Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-12-2024 20:07

General

  • Target

    JaffaCakes118_ff90c45bdc5a2af542143e7857a726fe60d182f113a188fb77a6380fbc15500b.exe

  • Size

    1.3MB

  • MD5

    978655e8b9ea7854362a7e86acb751fa

  • SHA1

    2a013b5deb208f90ff1eb6f964967d65e38f2c79

  • SHA256

    ff90c45bdc5a2af542143e7857a726fe60d182f113a188fb77a6380fbc15500b

  • SHA512

    0b6cff9ba54e7dc6e5f26a30a0ff17d2e819d81d75249f4670eb0b5040f3900fd85b9530ebf352665edb3242bb24fb0e6ce4f47fcecb86b54ea654e7b4061e4c

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff90c45bdc5a2af542143e7857a726fe60d182f113a188fb77a6380fbc15500b.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ff90c45bdc5a2af542143e7857a726fe60d182f113a188fb77a6380fbc15500b.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3832
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4964
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4416
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PrintDialog\pris\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2040
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4056
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1916
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3064
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Cookies\csrss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1896
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Templates\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5056
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4748
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6La3pVbGQy.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4452
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:3264
              • C:\Users\Public\Downloads\RuntimeBroker.exe
                "C:\Users\Public\Downloads\RuntimeBroker.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3764
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:956
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:3008
                    • C:\Users\Public\Downloads\RuntimeBroker.exe
                      "C:\Users\Public\Downloads\RuntimeBroker.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1584
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:668
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:2452
                          • C:\Users\Public\Downloads\RuntimeBroker.exe
                            "C:\Users\Public\Downloads\RuntimeBroker.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4908
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:852
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:2160
                                • C:\Users\Public\Downloads\RuntimeBroker.exe
                                  "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3180
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3060
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:3692
                                      • C:\Users\Public\Downloads\RuntimeBroker.exe
                                        "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:4756
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4412
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:4100
                                            • C:\Users\Public\Downloads\RuntimeBroker.exe
                                              "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                              16⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:2596
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat"
                                                17⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4336
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  18⤵
                                                    PID:4940
                                                  • C:\Users\Public\Downloads\RuntimeBroker.exe
                                                    "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                                    18⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4736
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat"
                                                      19⤵
                                                        PID:628
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          20⤵
                                                            PID:1804
                                                          • C:\Users\Public\Downloads\RuntimeBroker.exe
                                                            "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                                            20⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4884
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
                                                              21⤵
                                                                PID:2648
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  22⤵
                                                                    PID:1884
                                                                  • C:\Users\Public\Downloads\RuntimeBroker.exe
                                                                    "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                                                    22⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1540
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat"
                                                                      23⤵
                                                                        PID:1176
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          24⤵
                                                                            PID:764
                                                                          • C:\Users\Public\Downloads\RuntimeBroker.exe
                                                                            "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                                                            24⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1612
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MQa1PIx8rY.bat"
                                                                              25⤵
                                                                                PID:4532
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  26⤵
                                                                                    PID:4708
                                                                                  • C:\Users\Public\Downloads\RuntimeBroker.exe
                                                                                    "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                                                                    26⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:536
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat"
                                                                                      27⤵
                                                                                        PID:3328
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          28⤵
                                                                                            PID:2796
                                                                                          • C:\Users\Public\Downloads\RuntimeBroker.exe
                                                                                            "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                                                                            28⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3896
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat"
                                                                                              29⤵
                                                                                                PID:812
                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                  30⤵
                                                                                                    PID:1036
                                                                                                  • C:\Users\Public\Downloads\RuntimeBroker.exe
                                                                                                    "C:\Users\Public\Downloads\RuntimeBroker.exe"
                                                                                                    30⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:3700
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat"
                                                                                                      31⤵
                                                                                                        PID:3584
                                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                          32⤵
                                                                                                            PID:3552
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Windows\PrintDialog\pris\services.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1904
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\PrintDialog\pris\services.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1624
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\PrintDialog\pris\services.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2328
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\conhost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3440
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\conhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:436
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\conhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1196
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1864
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1220
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\TextInputHost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:628
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\RuntimeBroker.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:992
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2952
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Downloads\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1792
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Cookies\csrss.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5012
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Cookies\csrss.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1328
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Cookies\csrss.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3480
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Templates\fontdrvhost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4016
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\fontdrvhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1036
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\fontdrvhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4464
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\providercommon\fontdrvhost.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1208
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4256
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4216

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.exe.log

                                              Filesize

                                              1KB

                                              MD5

                                              baf55b95da4a601229647f25dad12878

                                              SHA1

                                              abc16954ebfd213733c4493fc1910164d825cac8

                                              SHA256

                                              ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                              SHA512

                                              24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                              Filesize

                                              2KB

                                              MD5

                                              d85ba6ff808d9e5444a4b369f5bc2730

                                              SHA1

                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                              SHA256

                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                              SHA512

                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              77d622bb1a5b250869a3238b9bc1402b

                                              SHA1

                                              d47f4003c2554b9dfc4c16f22460b331886b191b

                                              SHA256

                                              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                              SHA512

                                              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              d28a889fd956d5cb3accfbaf1143eb6f

                                              SHA1

                                              157ba54b365341f8ff06707d996b3635da8446f7

                                              SHA256

                                              21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                              SHA512

                                              0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              6d42b6da621e8df5674e26b799c8e2aa

                                              SHA1

                                              ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                              SHA256

                                              5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                              SHA512

                                              53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              6c47b3f4e68eebd47e9332eebfd2dd4e

                                              SHA1

                                              67f0b143336d7db7b281ed3de5e877fa87261834

                                              SHA256

                                              8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

                                              SHA512

                                              0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

                                            • C:\Users\Admin\AppData\Local\Temp\0tZmJrpaGF.bat

                                              Filesize

                                              208B

                                              MD5

                                              b2b115db5766424c72a504585f1ebe0c

                                              SHA1

                                              40d080f7dc88183b27cef6ae4ee63d4827c876fc

                                              SHA256

                                              568c597d076290ec6b747e8f7401cd2bf08f0cb318b77259615e75808deaf002

                                              SHA512

                                              502a66e0b5742fa415a6df243010836d71ab091d46dfd8b31cb677e5508da74e46a8dc820b74c02114b08ffef6a853bce45a0ee1b1b823731fe8729054139721

                                            • C:\Users\Admin\AppData\Local\Temp\6La3pVbGQy.bat

                                              Filesize

                                              208B

                                              MD5

                                              68749f1f12d45ed40197b6bc4a43d813

                                              SHA1

                                              b01bd13076791070dcf3da0015abd29938873be8

                                              SHA256

                                              b917250d888df77d49b4f4edc8843383b50aa66e995dd1aec2720ee965990b88

                                              SHA512

                                              97c6cd3ffc754243d1da66e1a40e75254b826c7aa6e7b996f567081d2d063f7e2a9bd5b8a7297c214d5e47ca3afb205fa8b5faaa55aa723fdfb17617708ce2a9

                                            • C:\Users\Admin\AppData\Local\Temp\7etkz3INVn.bat

                                              Filesize

                                              208B

                                              MD5

                                              8378810e054d7b98e3b4af8a99926687

                                              SHA1

                                              e3a20f0d065470729043014536b3e98e8ee665ab

                                              SHA256

                                              79c8a3d50d4ec67a84f7f7ff81047210a0ae50626f54475443be6ad7bd4b083e

                                              SHA512

                                              b9586a54f0ff50312de8eb6a53d94f4c0df21ef958320dcb6e03d4fa01f523b1319d68f959dd0a4ae01aa8c28f74ff124bd8981e2e1df0ce06d0b62241cd2e7e

                                            • C:\Users\Admin\AppData\Local\Temp\GN1wkOWwnv.bat

                                              Filesize

                                              208B

                                              MD5

                                              061f3a0faa8fc42ba0af5717db51b550

                                              SHA1

                                              bf42ca42478c574e39742beef6525770530237c2

                                              SHA256

                                              965fd1a0a897e1919ba3a23c530f7d6801d8f3545fb3e3967f90d44d1714af26

                                              SHA512

                                              f0087e1190ce8df6120117ab3266ff7113127fe18e8cf182e8b94b319cb9c520e99777e673133a4c93897225b8c91eaf1625b1f36e981f9ce6fbb117b843bd86

                                            • C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat

                                              Filesize

                                              208B

                                              MD5

                                              2d84f6eeaba851582b8d19ae89cdb073

                                              SHA1

                                              7cdc58b628ef7012954d523a352155c348b3b06a

                                              SHA256

                                              a96d93702c508a419b4bee023373558ecb16834aec9222a7c7a94c64aad40405

                                              SHA512

                                              41849607db8a13c86791e19e56f1b1fe146b53a13d0b99d1033604a3cb92d9865d04a25c860e113ebf08379752c63dde86c8074dc88e1353e799998e62fb231a

                                            • C:\Users\Admin\AppData\Local\Temp\JJ2zQTaq6h.bat

                                              Filesize

                                              208B

                                              MD5

                                              89f6cb5d057149c40a2ed4f27786174d

                                              SHA1

                                              6a65cd988b1760cbd243bfff2b0f2b97f60ef72d

                                              SHA256

                                              ce9f4863a3099cc3556b5c9eef8ab8b0a177718d07570c3dadee9e65ce6f745d

                                              SHA512

                                              fbb4d4d06b9634e02acbf95b72db656f65eb5056a600a5593fb13ab690b7c6199f9536aa2dff920d7d9d0a21e10ca7063f11dde452469db7e3e02cd14cb5f225

                                            • C:\Users\Admin\AppData\Local\Temp\MQa1PIx8rY.bat

                                              Filesize

                                              208B

                                              MD5

                                              03e630b231fed92556fc9dc71ff7093a

                                              SHA1

                                              d56aa6c8172b99f182444e81365bcb3af9a2708e

                                              SHA256

                                              e381d17e23770d132badedfd67846065a8141d0db204779c206782414b1e749c

                                              SHA512

                                              536cda5fb7734e6390262b99c4eb31fcf1a8b69199fbac091cfb56d87ad2657b33637b262209fa7b8c243a5b5befb58f6bc75e6fc59ee3e47d6bd32fcf022478

                                            • C:\Users\Admin\AppData\Local\Temp\RId7nS4uU7.bat

                                              Filesize

                                              208B

                                              MD5

                                              f45e85e718fb65e6851d780cc1a5f85e

                                              SHA1

                                              8302af5cf12d1737f3c9f3a4ebb335bd5b9931d2

                                              SHA256

                                              7f1837eebbcaf795efa69432697afa13eb02b4e0273fcee48fcb5958f1719df6

                                              SHA512

                                              284482366874595fbea2565130fa41e6355059617fb2ed018b0e11662195cca7af465df21b26e625ea6dc5488df992f6bab836e8ec8704e54327f2bca4d3c9c9

                                            • C:\Users\Admin\AppData\Local\Temp\WLCDTNV5Zk.bat

                                              Filesize

                                              208B

                                              MD5

                                              ad339f5574706e4df2a23129278d57f1

                                              SHA1

                                              6e8044ed86bc2169194cd5389d43fc9346d291f1

                                              SHA256

                                              0641551b0a607a74d28050e1d0e9ed8e1f6694f29fea55751ae3b1ce3a6c7fdb

                                              SHA512

                                              00e428a62309d6673ccab55039d87659fe7f5d53cbc8a8e2eff8d9af98af161ed87b96ac99125f977c33a87f4fb007f8c6aef7f6c5c3265ada047689e903e1dd

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cdalwy4t.2kj.ps1

                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat

                                              Filesize

                                              208B

                                              MD5

                                              f8d740cc7b1da4d755ff46ee0ab55099

                                              SHA1

                                              926e27874072920862a52915605497a14f14545b

                                              SHA256

                                              fa759d095f1920e4c509273d3361428ec554bdb1fb9564ee6687bb1cd38825db

                                              SHA512

                                              5b85d8586e9712eec9ebfe61456e5f583085e0039897d7b031c5a3a8832705b47d8898c84ae7f7fb226d063c014a19d836e4dc95ca19d9821c94a0f6e0c7d994

                                            • C:\Users\Admin\AppData\Local\Temp\ounU5LkXKE.bat

                                              Filesize

                                              208B

                                              MD5

                                              4cb204fac490e6cd289ef1580c579e7d

                                              SHA1

                                              697043e3cdf8ae1a31db9943f66150b0c05e8318

                                              SHA256

                                              0e10c2ff4cbe019e6c1d8e9d6684ab44c5e57e933a5b0108baa0de80a90bbe64

                                              SHA512

                                              a40e360ee65fa880b382e12dc2cdbf1f2a16b4ca359af3dcd9fb65a8deb88ebf2dc0022f9fa23df1d29765092fe5fd028f3e348aa21ef50b9d225c8e3ffbba97

                                            • C:\Users\Admin\AppData\Local\Temp\vhtd8auDHa.bat

                                              Filesize

                                              208B

                                              MD5

                                              051f8956ad3425a76546757c1d0660f1

                                              SHA1

                                              0ce9056818647022d88be40705a11ae84c196c7f

                                              SHA256

                                              8f5ee614168a2d89bc00700932dad85a5ac78be22f523f32eb8961005d49fa2e

                                              SHA512

                                              1dde050d2cd49fc30ab4d6e9596be6022110ed94ec096123e282067b99b9a85817862aaccfc8798eb6330da2b6e13fc791fde12775a34e30b9c2ed7cd690aff6

                                            • C:\Users\Admin\AppData\Local\Temp\xdvgpfy6bM.bat

                                              Filesize

                                              208B

                                              MD5

                                              d9562bd1b5b4ea446846315121c20bb3

                                              SHA1

                                              312c5f4634378e08b7306ea2c7b7f3c0e9e717af

                                              SHA256

                                              4b184e4c13348e5ef08bda373a77e9f7b233d46e4ef97e07cc560f73ea6feb71

                                              SHA512

                                              a94036192b6fe742c23fad7bc1bd7658d30bf0066d189f435d5cca63b20b5684b7909f7508cbb3906eb21d81b26e77fcf4a28fe4bcdf6e3491c05ceb2e067f2a

                                            • C:\providercommon\1zu9dW.bat

                                              Filesize

                                              36B

                                              MD5

                                              6783c3ee07c7d151ceac57f1f9c8bed7

                                              SHA1

                                              17468f98f95bf504cc1f83c49e49a78526b3ea03

                                              SHA256

                                              8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                              SHA512

                                              c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                              Filesize

                                              197B

                                              MD5

                                              8088241160261560a02c84025d107592

                                              SHA1

                                              083121f7027557570994c9fc211df61730455bb5

                                              SHA256

                                              2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                              SHA512

                                              20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                            • memory/3764-136-0x000000001CC00000-0x000000001CD02000-memory.dmp

                                              Filesize

                                              1.0MB

                                            • memory/4056-42-0x000001D49C7D0000-0x000001D49C7F2000-memory.dmp

                                              Filesize

                                              136KB

                                            • memory/4736-171-0x000000001AFF0000-0x000000001B002000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4756-158-0x000000001ADF0000-0x000000001AE02000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4964-13-0x0000000000190000-0x00000000002A0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/4964-15-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/4964-16-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/4964-17-0x0000000000BC0000-0x0000000000BCC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/4964-14-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/4964-12-0x00007FFDB5243000-0x00007FFDB5245000-memory.dmp

                                              Filesize

                                              8KB