dcrat | 4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe
Size

1.3MB
MD5

dab58b486bea84b9ec67d457ca986a25
SHA1

9ec96b143ecb603f8080422c27a4f54d15cc218b
SHA256

4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498
SHA512

afe599aaae0b518533eb1cd76933d7dc0ef29a418cc886335a3f77b17d157b08900ee04e9491451a0f25341f7682ea1dfc68ab47dc2854e4dc90e649a6d75900
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1048	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4692	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1912	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2148	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	396	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3084	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3936	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4944	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	372	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	372	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cb2-10.dat	dcrat
behavioral2/memory/4524-13-0x0000000000D70000-0x0000000000E80000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
244	powershell.exe
1016	powershell.exe
408	powershell.exe
5072	powershell.exe
1508	powershell.exe
2120	powershell.exe
3224	powershell.exe
1664	powershell.exe
880	powershell.exe
4292	powershell.exe
4496	powershell.exe
2284	powershell.exe
4916	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	sihost.exe

Executes dropped EXE 14 IoCs

pid	Process
4524	DllCommonsvc.exe
4424	sihost.exe
4496	sihost.exe
1436	sihost.exe
3908	sihost.exe
208	sihost.exe
1916	sihost.exe
2556	sihost.exe
736	sihost.exe
680	sihost.exe
1360	sihost.exe
996	sihost.exe
224	sihost.exe
3396	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
39	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
17	raw.githubusercontent.com
18	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
26	raw.githubusercontent.com
41	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\Registration\ea1d8f6d871115	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\22eafd247d37c3	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\5940a34987c991	DllCommonsvc.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\tracing\smss.exe	DllCommonsvc.exe
File created	C:\Windows\tracing\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\upfc.exe	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Windows\System\unsecapp.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\System\unsecapp.exe	DllCommonsvc.exe
File created	C:\Windows\System\29c1c3cc0f7685	DllCommonsvc.exe
File created	C:\Windows\rescache\_merged\3300340783\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\22eafd247d37c3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	sihost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4220	schtasks.exe
4848	schtasks.exe
1048	schtasks.exe
4152	schtasks.exe
1644	schtasks.exe
1060	schtasks.exe
3936	schtasks.exe
4716	schtasks.exe
4416	schtasks.exe
2344	schtasks.exe
3452	schtasks.exe
1656	schtasks.exe
2148	schtasks.exe
1580	schtasks.exe
4944	schtasks.exe
2216	schtasks.exe
3304	schtasks.exe
2796	schtasks.exe
772	schtasks.exe
3380	schtasks.exe
1516	schtasks.exe
4692	schtasks.exe
2912	schtasks.exe
396	schtasks.exe
2348	schtasks.exe
1408	schtasks.exe
3804	schtasks.exe
3388	schtasks.exe
804	schtasks.exe
4388	schtasks.exe
3848	schtasks.exe
1912	schtasks.exe
3084	schtasks.exe
2636	schtasks.exe
3608	schtasks.exe
3624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
4524	DllCommonsvc.exe
2120	powershell.exe
2120	powershell.exe
1016	powershell.exe
1016	powershell.exe
2284	powershell.exe
2284	powershell.exe
1508	powershell.exe
1508	powershell.exe
4496	powershell.exe
4496	powershell.exe
3224	powershell.exe
3224	powershell.exe
5072	powershell.exe
5072	powershell.exe
408	powershell.exe
408	powershell.exe
1664	powershell.exe
1664	powershell.exe
4292	powershell.exe
4292	powershell.exe
880	powershell.exe
880	powershell.exe
4916	powershell.exe
4916	powershell.exe
244	powershell.exe
244	powershell.exe
4916	powershell.exe
4424	sihost.exe
4424	sihost.exe
2120	powershell.exe
1016	powershell.exe
1664	powershell.exe
2284	powershell.exe
4496	powershell.exe
880	powershell.exe
3224	powershell.exe
1508	powershell.exe
5072	powershell.exe
4292	powershell.exe
408	powershell.exe
244	powershell.exe
4496	sihost.exe
1436	sihost.exe
3908	sihost.exe
208	sihost.exe
1916	sihost.exe
2556	sihost.exe
736	sihost.exe
680	sihost.exe
1360	sihost.exe
996	sihost.exe
224	sihost.exe
3396	sihost.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	DllCommonsvc.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	3224	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	4424	sihost.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	244	powershell.exe
Token: SeDebugPrivilege	4496	sihost.exe
Token: SeDebugPrivilege	1436	sihost.exe
Token: SeDebugPrivilege	3908	sihost.exe
Token: SeDebugPrivilege	208	sihost.exe
Token: SeDebugPrivilege	1916	sihost.exe
Token: SeDebugPrivilege	2556	sihost.exe
Token: SeDebugPrivilege	736	sihost.exe
Token: SeDebugPrivilege	680	sihost.exe
Token: SeDebugPrivilege	1360	sihost.exe
Token: SeDebugPrivilege	996	sihost.exe
Token: SeDebugPrivilege	224	sihost.exe
Token: SeDebugPrivilege	3396	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4456	5056	JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe	83
PID 5056 wrote to memory of 4456	5056	JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe	83
PID 5056 wrote to memory of 4456	5056	JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe	83
PID 4456 wrote to memory of 2872	4456	WScript.exe	85
PID 4456 wrote to memory of 2872	4456	WScript.exe	85
PID 4456 wrote to memory of 2872	4456	WScript.exe	85
PID 2872 wrote to memory of 4524	2872	cmd.exe	87
PID 2872 wrote to memory of 4524	2872	cmd.exe	87
PID 4524 wrote to memory of 244	4524	DllCommonsvc.exe	126
PID 4524 wrote to memory of 244	4524	DllCommonsvc.exe	126
PID 4524 wrote to memory of 4496	4524	DllCommonsvc.exe	127
PID 4524 wrote to memory of 4496	4524	DllCommonsvc.exe	127
PID 4524 wrote to memory of 1016	4524	DllCommonsvc.exe	128
PID 4524 wrote to memory of 1016	4524	DllCommonsvc.exe	128
PID 4524 wrote to memory of 2284	4524	DllCommonsvc.exe	129
PID 4524 wrote to memory of 2284	4524	DllCommonsvc.exe	129
PID 4524 wrote to memory of 408	4524	DllCommonsvc.exe	130
PID 4524 wrote to memory of 408	4524	DllCommonsvc.exe	130
PID 4524 wrote to memory of 5072	4524	DllCommonsvc.exe	131
PID 4524 wrote to memory of 5072	4524	DllCommonsvc.exe	131
PID 4524 wrote to memory of 1508	4524	DllCommonsvc.exe	132
PID 4524 wrote to memory of 1508	4524	DllCommonsvc.exe	132
PID 4524 wrote to memory of 2120	4524	DllCommonsvc.exe	133
PID 4524 wrote to memory of 2120	4524	DllCommonsvc.exe	133
PID 4524 wrote to memory of 4916	4524	DllCommonsvc.exe	134
PID 4524 wrote to memory of 4916	4524	DllCommonsvc.exe	134
PID 4524 wrote to memory of 3224	4524	DllCommonsvc.exe	135
PID 4524 wrote to memory of 3224	4524	DllCommonsvc.exe	135
PID 4524 wrote to memory of 1664	4524	DllCommonsvc.exe	136
PID 4524 wrote to memory of 1664	4524	DllCommonsvc.exe	136
PID 4524 wrote to memory of 880	4524	DllCommonsvc.exe	137
PID 4524 wrote to memory of 880	4524	DllCommonsvc.exe	137
PID 4524 wrote to memory of 4292	4524	DllCommonsvc.exe	138
PID 4524 wrote to memory of 4292	4524	DllCommonsvc.exe	138
PID 4524 wrote to memory of 4424	4524	DllCommonsvc.exe	151
PID 4524 wrote to memory of 4424	4524	DllCommonsvc.exe	151
PID 4424 wrote to memory of 4428	4424	sihost.exe	156
PID 4424 wrote to memory of 4428	4424	sihost.exe	156
PID 4428 wrote to memory of 3624	4428	cmd.exe	158
PID 4428 wrote to memory of 3624	4428	cmd.exe	158
PID 4428 wrote to memory of 4496	4428	cmd.exe	165
PID 4428 wrote to memory of 4496	4428	cmd.exe	165
PID 4496 wrote to memory of 3184	4496	sihost.exe	171
PID 4496 wrote to memory of 3184	4496	sihost.exe	171
PID 3184 wrote to memory of 1084	3184	cmd.exe	173
PID 3184 wrote to memory of 1084	3184	cmd.exe	173
PID 3184 wrote to memory of 1436	3184	cmd.exe	174
PID 3184 wrote to memory of 1436	3184	cmd.exe	174
PID 1436 wrote to memory of 1908	1436	sihost.exe	179
PID 1436 wrote to memory of 1908	1436	sihost.exe	179
PID 1908 wrote to memory of 3864	1908	cmd.exe	181
PID 1908 wrote to memory of 3864	1908	cmd.exe	181
PID 1908 wrote to memory of 3908	1908	cmd.exe	183
PID 1908 wrote to memory of 3908	1908	cmd.exe	183
PID 3908 wrote to memory of 2720	3908	sihost.exe	185
PID 3908 wrote to memory of 2720	3908	sihost.exe	185
PID 2720 wrote to memory of 4944	2720	cmd.exe	187
PID 2720 wrote to memory of 4944	2720	cmd.exe	187
PID 2720 wrote to memory of 208	2720	cmd.exe	189
PID 2720 wrote to memory of 208	2720	cmd.exe	189
PID 208 wrote to memory of 4912	208	sihost.exe	191
PID 208 wrote to memory of 4912	208	sihost.exe	191
PID 4912 wrote to memory of 2884	4912	cmd.exe	193
PID 4912 wrote to memory of 2884	4912	cmd.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4f1ef6cdf13530542fd4b9b40270d4e7917683628371a14b34866caf0d088498.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\System\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Configuration\Registration\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\Network Sharing\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:408
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Links\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Searches\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4292
    - - C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4424
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3624
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SXiopUTlQe.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:1084
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3864
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4944
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2884
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HmDgHlPzdV.bat"
        16⤵
        
        PID:3380
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:2668
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat"
        18⤵
        
        PID:3340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4784
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RgqsKqwwLg.bat"
        20⤵
        
        PID:1292
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4848
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat"
        22⤵
        
        PID:5076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3056
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat"
        24⤵
        
        PID:1600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:4820
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lHo4kC1bcD.bat"
        26⤵
        
        PID:1452
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1488
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat"
        28⤵
        
        PID:3116
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:1832
        
        C:\Users\Default\Links\sihost.exe
        
        "C:\Users\Default\Links\sihost.exe"
        29⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\System\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\System\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Windows\System\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Registration\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Network Sharing\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\Network Sharing\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Media Player\Network Sharing\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Windows\tracing\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\tracing\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\tracing\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Links\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\Default\Links\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Links\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\providercommon\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\providercommon\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Searches\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\Searches\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Searches\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\D5faDLbbQ0.bat

Filesize
198B

MD5
69a1e5b2ca512813043f6cf59547b286

SHA1
ae2b03eb6c22a7d106d19544d928b9eb9cea3c95

SHA256
24cbf474fe5ba41c957c9881f4efbb58f024d8ec557a82f296e71e9cbfcb0e1d

SHA512
e89cd8260ae9a6378fb4ac3028a40f683a4cb2969982972b7901ee9e00ce19bd45e28441c4aceca80fde01a402186891dca236135f5e5e79a219911f8f13c427

Download Submit
C:\Users\Admin\AppData\Local\Temp\HmDgHlPzdV.bat

Filesize
198B

MD5
1087d3406f4b990292bd118253c85fb2

SHA1
666789a8d68568e97c053b13e0a28348cf075e1c

SHA256
ab69f61e706b5f076a1266a350c5de0b17779f880013f9ad8d5ddac302a902b3

SHA512
ba25ef081bc2cd0dabd76dc8fea23c4ce87141c40aee112b5e18cb0a606bad20f7e96e9a33b633cb9722eb9c05d99c0c50976b042b37b3018d7abfbe73bc3427

Download Submit
C:\Users\Admin\AppData\Local\Temp\IxigaWiN4Z.bat

Filesize
198B

MD5
b2033eba2dcf5b6aa5b956bfc776bd68

SHA1
82ed77c792c01d6a2361534c3aabbc60073d743a

SHA256
40f6d631556720e8c99279ff63716ba53af65c6de97d174eaae6ebd7ac969d32

SHA512
9734d70ab44cd7dec360d8d21b25879840b520f7e698247c0ded43e63b28924f48a99c9faa17bde2a0eba0755997e872158628e2fa90a8e96ed357e136989b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LkcfmFI5TJ.bat

Filesize
198B

MD5
1d6fe580039229a9c82fa7d2fac6d209

SHA1
86e1cb60c26c60432091cce5ef1937da04730642

SHA256
403369cbb706d502f7b1740e3e0254f1ca1526df4ef46b5870760f0aeeb847d5

SHA512
ceb8b2875d6893aa3ebe153aac5d0094bb0586178c3a793086b0dbf1c876c569b20482798b504f079bab22c47bb845b0e5e11d71d46c238d48b0e9bd95ad8c58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat

Filesize
198B

MD5
4164ec2695dbaa0bc1158e6abffa2fc5

SHA1
be3a02f47887711ab874b3b505b710657d6ee5e8

SHA256
7e8485f406ff37f4779a588de0aea4936b2bffbb5534bf4b334436f5c4a7ac5e

SHA512
49a0588ccd95e6777a9b6d9a340c0fbbcd39e3c9a64d5013d604a9c23149df6f7d1b31c20db1736e757866e745dac683e44293032aca301fe071d733b111e76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RgqsKqwwLg.bat

Filesize
198B

MD5
9025bb3ccd4b73719d05f23635903294

SHA1
44ffe0856142e2b00f29eb08ad711c7920271024

SHA256
b10aa8e1cfd054f2ef0fbff80d5f214353a3c81848b671ef908537f1c68acd6e

SHA512
56e4b7641e665fd9271662add49da1c96f1ec1f551e0767e8ddf81bdca5be8bcb4450dc146bfc2df251b54408bedc8237ac434ac1a67b73f4b06b41fbe220d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SXiopUTlQe.bat

Filesize
198B

MD5
2d3c985c6573392ba50733eadc6766e4

SHA1
9480fc725e081c1ea82e08d960f04f2d1fe38b94

SHA256
b8b7825068e07642abb887897a8a18cc9d24aae1e37b67121868e01316f81973

SHA512
246b3eac231eb2a47f9e2dd4945b4df2889aab31879aba0a9f2c3edd736b03e788b6d85144fc5add1b4d7b42941acf3ce25812d7a2f6e5908923a94342e8f1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xeeel03c.e1j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\eON2Ze4cSc.bat

Filesize
198B

MD5
a6818d540ac0f60839d2e479db09db00

SHA1
85da7a78de73927a7ee1c35b3e6ba1dfea97a584

SHA256
a5b8e82b39cee451ecfd1e49b4636bfcd82e37c173d11009a2fd08cdc205efd2

SHA512
7828b9b35a29832743d916f87144448b4350b6ea8b552956ccb049cc4db8b7ee004b00e3e276c8616d0e6674f9f861a293616a34737a46812b0b8017ee575b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\lHo4kC1bcD.bat

Filesize
198B

MD5
f05dadb5a6781bd1444c5b93b43935f3

SHA1
e2762ed491b50be0aecb2cd3aa802733b86e642b

SHA256
752a2818cde94fab237bdfcf782f971f52a5dffe490934386d31e60dc2bfa090

SHA512
4afc48a484af8d47008433c46d00e923f88a99972870347fe006e914f61c302896b1d432e6f4eadaafc745d37dccf8fcb98be9a1a532f504196617eb08777352

Download Submit
C:\Users\Admin\AppData\Local\Temp\nDq7RH5Uwz.bat

Filesize
198B

MD5
bcdfaf8520eab69ceb4e03c7d86c7505

SHA1
187799816e21b695fdb0c612385c5102032a6667

SHA256
99b9d3d3b68d62cf47b131100131e911495c5419634c7c9cd17aed65b0cccf51

SHA512
7809afc3cd7acd5e3b8dcdd0da55b5930e332a492caa824a32d388619b8dabfde54630e7878bebb2d2212d1709d950b122144f4ed7e92628c25ecf3d088b061e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat

Filesize
198B

MD5
56b552271db6b2161f3bfe3ee3560b41

SHA1
5f680350babaf238a8d1f8cf49cc571bc9e57713

SHA256
d697db8e7233311feff580907351e1b48985e60d5e6b07b22b1363f0b8e3fe32

SHA512
788c8e1d44305e6034dab78b18bd0ae1c3ce1fdd31e067b60efbbc2fa50407eaf724f0c29ae61d3af9c85469de2fb59feda6a3365bcb94f029a7058037682f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat

Filesize
198B

MD5
5ec59a9f759f45a14a2ae0d21ef0e487

SHA1
49de100439824676207779cd9549cfa8dc251f7f

SHA256
9b38b51798b7168d45ed06b8e187912ea355308596fa4e02c618fe5715198f5e

SHA512
172e2334aabba5a93f93667e90a7ef5a6df1f2191779e40424b3d16c48bed51b7be6f6e6596fb9eda3c5e4daa23dd274ad3e9c1fa5e3cbae95a49842b3f6eabd

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/208-226-0x000000001B100000-0x000000001B112000-memory.dmp

Filesize
72KB

Download
memory/1016-62-0x000001C78C700000-0x000001C78C722000-memory.dmp

Filesize
136KB

Download
memory/2556-239-0x0000000002D50000-0x0000000002D62000-memory.dmp

Filesize
72KB

Download
memory/3396-276-0x0000000002610000-0x0000000002622000-memory.dmp

Filesize
72KB

Download
memory/4424-72-0x0000000002C90000-0x0000000002CA2000-memory.dmp

Filesize
72KB

Download
memory/4496-211-0x000000001BFE0000-0x000000001C0E2000-memory.dmp

Filesize
1.0MB

Download
memory/4524-17-0x00000000031E0000-0x00000000031EC000-memory.dmp

Filesize
48KB

Download
memory/4524-16-0x00000000030A0000-0x00000000030AC000-memory.dmp

Filesize
48KB

Download
memory/4524-15-0x00000000030B0000-0x00000000030BC000-memory.dmp

Filesize
48KB

Download
memory/4524-14-0x0000000003090000-0x00000000030A2000-memory.dmp

Filesize
72KB

Download
memory/4524-13-0x0000000000D70000-0x0000000000E80000-memory.dmp

Filesize
1.1MB

Download
memory/4524-12-0x00007FFFA5593000-0x00007FFFA5595000-memory.dmp

Filesize
8KB

Download