dcrat | d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 21:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe
Size

1.3MB
MD5

2f226ccda5018f4887ef8b37b0740bc1
SHA1

20364e965663d992567ff173877039b297eaaa37
SHA256

d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23
SHA512

a0c26fd547ffb2b00603627d50f083d1fe222011ddaf0f33f6a16f2d42a83b11f7daa8c413d7fb53e8094586453c0eef0a323b42a51245f2d532e1194c5a2387
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2804	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3560	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3740	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3412	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4412	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2984	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	2524	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	2524	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c86-10.dat	dcrat
behavioral2/memory/4308-13-0x0000000000620000-0x0000000000730000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3288	powershell.exe
376	powershell.exe
4320	powershell.exe
4492	powershell.exe
4576	powershell.exe
2584	powershell.exe
4916	powershell.exe
216	powershell.exe
3156	powershell.exe
4444	powershell.exe
4516	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	sihost.exe

Executes dropped EXE 14 IoCs

pid	Process
4308	DllCommonsvc.exe
4572	sihost.exe
1404	sihost.exe
348	sihost.exe
4152	sihost.exe
3760	sihost.exe
1516	sihost.exe
1136	sihost.exe
3560	sihost.exe
3576	sihost.exe
1848	sihost.exe
2816	sihost.exe
4596	sihost.exe
1196	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
17	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com
53	raw.githubusercontent.com
18	raw.githubusercontent.com
38	raw.githubusercontent.com
41	raw.githubusercontent.com
42	raw.githubusercontent.com
46	raw.githubusercontent.com
51	raw.githubusercontent.com
52	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe	DllCommonsvc.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\69ddcba757bf72	DllCommonsvc.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\886983d96e3d3e	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\uk-UA\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Security\66fc9ff0ee96c2	DllCommonsvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Containers\serviced\ea9f0e6c9e2dcd	DllCommonsvc.exe
File created	C:\Windows\Branding\shellbrd\wininit.exe	DllCommonsvc.exe
File created	C:\Windows\Branding\shellbrd\56085415360792	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\WinSAT\DataStore\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Windows\Containers\serviced\taskhostw.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3732	schtasks.exe
1412	schtasks.exe
2984	schtasks.exe
4252	schtasks.exe
2448	schtasks.exe
3700	schtasks.exe
5112	schtasks.exe
1876	schtasks.exe
1364	schtasks.exe
2804	schtasks.exe
2996	schtasks.exe
4128	schtasks.exe
2008	schtasks.exe
4340	schtasks.exe
1460	schtasks.exe
3412	schtasks.exe
4412	schtasks.exe
436	schtasks.exe
3560	schtasks.exe
3840	schtasks.exe
3740	schtasks.exe
4928	schtasks.exe
1452	schtasks.exe
2792	schtasks.exe
1416	schtasks.exe
2936	schtasks.exe
3464	schtasks.exe
3468	schtasks.exe
836	schtasks.exe
4636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
4308	DllCommonsvc.exe
4308	DllCommonsvc.exe
4308	DllCommonsvc.exe
4308	DllCommonsvc.exe
4308	DllCommonsvc.exe
4576	powershell.exe
4576	powershell.exe
3156	powershell.exe
3156	powershell.exe
4516	powershell.exe
4516	powershell.exe
376	powershell.exe
376	powershell.exe
4916	powershell.exe
4916	powershell.exe
216	powershell.exe
216	powershell.exe
4444	powershell.exe
4444	powershell.exe
3288	powershell.exe
3288	powershell.exe
2584	powershell.exe
2584	powershell.exe
4320	powershell.exe
4320	powershell.exe
4492	powershell.exe
4492	powershell.exe
4444	powershell.exe
4320	powershell.exe
3156	powershell.exe
216	powershell.exe
4576	powershell.exe
4516	powershell.exe
4916	powershell.exe
3288	powershell.exe
376	powershell.exe
4492	powershell.exe
2584	powershell.exe
4572	sihost.exe
1404	sihost.exe
348	sihost.exe
4152	sihost.exe
3760	sihost.exe
1516	sihost.exe
1136	sihost.exe
3560	sihost.exe
3576	sihost.exe
1848	sihost.exe
2816	sihost.exe
4596	sihost.exe
1196	sihost.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	DllCommonsvc.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeDebugPrivilege	4516	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	4492	powershell.exe
Token: SeDebugPrivilege	4572	sihost.exe
Token: SeDebugPrivilege	1404	sihost.exe
Token: SeDebugPrivilege	348	sihost.exe
Token: SeDebugPrivilege	4152	sihost.exe
Token: SeDebugPrivilege	3760	sihost.exe
Token: SeDebugPrivilege	1516	sihost.exe
Token: SeDebugPrivilege	1136	sihost.exe
Token: SeDebugPrivilege	3560	sihost.exe
Token: SeDebugPrivilege	3576	sihost.exe
Token: SeDebugPrivilege	1848	sihost.exe
Token: SeDebugPrivilege	2816	sihost.exe
Token: SeDebugPrivilege	4596	sihost.exe
Token: SeDebugPrivilege	1196	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3348	3116	JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe	83
PID 3116 wrote to memory of 3348	3116	JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe	83
PID 3116 wrote to memory of 3348	3116	JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe	83
PID 3348 wrote to memory of 2976	3348	WScript.exe	85
PID 3348 wrote to memory of 2976	3348	WScript.exe	85
PID 3348 wrote to memory of 2976	3348	WScript.exe	85
PID 2976 wrote to memory of 4308	2976	cmd.exe	87
PID 2976 wrote to memory of 4308	2976	cmd.exe	87
PID 4308 wrote to memory of 4492	4308	DllCommonsvc.exe	120
PID 4308 wrote to memory of 4492	4308	DllCommonsvc.exe	120
PID 4308 wrote to memory of 4576	4308	DllCommonsvc.exe	121
PID 4308 wrote to memory of 4576	4308	DllCommonsvc.exe	121
PID 4308 wrote to memory of 2584	4308	DllCommonsvc.exe	122
PID 4308 wrote to memory of 2584	4308	DllCommonsvc.exe	122
PID 4308 wrote to memory of 4916	4308	DllCommonsvc.exe	123
PID 4308 wrote to memory of 4916	4308	DllCommonsvc.exe	123
PID 4308 wrote to memory of 216	4308	DllCommonsvc.exe	124
PID 4308 wrote to memory of 216	4308	DllCommonsvc.exe	124
PID 4308 wrote to memory of 3288	4308	DllCommonsvc.exe	125
PID 4308 wrote to memory of 3288	4308	DllCommonsvc.exe	125
PID 4308 wrote to memory of 3156	4308	DllCommonsvc.exe	126
PID 4308 wrote to memory of 3156	4308	DllCommonsvc.exe	126
PID 4308 wrote to memory of 4516	4308	DllCommonsvc.exe	127
PID 4308 wrote to memory of 4516	4308	DllCommonsvc.exe	127
PID 4308 wrote to memory of 4320	4308	DllCommonsvc.exe	128
PID 4308 wrote to memory of 4320	4308	DllCommonsvc.exe	128
PID 4308 wrote to memory of 376	4308	DllCommonsvc.exe	129
PID 4308 wrote to memory of 376	4308	DllCommonsvc.exe	129
PID 4308 wrote to memory of 4444	4308	DllCommonsvc.exe	130
PID 4308 wrote to memory of 4444	4308	DllCommonsvc.exe	130
PID 4308 wrote to memory of 2808	4308	DllCommonsvc.exe	142
PID 4308 wrote to memory of 2808	4308	DllCommonsvc.exe	142
PID 2808 wrote to memory of 116	2808	cmd.exe	144
PID 2808 wrote to memory of 116	2808	cmd.exe	144
PID 2808 wrote to memory of 4572	2808	cmd.exe	146
PID 2808 wrote to memory of 4572	2808	cmd.exe	146
PID 4572 wrote to memory of 3928	4572	sihost.exe	155
PID 4572 wrote to memory of 3928	4572	sihost.exe	155
PID 3928 wrote to memory of 2024	3928	cmd.exe	157
PID 3928 wrote to memory of 2024	3928	cmd.exe	157
PID 3928 wrote to memory of 1404	3928	cmd.exe	163
PID 3928 wrote to memory of 1404	3928	cmd.exe	163
PID 1404 wrote to memory of 3776	1404	sihost.exe	168
PID 1404 wrote to memory of 3776	1404	sihost.exe	168
PID 3776 wrote to memory of 4304	3776	cmd.exe	170
PID 3776 wrote to memory of 4304	3776	cmd.exe	170
PID 3776 wrote to memory of 348	3776	cmd.exe	172
PID 3776 wrote to memory of 348	3776	cmd.exe	172
PID 348 wrote to memory of 2580	348	sihost.exe	174
PID 348 wrote to memory of 2580	348	sihost.exe	174
PID 2580 wrote to memory of 1444	2580	cmd.exe	176
PID 2580 wrote to memory of 1444	2580	cmd.exe	176
PID 2580 wrote to memory of 4152	2580	cmd.exe	178
PID 2580 wrote to memory of 4152	2580	cmd.exe	178
PID 4152 wrote to memory of 3544	4152	sihost.exe	180
PID 4152 wrote to memory of 3544	4152	sihost.exe	180
PID 3544 wrote to memory of 1616	3544	cmd.exe	182
PID 3544 wrote to memory of 1616	3544	cmd.exe	182
PID 3544 wrote to memory of 3760	3544	cmd.exe	184
PID 3544 wrote to memory of 3760	3544	cmd.exe	184
PID 3760 wrote to memory of 4720	3760	sihost.exe	186
PID 3760 wrote to memory of 4720	3760	sihost.exe	186
PID 4720 wrote to memory of 1488	4720	cmd.exe	188
PID 4720 wrote to memory of 1488	4720	cmd.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0c417af3a66626e3e11ff6bfce4e7c03d24d4d3df7c0e3bccdaf605c91c4a23.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\shellbrd\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\DataStore\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3288
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Security\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cnVBdQlyaT.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2808
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:116
      - C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yaFjl1awzE.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2024
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1404
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z7DRyUOV59.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4304
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1444
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8Usvo58uhQ.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:1616
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ay5NT8uJA6.bat"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1488
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat"
        17⤵
        
        PID:312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:220
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1136
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwHeC7tSxv.bat"
        19⤵
        
        PID:1792
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1600
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ottjOj3FQt.bat"
        21⤵
        
        PID:4748
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:2804
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ottjOj3FQt.bat"
        23⤵
        
        PID:3664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1544
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J91AFVPMIK.bat"
        25⤵
        
        PID:3440
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2300
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat"
        27⤵
        
        PID:3376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:324
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat"
        29⤵
        
        PID:932
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:1040
        
        C:\Program Files\Windows Security\sihost.exe
        
        "C:\Program Files\Windows Security\sihost.exe"
        30⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Windows\Branding\shellbrd\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Branding\shellbrd\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\Branding\shellbrd\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Windows\Performance\WinSAT\DataStore\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Windows\Containers\serviced\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\uk-UA\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\providercommon\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Security\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Security\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Security\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6c47b3f4e68eebd47e9332eebfd2dd4e

SHA1
67f0b143336d7db7b281ed3de5e877fa87261834

SHA256
8c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c

SHA512
0acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Temp\4WSxKcEorb.bat

Filesize
209B

MD5
d698c9c9fa008a84920db5721698678d

SHA1
f7063cd0f68d86ce15e77fdbf96e86a3dd745415

SHA256
e3e612be3c3f717b591bc3cdb6fd7dc9f1da8ba40bad14a256b502617379c78d

SHA512
d84e1cdd8126a0a68766af2ee7ceea6b8debea5fa74b0c96a3eacc79041f8b91aa90a7bda9208b3b5f0e9ad2485938feea4055515a85162b1deffbe7cac21e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\8Usvo58uhQ.bat

Filesize
209B

MD5
f775accb871fcb87bbe3cafa31f6790f

SHA1
1a076564a96906443feae0a7668d56c5788d4049

SHA256
b1adf6a55f8db69da29632edafaaa2c052669bcd6bb0c5beb2477cb7315be9c9

SHA512
6a92b1847ec25e2dac933f6f5efeda2f499ee6c1b658bf4508339ac8f20590d528c6317925845146648a65c089758f0fb5a247e379b10cc09cf9032bb7d09586

Download Submit
C:\Users\Admin\AppData\Local\Temp\J91AFVPMIK.bat

Filesize
209B

MD5
215b2dee6016b3be3be9c96dbff4a2f4

SHA1
b5e4ae6f4b5d3504288c8ee4557f48f7f2ad1bf2

SHA256
753e38fdb9e75af4cdbc0484b147e7c3d39c63c84943f7b1e6c699fd7b247c2f

SHA512
3261623d1339450903c07a09de073bb77588ba1f44b6830af2de26e994546be24214c25244bf10607be6a792ba23d3e483036239b7173a3b7e619baec51de3ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\PCaGvPqXNx.bat

Filesize
209B

MD5
9aeaecfe1911a9b2a0287a858aed0844

SHA1
2907c677195fac22cd3081e254760d75f43c11b4

SHA256
da3b4773a84dfa4e3bbbd917fa888f275957fd824b250f52a22bd8b193fbb9f5

SHA512
9108ba9f94339dfd4333d20b87e077d25fb8b0bf77e92db2652cc174309ee1970e18f15d17c02abcfbc75414681ac21c7adef8ad59982a4045b0adc660702d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z7DRyUOV59.bat

Filesize
209B

MD5
ccf5f51fe9ed956e8841bb25349e242c

SHA1
140706dd66be5dd49c74bb52feaa867510585f59

SHA256
d0baa4cd826d1184acb80e9231e3864f7e4b96a708aab7e7fab299237fe5a1ec

SHA512
dc59a845a801ed84a5afb6b0aad57d95980a91ca174692f391db25ba80c6e4ad9f4858ad34262c9221441a9e6762d542c34dd01d2d043d438f7b3ff4bd1e1552

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nruuxkl3.zqo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ay5NT8uJA6.bat

Filesize
209B

MD5
3583403067cf517bff8e894cb51eefb6

SHA1
026adc44fe129d6f1fa90e1b5c97464d058fb84b

SHA256
14c72f3046dc1c0603447096df71e833ff0e81582cb85a47602cb918d72699e7

SHA512
8e347aa23f0621589d00060bf574327a98c8d7044b77df1ba49beaffa6995fe8b7784d20d33d437a478397586f3f3a9b36f6a1588c1ada2d62d29cfb542ffb31

Download Submit
C:\Users\Admin\AppData\Local\Temp\cnVBdQlyaT.bat

Filesize
209B

MD5
55b6a905eaed7f4a3a42dd67009f5946

SHA1
1ffbd9189e46c36133b57d57ce2ec4034af81b67

SHA256
78e62a7ac8f3093e1e5feda4d16bb6321f0952f96cb9ad9f1151656ddaafee4a

SHA512
2efc1e1afba6d07679ee7ac062eae91590f1d56a16e3ef6e5daee01ee3c52ac82b2eae28439150588ae1a664a884f3d5f45091d0fd972c69fdaaf92d79171742

Download Submit
C:\Users\Admin\AppData\Local\Temp\cu7QADyCUt.bat

Filesize
209B

MD5
a07905290934976f00aeabfb274c2539

SHA1
102089c108dcb0283487fc38af7af9568329d3be

SHA256
f520104ea7e854180c377d77f2c144d72bfd1c7241ecbbdf989d413e56bd544f

SHA512
ee228c5d754e72a2adce05deb6d049e6cf80d10ba31f173b304dbdb4ca9724e59fa5db9665a5c95a5aef092bb1f61e7e6a6d8dc69df5e2435b01b03770d313f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ottjOj3FQt.bat

Filesize
209B

MD5
5cbfe7efa3a5057dbd6ef4e9fbc225aa

SHA1
960562103b9ad49982cb6c7527f69c8eca61cd84

SHA256
e413a163036e9e6f35067ab634eb54084ab7fa8dbdb84226c6876fc3ac998bf9

SHA512
f08188e6a75282d032ef8117e78f5929b5d2bd1cd06bc8804303630a13ae725993b83ef24930649afc7ada814e0b50db3adbfe84f9c8d9bc852714350a892ad1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkmftNZ3Wr.bat

Filesize
209B

MD5
4b6658dd0b27d774a2c389a8ae569398

SHA1
7f6f96234696f18d20b559264a329daf25fae650

SHA256
895d8dc33678ddcc991e1484842b108b6bdc49669af6d19baaf254cbf9ee30a1

SHA512
a6313ed93bd30e40c2aeac65882a0e8a024becf632595971da590681b68a11cd0a16fad5cbf702fea78773f417511dcf621b30edd6337d503204282775135ad9

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwHeC7tSxv.bat

Filesize
209B

MD5
0b6623eb6509a85bd29e1caecf275091

SHA1
7a9c960352776b7135610bea7c9efbf6af7a1d1a

SHA256
0aa67e219692feb9150f97bfea21e21406d21e196cb65ca50609112dc7b57627

SHA512
b0968ba4e1be0569e33eb07da71b24a5ae6480f66e64355e6ecda90f6cad29244a9070959534bec85ac916ae589c55a103d9422a3ab639390bc5b943a3190fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\yaFjl1awzE.bat

Filesize
209B

MD5
7fe1a80a861704c637b534bd0dce3f14

SHA1
01e9d13af02f5905794dd589fa19416fa4468b88

SHA256
8fb342f08eb54a819282d26d60cce446e652623db6c27007a85141cc123772a0

SHA512
df751eb0affc4a414eb62aec9ed2cbc0bef8afbca1a3b316477bb7e2566fddb5c08c3e800f50cea625699665808ee8170aeacf5008be3874de301efeeb5b0197

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1404-180-0x0000000000C10000-0x0000000000C22000-memory.dmp

Filesize
72KB

Download
memory/3560-218-0x0000000000A50000-0x0000000000A62000-memory.dmp

Filesize
72KB

Download
memory/4152-193-0x0000000002D40000-0x0000000002D52000-memory.dmp

Filesize
72KB

Download
memory/4308-12-0x00007FF8E7E93000-0x00007FF8E7E95000-memory.dmp

Filesize
8KB

Download
memory/4308-13-0x0000000000620000-0x0000000000730000-memory.dmp

Filesize
1.1MB

Download
memory/4308-14-0x0000000002940000-0x0000000002952000-memory.dmp

Filesize
72KB

Download
memory/4308-15-0x0000000002960000-0x000000000296C000-memory.dmp

Filesize
48KB

Download
memory/4308-16-0x0000000002970000-0x000000000297C000-memory.dmp

Filesize
48KB

Download
memory/4308-17-0x000000001B260000-0x000000001B26C000-memory.dmp

Filesize
48KB

Download
memory/4572-170-0x0000000000E90000-0x0000000000EA2000-memory.dmp

Filesize
72KB

Download
memory/4572-177-0x000000001BB00000-0x000000001BC02000-memory.dmp

Filesize
1.0MB

Download
memory/4576-61-0x0000017974D50000-0x0000017974D72000-memory.dmp

Filesize
136KB

Download
memory/4596-243-0x00000000022C0000-0x00000000022D2000-memory.dmp

Filesize
72KB

Download