Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 20:54
Behavioral task
behavioral1
Sample
JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe
-
Size
1.3MB
-
MD5
f3eeac6856229a281acc93fa5ca743bd
-
SHA1
7229f5b7506de25096049473c3809966455e734a
-
SHA256
9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440
-
SHA512
b2a257292182a6a1b48c42920005897e9b9534527171ba3f41e4b746bebd4c050457ebf9e0b5cf42df671323490261ab236be9ae321d17bfc6702b92f4252450
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1976 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2288 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1988 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 776 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2200 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2220 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1412 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 660 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2960 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2848 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2900 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2940 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 468 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2976 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2936 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3068 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1756 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1296 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 568 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 340 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2416 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 2592 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 832 2592 schtasks.exe 34 -
resource yara_rule behavioral1/files/0x00080000000156a8-9.dat dcrat behavioral1/memory/2868-13-0x00000000013C0000-0x00000000014D0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2152 powershell.exe 876 powershell.exe 2296 powershell.exe 624 powershell.exe 1292 powershell.exe 580 powershell.exe 824 powershell.exe 2172 powershell.exe 1128 powershell.exe 1760 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2868 DllCommonsvc.exe -
Loads dropped DLL 2 IoCs
pid Process 2176 cmd.exe 2176 cmd.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\fr-FR\sppsvc.exe DllCommonsvc.exe File opened for modification C:\Program Files\Windows Sidebar\fr-FR\sppsvc.exe DllCommonsvc.exe File created C:\Program Files\Windows Sidebar\fr-FR\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\cmd.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\ja-JP\ebf1f9fa8afd6d DllCommonsvc.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\security\logs\conhost.exe DllCommonsvc.exe File created C:\Windows\security\logs\088424020bedd6 DllCommonsvc.exe File created C:\Windows\schemas\TSWorkSpace\Idle.exe DllCommonsvc.exe File created C:\Windows\Registration\CRMLog\winlogon.exe DllCommonsvc.exe File created C:\Windows\Registration\CRMLog\cc11b995f2a76d DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2428 schtasks.exe 3028 schtasks.exe 660 schtasks.exe 2976 schtasks.exe 1756 schtasks.exe 1608 schtasks.exe 776 schtasks.exe 1296 schtasks.exe 1976 schtasks.exe 2288 schtasks.exe 468 schtasks.exe 2400 schtasks.exe 568 schtasks.exe 2416 schtasks.exe 2200 schtasks.exe 2848 schtasks.exe 2900 schtasks.exe 3068 schtasks.exe 1524 schtasks.exe 340 schtasks.exe 2220 schtasks.exe 2936 schtasks.exe 832 schtasks.exe 1988 schtasks.exe 1412 schtasks.exe 2960 schtasks.exe 2940 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2868 DllCommonsvc.exe 2172 powershell.exe 1292 powershell.exe 1128 powershell.exe 1760 powershell.exe 580 powershell.exe 824 powershell.exe 2296 powershell.exe 624 powershell.exe 2152 powershell.exe 876 powershell.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2868 DllCommonsvc.exe Token: SeDebugPrivilege 2172 powershell.exe Token: SeDebugPrivilege 1292 powershell.exe Token: SeDebugPrivilege 1128 powershell.exe Token: SeDebugPrivilege 1760 powershell.exe Token: SeDebugPrivilege 580 powershell.exe Token: SeDebugPrivilege 824 powershell.exe Token: SeDebugPrivilege 2296 powershell.exe Token: SeDebugPrivilege 624 powershell.exe Token: SeDebugPrivilege 2152 powershell.exe Token: SeDebugPrivilege 876 powershell.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2836 2984 JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe 30 PID 2984 wrote to memory of 2836 2984 JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe 30 PID 2984 wrote to memory of 2836 2984 JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe 30 PID 2984 wrote to memory of 2836 2984 JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe 30 PID 2836 wrote to memory of 2176 2836 WScript.exe 31 PID 2836 wrote to memory of 2176 2836 WScript.exe 31 PID 2836 wrote to memory of 2176 2836 WScript.exe 31 PID 2836 wrote to memory of 2176 2836 WScript.exe 31 PID 2176 wrote to memory of 2868 2176 cmd.exe 33 PID 2176 wrote to memory of 2868 2176 cmd.exe 33 PID 2176 wrote to memory of 2868 2176 cmd.exe 33 PID 2176 wrote to memory of 2868 2176 cmd.exe 33 PID 2868 wrote to memory of 580 2868 DllCommonsvc.exe 62 PID 2868 wrote to memory of 580 2868 DllCommonsvc.exe 62 PID 2868 wrote to memory of 580 2868 DllCommonsvc.exe 62 PID 2868 wrote to memory of 2152 2868 DllCommonsvc.exe 63 PID 2868 wrote to memory of 2152 2868 DllCommonsvc.exe 63 PID 2868 wrote to memory of 2152 2868 DllCommonsvc.exe 63 PID 2868 wrote to memory of 876 2868 DllCommonsvc.exe 65 PID 2868 wrote to memory of 876 2868 DllCommonsvc.exe 65 PID 2868 wrote to memory of 876 2868 DllCommonsvc.exe 65 PID 2868 wrote to memory of 1760 2868 DllCommonsvc.exe 66 PID 2868 wrote to memory of 1760 2868 DllCommonsvc.exe 66 PID 2868 wrote to memory of 1760 2868 DllCommonsvc.exe 66 PID 2868 wrote to memory of 1292 2868 DllCommonsvc.exe 67 PID 2868 wrote to memory of 1292 2868 DllCommonsvc.exe 67 PID 2868 wrote to memory of 1292 2868 DllCommonsvc.exe 67 PID 2868 wrote to memory of 824 2868 DllCommonsvc.exe 68 PID 2868 wrote to memory of 824 2868 DllCommonsvc.exe 68 PID 2868 wrote to memory of 824 2868 DllCommonsvc.exe 68 PID 2868 wrote to memory of 624 2868 DllCommonsvc.exe 69 PID 2868 wrote to memory of 624 2868 DllCommonsvc.exe 69 PID 2868 wrote to memory of 624 2868 DllCommonsvc.exe 69 PID 2868 wrote to memory of 1128 2868 DllCommonsvc.exe 71 PID 2868 wrote to memory of 1128 2868 DllCommonsvc.exe 71 PID 2868 wrote to memory of 1128 2868 DllCommonsvc.exe 71 PID 2868 wrote to memory of 2296 2868 DllCommonsvc.exe 72 PID 2868 wrote to memory of 2296 2868 DllCommonsvc.exe 72 PID 2868 wrote to memory of 2296 2868 DllCommonsvc.exe 72 PID 2868 wrote to memory of 2172 2868 DllCommonsvc.exe 74 PID 2868 wrote to memory of 2172 2868 DllCommonsvc.exe 74 PID 2868 wrote to memory of 2172 2868 DllCommonsvc.exe 74 PID 2868 wrote to memory of 1204 2868 DllCommonsvc.exe 82 PID 2868 wrote to memory of 1204 2868 DllCommonsvc.exe 82 PID 2868 wrote to memory of 1204 2868 DllCommonsvc.exe 82 PID 1204 wrote to memory of 2380 1204 cmd.exe 84 PID 1204 wrote to memory of 2380 1204 cmd.exe 84 PID 1204 wrote to memory of 2380 1204 cmd.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e9339ca5f3961e1341e18b167e8e48a7dabcc5b079c9fb081023636b6955440.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\fr-FR\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\ja-JP\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\security\logs\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VTfGvAKCjQ.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:2380
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\fr-FR\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\fr-FR\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\fr-FR\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:776
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2220
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\Registration\CRMLog\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Recovery\209d6542-69f6-11ef-b491-62cb582c238c\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Defender\ja-JP\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Windows\security\logs\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\security\logs\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\security\logs\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD58369098b9cc7763da0c21e129570f8ad
SHA1c00c97db1601242a3889db3fab91c5d647b3c451
SHA256c1b26732aeb2de5e8092f06370272af009b12e8ba67d8eaee68e009203c144f9
SHA5120fd2eea506daa2aa2da693ed93b3824fefb41d0455658710cf2fb2e1466d506c80484c64ce24e4175ca1f9a2d12ead62e5bd7d006655e9627590937225571fb1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD53e22968d7dbab8e1372fb6c1e870188e
SHA1fafa04011c8aff14c243ec6311917cc3cb14f23d
SHA25650dca97378038cba39785a4f84e423babdf758c3eaa8b38aac17ab110400d395
SHA512172fbfc037b19013c2cbaa8736591d10d9007b1f6fd3ec84fef1c1926fe355fa952baef6cb289418e0498c0463bf982fcbe514a49ef0b1a721ffd3fbaaa9b881
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394