dcrat | e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe
Size

1.3MB
MD5

f66688833e33a10db46fc0a81040fbaf
SHA1

22130c76816f54915323e7a12367c81fa97cc008
SHA256

e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a
SHA512

13458110e5e752a62be6bc989cd0d97d2f80c5c0ce23f6473d60266e59c18fb36991c83dd67313b9c7078bcbc727cd1da30278ef6fb921418cdedb26d768c019
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2928	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4784	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4088	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3796	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5032	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2608	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3376	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4148	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3212	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1520	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4384	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3592	4776	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	4776	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b67-9.dat	dcrat
behavioral2/memory/2868-13-0x00000000009A0000-0x0000000000AB0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3056	powershell.exe
1028	powershell.exe
4692	powershell.exe
1464	powershell.exe
4816	powershell.exe
3180	powershell.exe
4860	powershell.exe
4880	powershell.exe
4276	powershell.exe
2628	powershell.exe
1664	powershell.exe
3228	powershell.exe
4548	powershell.exe
1976	powershell.exe
1476	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	dwm.exe

Executes dropped EXE 13 IoCs

pid	Process
2868	DllCommonsvc.exe
4672	dwm.exe
1724	dwm.exe
4972	dwm.exe
4440	dwm.exe
3796	dwm.exe
2404	dwm.exe
3760	dwm.exe
2608	dwm.exe
1956	dwm.exe
2692	dwm.exe
4844	dwm.exe
668	dwm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
38	raw.githubusercontent.com
44	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
56	raw.githubusercontent.com
13	raw.githubusercontent.com
26	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
55	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\de-DE\taskhostw.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\de-DE\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\spoolsv.exe	DllCommonsvc.exe
File created	C:\Program Files\Uninstall Information\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\55b276f4edf653	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\BitLockerDiscoveryVolumeContents\System.exe	DllCommonsvc.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\27d1bcfc3c54e0	DllCommonsvc.exe
File created	C:\Windows\fr-FR\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Windows\fr-FR\e1ef82546f0b02	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5032	schtasks.exe
2244	schtasks.exe
4384	schtasks.exe
3040	schtasks.exe
3392	schtasks.exe
3592	schtasks.exe
3016	schtasks.exe
2756	schtasks.exe
3796	schtasks.exe
4908	schtasks.exe
3212	schtasks.exe
4136	schtasks.exe
1684	schtasks.exe
4612	schtasks.exe
4808	schtasks.exe
4488	schtasks.exe
1944	schtasks.exe
2976	schtasks.exe
2448	schtasks.exe
1520	schtasks.exe
3048	schtasks.exe
1668	schtasks.exe
2608	schtasks.exe
4148	schtasks.exe
1872	schtasks.exe
3220	schtasks.exe
3988	schtasks.exe
4088	schtasks.exe
4768	schtasks.exe
1080	schtasks.exe
1568	schtasks.exe
4284	schtasks.exe
3028	schtasks.exe
4632	schtasks.exe
4784	schtasks.exe
4300	schtasks.exe
2208	schtasks.exe
3376	schtasks.exe
5060	schtasks.exe
4360	schtasks.exe
2928	schtasks.exe
4128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2868	DllCommonsvc.exe
2868	DllCommonsvc.exe
2868	DllCommonsvc.exe
2868	DllCommonsvc.exe
2868	DllCommonsvc.exe
2868	DllCommonsvc.exe
2868	DllCommonsvc.exe
4880	powershell.exe
4880	powershell.exe
1464	powershell.exe
1464	powershell.exe
4276	powershell.exe
4276	powershell.exe
1476	powershell.exe
1476	powershell.exe
4692	powershell.exe
4692	powershell.exe
3056	powershell.exe
3056	powershell.exe
1664	powershell.exe
1664	powershell.exe
2628	powershell.exe
2628	powershell.exe
1028	powershell.exe
1028	powershell.exe
4548	powershell.exe
4548	powershell.exe
4860	powershell.exe
4860	powershell.exe
3228	powershell.exe
3228	powershell.exe
4816	powershell.exe
4816	powershell.exe
3180	powershell.exe
3180	powershell.exe
1976	powershell.exe
1976	powershell.exe
1028	powershell.exe
1476	powershell.exe
1464	powershell.exe
4880	powershell.exe
4692	powershell.exe
1664	powershell.exe
4276	powershell.exe
4548	powershell.exe
3228	powershell.exe
2628	powershell.exe
4860	powershell.exe
3180	powershell.exe
3056	powershell.exe
4816	powershell.exe
1976	powershell.exe
4672	dwm.exe
1724	dwm.exe
4972	dwm.exe
4440	dwm.exe
3796	dwm.exe
2404	dwm.exe
3760	dwm.exe
2608	dwm.exe
1956	dwm.exe
2692	dwm.exe
4844	dwm.exe
668	dwm.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	DllCommonsvc.exe
Token: SeDebugPrivilege	4692	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1464	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	4672	dwm.exe
Token: SeDebugPrivilege	1724	dwm.exe
Token: SeDebugPrivilege	4972	dwm.exe
Token: SeDebugPrivilege	4440	dwm.exe
Token: SeDebugPrivilege	3796	dwm.exe
Token: SeDebugPrivilege	2404	dwm.exe
Token: SeDebugPrivilege	3760	dwm.exe
Token: SeDebugPrivilege	2608	dwm.exe
Token: SeDebugPrivilege	1956	dwm.exe
Token: SeDebugPrivilege	2692	dwm.exe
Token: SeDebugPrivilege	4844	dwm.exe
Token: SeDebugPrivilege	668	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3088	3388	JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe	83
PID 3388 wrote to memory of 3088	3388	JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe	83
PID 3388 wrote to memory of 3088	3388	JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe	83
PID 3088 wrote to memory of 4752	3088	WScript.exe	85
PID 3088 wrote to memory of 4752	3088	WScript.exe	85
PID 3088 wrote to memory of 4752	3088	WScript.exe	85
PID 4752 wrote to memory of 2868	4752	cmd.exe	87
PID 4752 wrote to memory of 2868	4752	cmd.exe	87
PID 2868 wrote to memory of 1976	2868	DllCommonsvc.exe	132
PID 2868 wrote to memory of 1976	2868	DllCommonsvc.exe	132
PID 2868 wrote to memory of 1028	2868	DllCommonsvc.exe	133
PID 2868 wrote to memory of 1028	2868	DllCommonsvc.exe	133
PID 2868 wrote to memory of 4276	2868	DllCommonsvc.exe	134
PID 2868 wrote to memory of 4276	2868	DllCommonsvc.exe	134
PID 2868 wrote to memory of 4692	2868	DllCommonsvc.exe	135
PID 2868 wrote to memory of 4692	2868	DllCommonsvc.exe	135
PID 2868 wrote to memory of 2628	2868	DllCommonsvc.exe	136
PID 2868 wrote to memory of 2628	2868	DllCommonsvc.exe	136
PID 2868 wrote to memory of 4880	2868	DllCommonsvc.exe	137
PID 2868 wrote to memory of 4880	2868	DllCommonsvc.exe	137
PID 2868 wrote to memory of 4860	2868	DllCommonsvc.exe	138
PID 2868 wrote to memory of 4860	2868	DllCommonsvc.exe	138
PID 2868 wrote to memory of 4548	2868	DllCommonsvc.exe	139
PID 2868 wrote to memory of 4548	2868	DllCommonsvc.exe	139
PID 2868 wrote to memory of 3228	2868	DllCommonsvc.exe	140
PID 2868 wrote to memory of 3228	2868	DllCommonsvc.exe	140
PID 2868 wrote to memory of 3056	2868	DllCommonsvc.exe	141
PID 2868 wrote to memory of 3056	2868	DllCommonsvc.exe	141
PID 2868 wrote to memory of 1664	2868	DllCommonsvc.exe	142
PID 2868 wrote to memory of 1664	2868	DllCommonsvc.exe	142
PID 2868 wrote to memory of 3180	2868	DllCommonsvc.exe	143
PID 2868 wrote to memory of 3180	2868	DllCommonsvc.exe	143
PID 2868 wrote to memory of 4816	2868	DllCommonsvc.exe	144
PID 2868 wrote to memory of 4816	2868	DllCommonsvc.exe	144
PID 2868 wrote to memory of 1476	2868	DllCommonsvc.exe	146
PID 2868 wrote to memory of 1476	2868	DllCommonsvc.exe	146
PID 2868 wrote to memory of 1464	2868	DllCommonsvc.exe	147
PID 2868 wrote to memory of 1464	2868	DllCommonsvc.exe	147
PID 2868 wrote to memory of 4748	2868	DllCommonsvc.exe	162
PID 2868 wrote to memory of 4748	2868	DllCommonsvc.exe	162
PID 4748 wrote to memory of 4088	4748	cmd.exe	164
PID 4748 wrote to memory of 4088	4748	cmd.exe	164
PID 4748 wrote to memory of 4672	4748	cmd.exe	166
PID 4748 wrote to memory of 4672	4748	cmd.exe	166
PID 4672 wrote to memory of 1472	4672	dwm.exe	168
PID 4672 wrote to memory of 1472	4672	dwm.exe	168
PID 1472 wrote to memory of 1156	1472	cmd.exe	170
PID 1472 wrote to memory of 1156	1472	cmd.exe	170
PID 1472 wrote to memory of 1724	1472	cmd.exe	172
PID 1472 wrote to memory of 1724	1472	cmd.exe	172
PID 1724 wrote to memory of 2448	1724	dwm.exe	180
PID 1724 wrote to memory of 2448	1724	dwm.exe	180
PID 2448 wrote to memory of 2792	2448	cmd.exe	182
PID 2448 wrote to memory of 2792	2448	cmd.exe	182
PID 2448 wrote to memory of 4972	2448	cmd.exe	186
PID 2448 wrote to memory of 4972	2448	cmd.exe	186
PID 4972 wrote to memory of 2744	4972	dwm.exe	192
PID 4972 wrote to memory of 2744	4972	dwm.exe	192
PID 2744 wrote to memory of 4092	2744	cmd.exe	194
PID 2744 wrote to memory of 4092	2744	cmd.exe	194
PID 2744 wrote to memory of 4440	2744	cmd.exe	196
PID 2744 wrote to memory of 4440	2744	cmd.exe	196
PID 4440 wrote to memory of 4748	4440	dwm.exe	198
PID 4440 wrote to memory of 4748	4440	dwm.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e58ed36e149e1df87f324f4781637a45c05f2d5dfd0f5245d5cf45b4f2caf84a.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4692
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\sysmon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2uBLrXDQVK.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4748
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:4088
      - C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1156
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pksuDlslcW.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:2792
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:4092
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K00M4WFsUw.bat"
        13⤵
        
        PID:4748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3184
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat"
        15⤵
        
        PID:3788
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2316
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3IH1xDWFpP.bat"
        17⤵
        
        PID:2472
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:4880
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        19⤵
        
        PID:4964
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:2080
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bo4ZIAkpMj.bat"
        21⤵
        
        PID:3140
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:4120
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        23⤵
        
        PID:4028
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:3780
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat"
        25⤵
        
        PID:1368
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:4644
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat"
        27⤵
        
        PID:1724
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4976
        
        C:\providercommon\dwm.exe
        
        "C:\providercommon\dwm.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat"
        29⤵
        
        PID:3088
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:5104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\providercommon\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Users\Default User\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\providercommon\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\de-DE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Libraries\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\Libraries\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Windows\fr-FR\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\fr-FR\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\fr-FR\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Shared Gadgets\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\providercommon\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\providercommon\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dwm.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\2uBLrXDQVK.bat

Filesize
190B

MD5
06a1ac933052d6e0073e6a2323a6f0fa

SHA1
3a80115fe75e904da0e8872b356b4e2b3cad43b1

SHA256
64bdc846a6b0a4fa0d1f48dae2519437173b5f42dafac6bfce811e45f4da2678

SHA512
36d8ba196802649fc330d10d05312f78fae6b03fb0b0e210e136f7750732b6051ff39b2656dfc2a66009a128f59eb34cf6eace8602eff8bcb0d168ac87861133

Download Submit
C:\Users\Admin\AppData\Local\Temp\3IH1xDWFpP.bat

Filesize
190B

MD5
7a39766d88a0b22eb85ff6d486d92435

SHA1
22e96b47f35df8c988b79680ae9b86738e1adb40

SHA256
f05ac36555d7fc0d10584272142bb8cc88a248cf6463660b8535a0a54c79081d

SHA512
2dd50849cfab47d91725884efbf2914fac539695e45630e411e6f760142783ecf8e02c6f248edc4edb3bba1058faf6a097afc23010ba2de14f5cbf26e621fc1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat

Filesize
190B

MD5
6187cd107012fa9f3e16049c41d38e8d

SHA1
b405aa7e30e8b4962f93eb9a27212dc33c6c957e

SHA256
cb43728a11e818a905913190d88b3be4bb2e1250191cec10afe063afe73fbb5c

SHA512
4cdc0188193945e5656428fe713c6fedeccd64b63ab6a1de3791dbeaaec3dd4d0725aa5fa949792e6a46e3136f8d18cc423e3095c3cff333af9bdf8e1dbe4bb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat

Filesize
190B

MD5
b88b89dbd71e9746e845b6f595ba7d1c

SHA1
fd2249215a5bec15c4ba96b6d952f02d2e9210f7

SHA256
e20dcde124de62ae287eb4a17f3ae2fb63fb5b19c634c263b7435ec39b2da23c

SHA512
aea99829028223d9a6ff3831b33a22c32387d914d867be62fe5de573a0f9fb4aecd7fb7f528c7e3a0de783158337633f43388665ec818ae81e08ef31512dc76f

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
190B

MD5
57bb3a5249ee8f4d4462793a0214b795

SHA1
e73925560bfb1459b6c17d12f9327925dfcd1c22

SHA256
02818221d59505ec49904b3bf19cb276e73601126f1ba655905875f9fec9398d

SHA512
82048c5cae36fed5f57571104873fb6cad29b343c28a97d527062568e40909dd563f11a8c4bcacff293eea0b518402e928396117bbbbde2452506b94818e66fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\K00M4WFsUw.bat

Filesize
190B

MD5
5c79201a5e3de2176d82ab2c39a90e93

SHA1
3ec5b80ae14c374f607f752d08b3e2ebd64cbec1

SHA256
64792c1b4f29763b4fa9ce858d455279bb973a9c89199f702a9a6f654d72d7b5

SHA512
26e732c79e04c4083ff1d686add9ac8617049f9b4fe62a1021aa83e07db5dfb1eaee5919583a7488103fb16eb8087d2f01972f0de9dd314444f9ce9a09ad8e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mw1PlbJmoj.bat

Filesize
190B

MD5
92eb096ad2c7d4cca15fa2705991d18e

SHA1
9b0dcc1ec038baf495a001d25aceccd65cfef8cc

SHA256
6a512f6b631aeef1613753010fefb770f871b04efadba7bdda97d7b4d5ee72f7

SHA512
853eda80484c9a3182b3ac4ad1b8c71401e3e624be56a87875e4c35164c55e3af7f80f9cbe6da2f774ce6b83a4cac2d49b9929017ccffafae7040514bd872c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02chpdeh.okp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\axBdnWD1Gl.bat

Filesize
190B

MD5
df2651377f973bb9b3366f6c94e13af0

SHA1
c926cca7dd58bd751e362451d7cd6e7bde1a90b3

SHA256
28a649004ce09b30768b05416871356f21befc970242c715ab24d5c38933a2f1

SHA512
0a89e00b3ac84721592317ea4b15eead970d23ed8b1c3001b7bb4f256fff038eb9b49f779d6834f665a9924fc4fd3bb7f14af9438a22ff07efc3af3340f87513

Download Submit
C:\Users\Admin\AppData\Local\Temp\bo4ZIAkpMj.bat

Filesize
190B

MD5
d02bb5b0b94376576dd732b7f98f1510

SHA1
3a3b94b3c246f84f69416670649d7707d49f36d7

SHA256
99fc377a29cd9788589ea66ec468649596a98efed321f886ff4c8be1b717e491

SHA512
3ef24e15f461a4eb4bcaae232e251c80ff4838b0bfc552ccc395437c3484829d61a622a0c68904490252237e64cf34a40bff463de0a5640b49ad59fe7ccaf6fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlHmrlOhE6.bat

Filesize
190B

MD5
6e48a34598d792b171a2ef5aa191ef92

SHA1
de6acc0641294e1a864474b8305597ff679bcab7

SHA256
dd802bfdec6303ff09def39ab6fb56ca3966442c061c8facfaa2a945094d815e

SHA512
b0a8c8823f9b4a71bec03c8225a1a63e7557b8ba1b35dc7d59e9bef3825100e95b75f12a493fce41ee45b6e5930e3bbf44dbd3b580ba1b9b6b7749aa018d46dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pksuDlslcW.bat

Filesize
190B

MD5
7f845da266feb327f4f24d1fc58895da

SHA1
466064cd9d8aa4e565a8e0f3ca56c788cb8346e5

SHA256
fd3b1ba4eecf4cf1097261a35dca61634043fd37a9c1d7d2f23f52c3a6e048e5

SHA512
798a006c062bbda734bb01d4e79a3d0488c05ad3af1eb0d7ab191d1dc32a344bd7d65c8ab2adca0097dfeac37f1b6275b7f7c3a9b5cd6740b0358ee8c430138c

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat

Filesize
190B

MD5
f2a15898dac9fc0462b62a8a7ce124dd

SHA1
4aede1273fe151cb70e0879deb45f13b736530b3

SHA256
ea3a93a58f01009dc83eac0573f24af4c58073dfd757298297510bf7a5553e5e

SHA512
9aedf12e22f9d5cda3d863caa3b39ddcff01cf98102664ca79a00568671b9bfe1334acaa77c897984e435abeb69980cf3ebd4e2275554e9b68a2318e77fac165

Download Submit
C:\Users\Admin\AppData\Local\Temp\yQDva2PSBr.bat

Filesize
190B

MD5
3308e578391d8052f8cfaf7637f4e0a7

SHA1
df1f6f0814915e62c95134ccdd2175f4f48e4310

SHA256
de4a445b0f5eb4a794b4ba543c91e49821927b6ddc560c259511cd17432159b1

SHA512
2f22fa6ac68571961fb7a6739bf93b29702af91ba59712b5d8deb99b1f1ab0ce278e9f036f1728a13b2b49aef040de5c202f52c4faf8d97d18771c47b7b60d62

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/668-297-0x000000001BB50000-0x000000001BB62000-memory.dmp

Filesize
72KB

Download
memory/668-303-0x000000001C9B0000-0x000000001CB59000-memory.dmp

Filesize
1.7MB

Download
memory/1724-229-0x00000000028E0000-0x00000000028F2000-memory.dmp

Filesize
72KB

Download
memory/1956-277-0x0000000003280000-0x0000000003292000-memory.dmp

Filesize
72KB

Download
memory/2608-269-0x0000000001790000-0x00000000017A2000-memory.dmp

Filesize
72KB

Download
memory/2608-274-0x000000001C8A0000-0x000000001CA0A000-memory.dmp

Filesize
1.4MB

Download
memory/2692-284-0x00000000030D0000-0x00000000030E2000-memory.dmp

Filesize
72KB

Download
memory/2868-14-0x00000000013D0000-0x00000000013E2000-memory.dmp

Filesize
72KB

Download
memory/2868-16-0x0000000002BE0000-0x0000000002BEC000-memory.dmp

Filesize
48KB

Download
memory/2868-17-0x0000000002BF0000-0x0000000002BFC000-memory.dmp

Filesize
48KB

Download
memory/2868-15-0x00000000013E0000-0x00000000013EC000-memory.dmp

Filesize
48KB

Download
memory/2868-13-0x00000000009A0000-0x0000000000AB0000-memory.dmp

Filesize
1.1MB

Download
memory/2868-12-0x00007FFB1A463000-0x00007FFB1A465000-memory.dmp

Filesize
8KB

Download
memory/3760-262-0x0000000002E30000-0x0000000002E42000-memory.dmp

Filesize
72KB

Download
memory/4672-220-0x00000000029F0000-0x0000000002A02000-memory.dmp

Filesize
72KB

Download
memory/4692-51-0x000001653B350000-0x000001653B372000-memory.dmp

Filesize
136KB

Download
memory/4972-241-0x000000001C8C0000-0x000000001CA69000-memory.dmp

Filesize
1.7MB

Download
memory/4972-236-0x0000000001720000-0x0000000001732000-memory.dmp

Filesize
72KB

Download