dcrat | 60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe
Size

1.3MB
MD5

f837438076c31b473a7e5d9aa65aca7f
SHA1

04f7f9142bcf479df0443266bd0a66e360b5fbf4
SHA256

60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43
SHA512

928f5d609a93efaaf66f9487df05ec1c654be9a8d10ebcd46c60d42aae619c760d306d46a9e1c6e8dd08f1723e056a9e5f3bac9ed6b91a6a8bb967ac5cc4a53e
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4292	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	344	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	708	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4764	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3860	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3392	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4324	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	524	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3884	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	184	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	644	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	644	schtasks.exe	89

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c7f-10.dat	dcrat
behavioral2/memory/232-13-0x0000000000E20000-0x0000000000F30000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1924	powershell.exe
520	powershell.exe
2164	powershell.exe
2388	powershell.exe
2620	powershell.exe
2372	powershell.exe
2840	powershell.exe
372	powershell.exe
4400	powershell.exe
1452	powershell.exe
4868	powershell.exe
3612	powershell.exe
4884	powershell.exe
4080	powershell.exe

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	dllhost.exe

Executes dropped EXE 14 IoCs

pid	Process
232	DllCommonsvc.exe
2880	dllhost.exe
1524	dllhost.exe
4292	dllhost.exe
4388	dllhost.exe
2200	dllhost.exe
1584	dllhost.exe
1588	dllhost.exe
2884	dllhost.exe
4376	dllhost.exe
4584	dllhost.exe
4944	dllhost.exe
4140	dllhost.exe
4556	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
40	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
45	raw.githubusercontent.com
23	raw.githubusercontent.com
37	raw.githubusercontent.com
51	raw.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
49	raw.githubusercontent.com
39	raw.githubusercontent.com
50	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\56085415360792	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\088424020bedd6	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\twain_32\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\ServiceState\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Windows\Cursors\upfc.exe	DllCommonsvc.exe
File created	C:\Windows\Cursors\ea1d8f6d871115	DllCommonsvc.exe
File created	C:\Windows\Performance\dwm.exe	DllCommonsvc.exe
File created	C:\Windows\Performance\6cb0b6c459d5d3	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
344	schtasks.exe
3712	schtasks.exe
4780	schtasks.exe
4272	schtasks.exe
1668	schtasks.exe
184	schtasks.exe
1504	schtasks.exe
1688	schtasks.exe
4860	schtasks.exe
3860	schtasks.exe
4020	schtasks.exe
1860	schtasks.exe
224	schtasks.exe
4844	schtasks.exe
4324	schtasks.exe
3504	schtasks.exe
4112	schtasks.exe
3496	schtasks.exe
964	schtasks.exe
3884	schtasks.exe
1016	schtasks.exe
4292	schtasks.exe
708	schtasks.exe
1032	schtasks.exe
1804	schtasks.exe
1396	schtasks.exe
1952	schtasks.exe
3976	schtasks.exe
2068	schtasks.exe
524	schtasks.exe
2064	schtasks.exe
4764	schtasks.exe
3392	schtasks.exe
4584	schtasks.exe
1848	schtasks.exe
3020	schtasks.exe
3836	schtasks.exe
444	schtasks.exe
3916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
232	DllCommonsvc.exe
2620	powershell.exe
2620	powershell.exe
372	powershell.exe
372	powershell.exe
4080	powershell.exe
4080	powershell.exe
4884	powershell.exe
4884	powershell.exe
3612	powershell.exe
3612	powershell.exe
4868	powershell.exe
4868	powershell.exe
2840	powershell.exe
2840	powershell.exe
2388	powershell.exe
2388	powershell.exe
520	powershell.exe
520	powershell.exe
1924	powershell.exe
1924	powershell.exe
2164	powershell.exe
2164	powershell.exe
1452	powershell.exe
1452	powershell.exe
2372	powershell.exe
2372	powershell.exe
4400	powershell.exe
4400	powershell.exe
2372	powershell.exe
4080	powershell.exe
2620	powershell.exe
2620	powershell.exe
372	powershell.exe
372	powershell.exe
4400	powershell.exe
4868	powershell.exe
2840	powershell.exe
1924	powershell.exe
4884	powershell.exe
3612	powershell.exe
2388	powershell.exe
1452	powershell.exe
520	powershell.exe
2164	powershell.exe
2880	dllhost.exe
1524	dllhost.exe
4292	dllhost.exe
4388	dllhost.exe
2200	dllhost.exe
1584	dllhost.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	232	DllCommonsvc.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	372	powershell.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	1452	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	2880	dllhost.exe
Token: SeDebugPrivilege	1524	dllhost.exe
Token: SeDebugPrivilege	4292	dllhost.exe
Token: SeDebugPrivilege	4388	dllhost.exe
Token: SeDebugPrivilege	2200	dllhost.exe
Token: SeDebugPrivilege	1584	dllhost.exe
Token: SeDebugPrivilege	1588	dllhost.exe
Token: SeDebugPrivilege	2884	dllhost.exe
Token: SeDebugPrivilege	4376	dllhost.exe
Token: SeDebugPrivilege	4584	dllhost.exe
Token: SeDebugPrivilege	4944	dllhost.exe
Token: SeDebugPrivilege	4140	dllhost.exe
Token: SeDebugPrivilege	4556	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4144	4248	JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe	84
PID 4248 wrote to memory of 4144	4248	JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe	84
PID 4248 wrote to memory of 4144	4248	JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe	84
PID 4144 wrote to memory of 1304	4144	WScript.exe	86
PID 4144 wrote to memory of 1304	4144	WScript.exe	86
PID 4144 wrote to memory of 1304	4144	WScript.exe	86
PID 1304 wrote to memory of 232	1304	cmd.exe	88
PID 1304 wrote to memory of 232	1304	cmd.exe	88
PID 232 wrote to memory of 4400	232	DllCommonsvc.exe	130
PID 232 wrote to memory of 4400	232	DllCommonsvc.exe	130
PID 232 wrote to memory of 2620	232	DllCommonsvc.exe	131
PID 232 wrote to memory of 2620	232	DllCommonsvc.exe	131
PID 232 wrote to memory of 2372	232	DllCommonsvc.exe	132
PID 232 wrote to memory of 2372	232	DllCommonsvc.exe	132
PID 232 wrote to memory of 520	232	DllCommonsvc.exe	133
PID 232 wrote to memory of 520	232	DllCommonsvc.exe	133
PID 232 wrote to memory of 2164	232	DllCommonsvc.exe	134
PID 232 wrote to memory of 2164	232	DllCommonsvc.exe	134
PID 232 wrote to memory of 2388	232	DllCommonsvc.exe	135
PID 232 wrote to memory of 2388	232	DllCommonsvc.exe	135
PID 232 wrote to memory of 2840	232	DllCommonsvc.exe	136
PID 232 wrote to memory of 2840	232	DllCommonsvc.exe	136
PID 232 wrote to memory of 372	232	DllCommonsvc.exe	137
PID 232 wrote to memory of 372	232	DllCommonsvc.exe	137
PID 232 wrote to memory of 1924	232	DllCommonsvc.exe	138
PID 232 wrote to memory of 1924	232	DllCommonsvc.exe	138
PID 232 wrote to memory of 4080	232	DllCommonsvc.exe	139
PID 232 wrote to memory of 4080	232	DllCommonsvc.exe	139
PID 232 wrote to memory of 4868	232	DllCommonsvc.exe	141
PID 232 wrote to memory of 4868	232	DllCommonsvc.exe	141
PID 232 wrote to memory of 1452	232	DllCommonsvc.exe	142
PID 232 wrote to memory of 1452	232	DllCommonsvc.exe	142
PID 232 wrote to memory of 4884	232	DllCommonsvc.exe	143
PID 232 wrote to memory of 4884	232	DllCommonsvc.exe	143
PID 232 wrote to memory of 3612	232	DllCommonsvc.exe	145
PID 232 wrote to memory of 3612	232	DllCommonsvc.exe	145
PID 232 wrote to memory of 2240	232	DllCommonsvc.exe	157
PID 232 wrote to memory of 2240	232	DllCommonsvc.exe	157
PID 2240 wrote to memory of 1580	2240	cmd.exe	160
PID 2240 wrote to memory of 1580	2240	cmd.exe	160
PID 2240 wrote to memory of 2880	2240	cmd.exe	166
PID 2240 wrote to memory of 2880	2240	cmd.exe	166
PID 2880 wrote to memory of 2444	2880	dllhost.exe	174
PID 2880 wrote to memory of 2444	2880	dllhost.exe	174
PID 2444 wrote to memory of 1504	2444	cmd.exe	176
PID 2444 wrote to memory of 1504	2444	cmd.exe	176
PID 2444 wrote to memory of 1524	2444	cmd.exe	178
PID 2444 wrote to memory of 1524	2444	cmd.exe	178
PID 1524 wrote to memory of 3120	1524	dllhost.exe	183
PID 1524 wrote to memory of 3120	1524	dllhost.exe	183
PID 3120 wrote to memory of 4996	3120	cmd.exe	185
PID 3120 wrote to memory of 4996	3120	cmd.exe	185
PID 3120 wrote to memory of 4292	3120	cmd.exe	187
PID 3120 wrote to memory of 4292	3120	cmd.exe	187
PID 4292 wrote to memory of 416	4292	dllhost.exe	189
PID 4292 wrote to memory of 416	4292	dllhost.exe	189
PID 416 wrote to memory of 1016	416	cmd.exe	191
PID 416 wrote to memory of 1016	416	cmd.exe	191
PID 416 wrote to memory of 4388	416	cmd.exe	193
PID 416 wrote to memory of 4388	416	cmd.exe	193
PID 4388 wrote to memory of 2916	4388	dllhost.exe	195
PID 4388 wrote to memory of 2916	4388	dllhost.exe	195
PID 2916 wrote to memory of 2016	2916	cmd.exe	197
PID 2916 wrote to memory of 2016	2916	cmd.exe	197

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_60d8e73a791882333ba7c35de391863b33e3f7f873fd7d89b9afa5b0225eac43.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\System.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\es-ES\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:520
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\services.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eYabtubPZN.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2240
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1580
      - C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2444
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:1504
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4996
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2RP5SY0RjS.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1016
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2016
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2200
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat"
        15⤵
        
        PID:4032
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:556
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat"
        17⤵
        
        PID:3884
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1560
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat"
        19⤵
        
        PID:4340
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1840
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat"
        21⤵
        
        PID:1336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3432
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat"
        23⤵
        
        PID:572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:1476
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\83zFD3riGi.bat"
        25⤵
        
        PID:4808
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:1072
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4944
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"
        27⤵
        
        PID:60
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:2524
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4140
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat"
        29⤵
        
        PID:2128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:3832
        
        C:\Windows\twain_32\dllhost.exe
        
        "C:\Windows\twain_32\dllhost.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Default\SendTo\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\SendTo\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Windows\twain_32\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\twain_32\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\twain_32\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\Cursors\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Cursors\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\Cursors\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\providercommon\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\providercommon\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\providercommon\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\Performance\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Performance\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Windows\Performance\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a8e8360d573a4ff072dcc6f09d992c88

SHA1
3446774433ceaf0b400073914facab11b98b6807

SHA256
bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

SHA512
4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Temp\2RP5SY0RjS.bat

Filesize
196B

MD5
086e6614aac9df9734dede8184031e70

SHA1
99a81914a44daa3850fc0887ec729d79523ebb6e

SHA256
69a9452accc1e537747092d437d285ddc62c3a270ff5ff4ee1db77fad025ed43

SHA512
f02a32c8917e6997aecf38c39c556c524d6d19287e3e9d46ad0393880656693ef1952334683011311f42d072f62bd09bbfe0ae8181db7b20a3ca1cd08a2dce6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3Bw8qtkvcA.bat

Filesize
196B

MD5
70adf57da2f880921134b0dd0baaa320

SHA1
4b892c2856d478bb831ef2981d93cc127fba6a6e

SHA256
55976e66b4876733c81ddebbfff8f0c5d99c042963b6348d052924e064b60853

SHA512
cb844a375fd2d02468c3f3c1866d74b01a191d064250cb62ec1a041740e47ca79c4add1f0008c56ef4d38656f3dc631ccc02e93dc6cfc63630c5b8b5b1ead9f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7JTBpj7DN0.bat

Filesize
196B

MD5
26c7923516b5b4797a4eaf3e2f66e48d

SHA1
1241c705a338e630acb031b3c9cc7ceaac98472d

SHA256
2cbd97b679738ca2f8cdcb870da3e4b0c6e36c206c7a54b48058328c785bad5b

SHA512
4c44132afd6400a25f74a3e5781a516d072b0b66f0311377e22b584e92bc8f958a8d3923b8b9c24cc2580afaf4788630682529dd28fcb742ab90e39e135a4d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\83zFD3riGi.bat

Filesize
196B

MD5
863cf945022270b5001ae26030dc2e37

SHA1
40dabb6d2bd60840794fa948724e9690d82c6aea

SHA256
18bf17725ee37bfc8de685603624f2a544b6815ef2fdb93515521afd04afe401

SHA512
56555e8b703b611c4d1c3791cbd4b0c90748f2279ea38343f6973505d1658d384ccc63fdbb913f356d8ba322418a5b31693f64278dd69b6d0b2741570111e843

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat

Filesize
196B

MD5
6f721fd76e48a52406af9b9ca56f887a

SHA1
18d3c6354b1d5a7dbcdc35e81f71ea39ef29e032

SHA256
02697350e9b2f7c791217be330d0cb1282c8aa96e3a0d17f25dcb8bd09b8295c

SHA512
56b50e39e6f3b0a7de05d0829f4e808909ad70a4b68ab3542181f2a4df19eeda34695e1e429af352322efba973c64d237ff68b76587eb2fc44716f6d6a2751ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat

Filesize
196B

MD5
0561c6acb6e60a9f973a384775429555

SHA1
58096dba374bccf1af745e88baa04c763a360671

SHA256
9a3a80dcbb87fab32d6fc4d267223538dff641eb9dd8b2a4ae7e5e49c7ac9a9e

SHA512
9dbb987cb7ca0a03aaf3cb46ff4a5475f8082fbe140e36fe904b0ebecdbc3dabe5bb6e7fd42cdd4867c2908390692d4134614c16f11446496fc2a13563a0960b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SsFcJDxdf6.bat

Filesize
196B

MD5
8c410461b8fdc114823353cb86dc1bbc

SHA1
9fa26dc7f11a5a24e7bf2a822bcfea8c278d35da

SHA256
0c2b8609a59c7492602e5088674ab4a2642add9d504fa74d0252eb8b90d3ee88

SHA512
a215ce5a859a48f32e43bca40ff2a9be12801db70cad3160edea7788b784a156a14ec6133f557df167aec617b320d4f047b5a253bba6c56e1a80442800156c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tvrril15.tzw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctDgUbHuaY.bat

Filesize
196B

MD5
024f6877a56d9ea4e7d0b1ff91e6e483

SHA1
75cc74c0e3c0146ae9c796170df23823b943fbfb

SHA256
449600cdda35864f3fdb36a318443c9067820881b385aedc29448dd0461656c0

SHA512
cfd9adaa723778ecfd734cbf642e0dffb0d055b3d89a27019be1b3208b54393628ad71e5d6257ecc3872aec021f24a46bd752d2890551c05d783431f63636cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\eYabtubPZN.bat

Filesize
196B

MD5
b089672e43cb53cf7f91e2239468124d

SHA1
7df49b32c3aeb51361d90239c0afe427906e71a3

SHA256
7685a47ecd256fae4992f39bd0dc1a8ba61eb4c9561880d4a814c401b4760f60

SHA512
1a8fa5dddc57b5cbfd717089c9b5535810eb10d39cb08f570f467063e3740ed51e5b2eb0b5cb89c13b6159b9fff61b9f0cd7e1903e859465421f9e91d162618b

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhJpXqSaXt.bat

Filesize
196B

MD5
67dced85de56b57cf2e012bbb9598229

SHA1
220d25f18942fcd9994e6d798f068e14f4e1eec8

SHA256
4d2b5750cec4d363b1319139ac67c7d87a3c5ac53e882fc8841ada5a0e62d142

SHA512
b59f9c51d76c18dc1248c7b9842582f05dd3b78619cc57961c9bf7af2a1ab8d4e4dc75d9470aaf399ee5671c614f960ccc338432ba288df3907bc22c295f6cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat

Filesize
196B

MD5
86b5052928cff92468c2a2d95d36e018

SHA1
155658f9a0726aeb85ac40ed3ecd7d25561eea85

SHA256
c18cadf40bf1a547ac73fc3c49880ceb12d9574a946d704568f3ec96abd7d7b2

SHA512
6671e04360d4a5f356e16a545084cfc0630f071586550ede8b69171999fbe9070d0a7d469097887da544245fb96b1ff872079904a6c49c0c51418ceb52900937

Download Submit
C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat

Filesize
196B

MD5
c9c970d92e1c3c1c55b4d5562b52e63f

SHA1
d783fdd6a9682905dcc1b4096a96576090920718

SHA256
049815e27d063f5e99db8b4732783f9598bd3e10031f9fb34b260ddabfb36dce

SHA512
a4df78b8e5d4855493961473bdf22ecc71a31c57ca196c9dfd0ab8bcc45133d77a5e847f2360d7870b90755ad954c497ab1c8b0a35cdf31c5a7899dad4cf95f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\rfuxuqwfwI.bat

Filesize
196B

MD5
e3ce1f75ba4214ba7bd8316ef24ab8dd

SHA1
3311c8ce4ca0eacb46163f0c0cd6500ab1b9f1bf

SHA256
d5e23fa9137658dfcbdade19fce48a50cb022ef3054b3df61960d3edbbd163fb

SHA512
c58790796654d7ad0972b395bac9d25a0c0de8e35306f7c32b6fb54f6c64fb2830a80367bd206a7d32ba31bcfe170cc8200aa066e198a3decdbda99113359640

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/232-17-0x0000000003170000-0x000000000317C000-memory.dmp

Filesize
48KB

Download
memory/232-16-0x0000000003150000-0x000000000315C000-memory.dmp

Filesize
48KB

Download
memory/232-15-0x0000000003160000-0x000000000316C000-memory.dmp

Filesize
48KB

Download
memory/232-14-0x0000000001850000-0x0000000001862000-memory.dmp

Filesize
72KB

Download
memory/232-13-0x0000000000E20000-0x0000000000F30000-memory.dmp

Filesize
1.1MB

Download
memory/232-12-0x00007FFF8A6E3000-0x00007FFF8A6E5000-memory.dmp

Filesize
8KB

Download
memory/1584-238-0x0000000000E10000-0x0000000000E22000-memory.dmp

Filesize
72KB

Download
memory/1588-245-0x0000000001080000-0x0000000001092000-memory.dmp

Filesize
72KB

Download
memory/2620-54-0x000002AAE8900000-0x000002AAE8922000-memory.dmp

Filesize
136KB

Download
memory/2880-205-0x00000000029E0000-0x00000000029F2000-memory.dmp

Filesize
72KB

Download
memory/4140-277-0x0000000001050000-0x0000000001062000-memory.dmp

Filesize
72KB

Download
memory/4556-284-0x0000000002C10000-0x0000000002C22000-memory.dmp

Filesize
72KB

Download
memory/4944-270-0x00000000029C0000-0x00000000029D2000-memory.dmp

Filesize
72KB

Download