe
812	schtasks.exe
5072	schtasks.exe
636	schtasks.exe
3052	schtasks.exe
3640	schtasks.exe
3688	schtasks.exe
3312	schtasks.exe
4188	schtasks.exe
1400	schtasks.exe
4576	schtasks.exe
3628	schtasks.exe
1676	schtasks.exe
1696	schtasks.exe
2220	schtasks.exe
2740	schtasks.exe
4444	schtasks.exe
4516	schtasks.exe
384	schtasks.exe
460	schtasks.exe
1292	schtasks.exe
2224	schtasks.exe
3244	schtasks.exe
3916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
4716	DllCommonsvc.exe
3588	powershell.exe
3588	powershell.exe
1984	powershell.exe
1984	powershell.exe
60	powershell.exe
60	powershell.exe
4072	powershell.exe
4072	powershell.exe
4044	powershell.exe
4044	powershell.exe
2684	powershell.exe
2684	powershell.exe
2056	powershell.exe
2056	powershell.exe
3968	powershell.exe
3960	powershell.exe
3968	powershell.exe
3960	powershell.exe
3204	powershell.exe
3204	powershell.exe
4072	powershell.exe
4884	powershell.exe
4884	powershell.exe
2308	powershell.exe
2308	powershell.exe
4884	powershell.exe
1984	powershell.exe
3588	powershell.exe
3204	powershell.exe
60	powershell.exe
2684	powershell.exe
2056	powershell.exe
4044	powershell.exe
3960	powershell.exe
3968	powershell.exe
2308	powershell.exe
4548	fontdrvhost.exe
4252	fontdrvhost.exe
3596	fontdrvhost.exe
1416	fontdrvhost.exe
2344	fontdrvhost.exe
2600	fontdrvhost.exe
2608	fontdrvhost.exe
916	fontdrvhost.exe
1068	fontdrvhost.exe
3688	fontdrvhost.exe
1188	fontdrvhost.exe
1032	fontdrvhost.exe
1472	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	DllCommonsvc.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	4072	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	4548	fontdrvhost.exe
Token: SeDebugPrivilege	4252	fontdrvhost.exe
Token: SeDebugPrivilege	3596	fontdrvhost.exe
Token: SeDebugPrivilege	1416	fontdrvhost.exe
Token: SeDebugPrivilege	2344	fontdrvhost.exe
Token: SeDebugPrivilege	2600	fontdrvhost.exe
Token: SeDebugPrivilege	2608	fontdrvhost.exe
Token: SeDebugPrivilege	916	fontdrvhost.exe
Token: SeDebugPrivilege	1068	fontdrvhost.exe
Token: SeDebugPrivilege	3688	fontdrvhost.exe
Token: SeDebugPrivilege	1188	fontdrvhost.exe
Token: SeDebugPrivilege	1032	fontdrvhost.exe
Token: SeDebugPrivilege	1472	fontdrvhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2532	1236	JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe	83
PID 1236 wrote to memory of 2532	1236	JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe	83
PID 1236 wrote to memory of 2532	1236	JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe	83
PID 2532 wrote to memory of 4904	2532	WScript.exe	85
PID 2532 wrote to memory of 4904	2532	WScript.exe	85
PID 2532 wrote to memory of 4904	2532	WScript.exe	85
PID 4904 wrote to memory of 4716	4904	cmd.exe	87
PID 4904 wrote to memory of 4716	4904	cmd.exe	87
PID 4716 wrote to memory of 2308	4716	DllCommonsvc.exe	123
PID 4716 wrote to memory of 2308	4716	DllCommonsvc.exe	123
PID 4716 wrote to memory of 2056	4716	DllCommonsvc.exe	124
PID 4716 wrote to memory of 2056	4716	DllCommonsvc.exe	124
PID 4716 wrote to memory of 3588	4716	DllCommonsvc.exe	125
PID 4716 wrote to memory of 3588	4716	DllCommonsvc.exe	125
PID 4716 wrote to memory of 1984	4716	DllCommonsvc.exe	126
PID 4716 wrote to memory of 1984	4716	DllCommonsvc.exe	126
PID 4716 wrote to memory of 2684	4716	DllCommonsvc.exe	127
PID 4716 wrote to memory of 2684	4716	DllCommonsvc.exe	127
PID 4716 wrote to memory of 3968	4716	DllCommonsvc.exe	128
PID 4716 wrote to memory of 3968	4716	DllCommonsvc.exe	128
PID 4716 wrote to memory of 4072	4716	DllCommonsvc.exe	129
PID 4716 wrote to memory of 4072	4716	DllCommonsvc.exe	129
PID 4716 wrote to memory of 4044	4716	DllCommonsvc.exe	130
PID 4716 wrote to memory of 4044	4716	DllCommonsvc.exe	130
PID 4716 wrote to memory of 3960	4716	DllCommonsvc.exe	131
PID 4716 wrote to memory of 3960	4716	DllCommonsvc.exe	131
PID 4716 wrote to memory of 3204	4716	DllCommonsvc.exe	132
PID 4716 wrote to memory of 3204	4716	DllCommonsvc.exe	132
PID 4716 wrote to memory of 4884	4716	DllCommonsvc.exe	133
PID 4716 wrote to memory of 4884	4716	DllCommonsvc.exe	133
PID 4716 wrote to memory of 60	4716	DllCommonsvc.exe	134
PID 4716 wrote to memory of 60	4716	DllCommonsvc.exe	134
PID 4716 wrote to memory of 2520	4716	DllCommonsvc.exe	146
PID 4716 wrote to memory of 2520	4716	DllCommonsvc.exe	146
PID 1896 wrote to memory of 3780	1896	cmd.exe	158
PID 1896 wrote to memory of 3780	1896	cmd.exe	158
PID 1896 wrote to memory of 4548	1896	cmd.exe	164
PID 1896 wrote to memory of 4548	1896	cmd.exe	164
PID 4548 wrote to memory of 2316	4548	fontdrvhost.exe	166
PID 4548 wrote to memory of 2316	4548	fontdrvhost.exe	166
PID 2316 wrote to memory of 1008	2316	cmd.exe	168
PID 2316 wrote to memory of 1008	2316	cmd.exe	168
PID 2316 wrote to memory of 4252	2316	cmd.exe	172
PID 2316 wrote to memory of 4252	2316	cmd.exe	172
PID 4252 wrote to memory of 4220	4252	fontdrvhost.exe	174
PID 4252 wrote to memory of 4220	4252	fontdrvhost.exe	174
PID 4220 wrote to memory of 3104	4220	cmd.exe	176
PID 4220 wrote to memory of 3104	4220	cmd.exe	176
PID 4220 wrote to memory of 3596	4220	cmd.exe	179
PID 4220 wrote to memory of 3596	4220	cmd.exe	179
PID 3596 wrote to memory of 1484	3596	fontdrvhost.exe	181
PID 3596 wrote to memory of 1484	3596	fontdrvhost.exe	181
PID 1484 wrote to memory of 4620	1484	cmd.exe	183
PID 1484 wrote to memory of 4620	1484	cmd.exe	183
PID 1484 wrote to memory of 1416	1484	cmd.exe	185
PID 1484 wrote to memory of 1416	1484	cmd.exe	185
PID 1416 wrote to memory of 3284	1416	fontdrvhost.exe	187
PID 1416 wrote to memory of 3284	1416	fontdrvhost.exe	187
PID 3284 wrote to memory of 864	3284	cmd.exe	189
PID 3284 wrote to memory of 864	3284	cmd.exe	189
PID 3284 wrote to memory of 2344	3284	cmd.exe	191
PID 3284 wrote to memory of 2344	3284	cmd.exe	191
PID 2344 wrote to memory of 4732	2344	fontdrvhost.exe	193
PID 2344 wrote to memory of 4732	2344	fontdrvhost.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_93da02a57aa4a7125ed69617157b54b5c3afb4091e7fc53fc47c450aececa620.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\reports\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\setup.exe\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PrintDialog\Assets\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\setup\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:60
    - - C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        
        PID:2520
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3780
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ffEuziAK6w.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1008
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4220
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3104
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RkPY472Oq9.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4620
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:864
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bf2k7CZMYL.bat"
        16⤵
        
        PID:4732
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:376
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat"
        18⤵
        
        PID:3812
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2796
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\80JI9OTYea.bat"
        20⤵
        
        PID:2300
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4328
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat"
        22⤵
        
        PID:1136
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:512
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\U04fYIssV3.bat"
        24⤵
        
        PID:5104
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4912
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3688
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat"
        26⤵
        
        PID:2088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:2604
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kOAwrWovpT.bat"
        28⤵
        
        PID:5028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2684
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat"
        30⤵
        
        PID:968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1584
        
        C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe
        
        "C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe"
        31⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Crashpad\reports\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Crashpad\reports\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Panther\setup.exe\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\setup.exe\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Mail\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\providercommon\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\PrintDialog\Assets\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Windows\PrintDialog\Assets\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\setup\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\providercommon\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\providercommon\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\3HNGHapxv4.bat

Filesize
227B

MD5
02ec43295e5a70653bc14adff0dafbdf

SHA1
aab18e4fa4f44c611057b4bf5e2f98bc34fa5cbc

SHA256
62b55cfdc3ff69fd43cc1dbe557c1420460c58c79d123ca20fb34c636355de98

SHA512
1dd49604676c3398b2ad14fe7e1ce062a8531054214503716dfdfaebaddb76c9d59d4171ed849b7ce768c11e87bd4c4fd270eada44cc1fadb35455c4fe7dc184

Download Submit
C:\Users\Admin\AppData\Local\Temp\80JI9OTYea.bat

Filesize
227B

MD5
a73435491457dede3b7ab43863554542

SHA1
2072a17f42558fe20e18e2f5d86e3bb7a742c679

SHA256
fd640d123d69edfa95009e652367b4239903d798070e5051a2779fee3e839160

SHA512
4b5bfbaac15360b922e31bdb48dad88cbf572756a25208e00adda5598d4ea890b0886cdd151d17e15858021c20054d236d1c28303f36aac8388de71f7f1e872d

Download Submit
C:\Users\Admin\AppData\Local\Temp\F82V1kRox2.bat

Filesize
227B

MD5
be01c09253cfb9d658261f3642b43379

SHA1
46d66afd9b14ba70db4bb6a45c8a85df2e4dbe36

SHA256
a1fe3b90e50f0dedf481c5dd5c19fc4333e17d60028c04ee7879db03e8a49ac0

SHA512
9965789bc2783198f1fabbbe0578a8ac961b42dbd30202966e63b8119431f20e039272da2d23dd42740db0f8674b83f220ea0cd373c7e7575f7168ba2b41e801

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kz6bOuYaab.bat

Filesize
227B

MD5
704d76a160ee7bcb80d53e47535d5b60

SHA1
48ad68e912e27850caacd7783d7c4f3eae7bf1fb

SHA256
964299e7dd2f176fd8a4d96045ffb8d4fd355b8d98d20cfb1b521c4d1a84a70d

SHA512
9b26970e3a63cb555cd8ecbb3e53e5a71a16135178758a0ec18de3aa4591fe82499b05f31ca2bcfa68067548ce3207554d7223995c4109de1e6085ed787b81e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\OxVZsORhRP.bat

Filesize
227B

MD5
9476c4e8e0a70f4779c2912d83b3c587

SHA1
ff70e4439f8e2755c3ad505e99e0d79c62c9b21d

SHA256
ed68256a03ef63056e8b3265b28bfa5fd06f0505ec9eaa0e7d33e25d20277ffe

SHA512
eca2ee600e046bcba8210087973d1321ff28cb842c5ed20fea1e994384c8b2acb6a0cb638e46fce77dca0a50f804d6bbddaf288a36ec85c3a772014f4195fa4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QtXcZTVakC.bat

Filesize
227B

MD5
5011737b54b34cd74d03bae13923e347

SHA1
58172767f262fc7b76583ffc0aa23fb37fa75bdd

SHA256
148e7fbbadbef9cd31f9df1024b03f3b2e8a78228309b610510f36f8fa341251

SHA512
906af2cc0eddb26f0d0fcfc321a9210dea1a2a70097650c5456a5239c1f6646b8796e54590c19cd55be088d9f04708831abf297835d5aca3331875b9ac594b21

Download Submit
C:\Users\Admin\AppData\Local\Temp\RkPY472Oq9.bat

Filesize
227B

MD5
a8d890006065b6a53e57e7b35e9090cc

SHA1
58756dd69a76f7263860c5d8bacf2a47923f5f33

SHA256
2d019d60069de68d7ebde8739b436e199258f4b9608d803e14c47c49a811ca7e

SHA512
efae29782eead5949eca5ba93faa29f0bf2a81223ad091f4ff15ec4a6c3d32563730856eef5f40dab06e68926e273b41f49b3f29e7a885bf916563bd7df57f59

Download Submit
C:\Users\Admin\AppData\Local\Temp\U04fYIssV3.bat

Filesize
227B

MD5
18e36949480589b2231c22b0a5ff3a48

SHA1
3dea073309aaeb69d20f7c96d6e9d48100e209fc

SHA256
ea57d2e89c86c539cdd8071de8efbf01e40a41df8ecd309c071205791d054771

SHA512
fa65005a262c9f2215f4faedcb47034a425556489a8490b16ae4a54ed8121fd9cecd0f56191458121ad4e40cb2827f1410940eb77cdcfd195b3c3c1949eaef71

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvlk5cs5.yqo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bf2k7CZMYL.bat

Filesize
227B

MD5
9f78ac4925371f53a0313581fadafc5e

SHA1
127d6b8918e31469077af01d2c605de7c597dc9f

SHA256
3d6a5dddc25d30083274f197318e5cfd12983e26cbdb6fa022ca72d80d6b4164

SHA512
f3560a3783fb719e54487fcd3703369fe852cded460a0e613ac25e094e51a0e75582b6eeaa2daeaf0cfef1e770ab0e1b1a1dfbe07c8c152b72b8ac5525f02c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\ffEuziAK6w.bat

Filesize
227B

MD5
8920ff4ae71e9e3b36d289c4ebb94a07

SHA1
75c1761eea94625cf0625e9be94dea4aea692455

SHA256
4e6297a2f199ab9a7dee5372e68e50920a7dc357a7e743d7e879a8a048e7cbe6

SHA512
7f52c971764f2bfd4ea0f2054de667609cf574b7a0477e46ae6fbc3aa6fe293d98884449466a4eccdc5bf6ab1902dfeb00e74ff867d03f7183939e2356c20433

Download Submit
C:\Users\Admin\AppData\Local\Temp\kOAwrWovpT.bat

Filesize
227B

MD5
3c3ef971607024248e713230ff7ccb82

SHA1
8b6924d9b8b27ed01a992a891b3eb7cd1dbab5bf

SHA256
400776a81c88ff29cb9ff8d888828ac6c923b423a666141c0c26adf40324e47c

SHA512
9aaca2a611aa0f44e2fa55aabad1681d29d826486cf1fccad30ab33bebcb9c063d91577d3ba02377c1e807a97d081d22f1df74b2a403b89c89d5998e5d6aa5ed

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1032-260-0x0000000001030000-0x0000000001042000-memory.dmp

Filesize
72KB

Download
memory/1416-212-0x000000001CB80000-0x000000001CCEA000-memory.dmp

Filesize
1.4MB

Download
memory/1472-267-0x00000000031F0000-0x0000000003202000-memory.dmp

Filesize
72KB

Download
memory/2344-215-0x0000000000D00000-0x0000000000D12000-memory.dmp

Filesize
72KB

Download
memory/2344-220-0x000000001C020000-0x000000001C18A000-memory.dmp

Filesize
1.4MB

Download
memory/2600-227-0x000000001C6D0000-0x000000001C83A000-memory.dmp

Filesize
1.4MB

Download
memory/3588-64-0x00000249DE170000-0x00000249DE192000-memory.dmp

Filesize
136KB

Download
memory/3596-200-0x0000000002DE0000-0x0000000002DF2000-memory.dmp

Filesize
72KB

Download
memory/3596-205-0x000000001C880000-0x000000001C9EA000-memory.dmp

Filesize
1.4MB

Download
memory/4548-187-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

Filesize
72KB

Download
memory/4716-14-0x0000000002910000-0x0000000002922000-memory.dmp

Filesize
72KB

Download
memory/4716-13-0x00000000006F0000-0x0000000000800000-memory.dmp

Filesize
1.1MB

Download
memory/4716-12-0x00007FFBC2253000-0x00007FFBC2255000-memory.dmp

Filesize
8KB

Download
memory/4716-15-0x0000000002930000-0x000000000293C000-memory.dmp

Filesize
48KB

Download
memory/4716-16-0x0000000002940000-0x000000000294C000-memory.dmp

Filesize
48KB

Download
memory/4716-17-0x0000000002950000-0x000000000295C000-memory.dmp

Filesize
48KB

Download