dcrat | 5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe
Size

1.3MB
MD5

5c06cb74d085247d633f06aa98b53904
SHA1

e6201bef30eb8ad1981b60476f8afad76f853b4e
SHA256

5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954
SHA512

9beee06788a692a1712cc2ada99c9b3f30c37022176a285ba094684225f613a40fa8d97b723f36f7dd79ef94259d152dbf55764cb5661495910975a613217433
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1652	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3836	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3248	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3524	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1488	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4584	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4988	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4640	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	3532	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	3532	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c83-10.dat	dcrat
behavioral2/memory/1876-13-0x0000000000630000-0x0000000000740000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
1936	powershell.exe
5060	powershell.exe
3328	powershell.exe
2824	powershell.exe
2188	powershell.exe
4200	powershell.exe
1060	powershell.exe
332	powershell.exe
4428	powershell.exe
1892	powershell.exe
1508	powershell.exe
928	powershell.exe

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	sihost.exe

Executes dropped EXE 13 IoCs

pid	Process
1876	DllCommonsvc.exe
2696	sihost.exe
676	sihost.exe
4664	sihost.exe
3196	sihost.exe
4640	sihost.exe
2640	sihost.exe
3648	sihost.exe
2300	sihost.exe
740	sihost.exe
1596	sihost.exe
1544	sihost.exe
68	sihost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
43	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
24	raw.githubusercontent.com
38	raw.githubusercontent.com
53	raw.githubusercontent.com
39	raw.githubusercontent.com
44	raw.githubusercontent.com
47	raw.githubusercontent.com
52	raw.githubusercontent.com

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\66fc9ff0ee96c2	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\fr-FR\dllhost.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\ebf1f9fa8afd6d	DllCommonsvc.exe
File created	C:\Program Files\Windows Media Player\fr-FR\5940a34987c991	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\Skins\5b884080fd4f94	DllCommonsvc.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files\WindowsPowerShell\cmd.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Defender\uk-UA\7a0fd90576e088	DllCommonsvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Boot\Resources\de-DE\services.exe	DllCommonsvc.exe
File created	C:\Windows\WaaS\tasks\Registry.exe	DllCommonsvc.exe
File created	C:\Windows\AppReadiness\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\AppReadiness\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	sihost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5004	schtasks.exe
896	schtasks.exe
3988	schtasks.exe
3524	schtasks.exe
1652	schtasks.exe
2412	schtasks.exe
3964	schtasks.exe
536	schtasks.exe
1192	schtasks.exe
1488	schtasks.exe
4732	schtasks.exe
3300	schtasks.exe
3836	schtasks.exe
2644	schtasks.exe
1820	schtasks.exe
2356	schtasks.exe
2692	schtasks.exe
3248	schtasks.exe
2280	schtasks.exe
4840	schtasks.exe
1952	schtasks.exe
3056	schtasks.exe
4640	schtasks.exe
1340	schtasks.exe
4916	schtasks.exe
224	schtasks.exe
3388	schtasks.exe
2068	schtasks.exe
3548	schtasks.exe
1560	schtasks.exe
2764	schtasks.exe
2024	schtasks.exe
676	schtasks.exe
4140	schtasks.exe
4584	schtasks.exe
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1876	DllCommonsvc.exe
1508	powershell.exe
1508	powershell.exe
4972	powershell.exe
4972	powershell.exe
2824	powershell.exe
2824	powershell.exe
332	powershell.exe
332	powershell.exe
4428	powershell.exe
4428	powershell.exe
3328	powershell.exe
3328	powershell.exe
928	powershell.exe
928	powershell.exe
1936	powershell.exe
1936	powershell.exe
1892	powershell.exe
1892	powershell.exe
2188	powershell.exe
2188	powershell.exe
5060	powershell.exe
5060	powershell.exe
1060	powershell.exe
1060	powershell.exe
4200	powershell.exe
4200	powershell.exe
2188	powershell.exe
2696	sihost.exe
2696	sihost.exe
1508	powershell.exe
4972	powershell.exe
3328	powershell.exe
332	powershell.exe
2824	powershell.exe
1892	powershell.exe
4428	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	DllCommonsvc.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	928	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	1060	powershell.exe
Token: SeDebugPrivilege	2696	sihost.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	676	sihost.exe
Token: SeDebugPrivilege	4664	sihost.exe
Token: SeDebugPrivilege	3196	sihost.exe
Token: SeDebugPrivilege	4640	sihost.exe
Token: SeDebugPrivilege	2640	sihost.exe
Token: SeDebugPrivilege	3648	sihost.exe
Token: SeDebugPrivilege	2300	sihost.exe
Token: SeDebugPrivilege	740	sihost.exe
Token: SeDebugPrivilege	1596	sihost.exe
Token: SeDebugPrivilege	1544	sihost.exe
Token: SeDebugPrivilege	68	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4620	1668	JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe	83
PID 1668 wrote to memory of 4620	1668	JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe	83
PID 1668 wrote to memory of 4620	1668	JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe	83
PID 4620 wrote to memory of 2520	4620	WScript.exe	84
PID 4620 wrote to memory of 2520	4620	WScript.exe	84
PID 4620 wrote to memory of 2520	4620	WScript.exe	84
PID 2520 wrote to memory of 1876	2520	cmd.exe	86
PID 2520 wrote to memory of 1876	2520	cmd.exe	86
PID 1876 wrote to memory of 4200	1876	DllCommonsvc.exe	125
PID 1876 wrote to memory of 4200	1876	DllCommonsvc.exe	125
PID 1876 wrote to memory of 4972	1876	DllCommonsvc.exe	126
PID 1876 wrote to memory of 4972	1876	DllCommonsvc.exe	126
PID 1876 wrote to memory of 1060	1876	DllCommonsvc.exe	127
PID 1876 wrote to memory of 1060	1876	DllCommonsvc.exe	127
PID 1876 wrote to memory of 1936	1876	DllCommonsvc.exe	128
PID 1876 wrote to memory of 1936	1876	DllCommonsvc.exe	128
PID 1876 wrote to memory of 332	1876	DllCommonsvc.exe	129
PID 1876 wrote to memory of 332	1876	DllCommonsvc.exe	129
PID 1876 wrote to memory of 5060	1876	DllCommonsvc.exe	130
PID 1876 wrote to memory of 5060	1876	DllCommonsvc.exe	130
PID 1876 wrote to memory of 3328	1876	DllCommonsvc.exe	131
PID 1876 wrote to memory of 3328	1876	DllCommonsvc.exe	131
PID 1876 wrote to memory of 4428	1876	DllCommonsvc.exe	132
PID 1876 wrote to memory of 4428	1876	DllCommonsvc.exe	132
PID 1876 wrote to memory of 1892	1876	DllCommonsvc.exe	133
PID 1876 wrote to memory of 1892	1876	DllCommonsvc.exe	133
PID 1876 wrote to memory of 2824	1876	DllCommonsvc.exe	134
PID 1876 wrote to memory of 2824	1876	DllCommonsvc.exe	134
PID 1876 wrote to memory of 1508	1876	DllCommonsvc.exe	135
PID 1876 wrote to memory of 1508	1876	DllCommonsvc.exe	135
PID 1876 wrote to memory of 2188	1876	DllCommonsvc.exe	136
PID 1876 wrote to memory of 2188	1876	DllCommonsvc.exe	136
PID 1876 wrote to memory of 928	1876	DllCommonsvc.exe	137
PID 1876 wrote to memory of 928	1876	DllCommonsvc.exe	137
PID 1876 wrote to memory of 2696	1876	DllCommonsvc.exe	151
PID 1876 wrote to memory of 2696	1876	DllCommonsvc.exe	151
PID 2696 wrote to memory of 1544	2696	sihost.exe	160
PID 2696 wrote to memory of 1544	2696	sihost.exe	160
PID 1544 wrote to memory of 1156	1544	cmd.exe	162
PID 1544 wrote to memory of 1156	1544	cmd.exe	162
PID 1544 wrote to memory of 676	1544	cmd.exe	167
PID 1544 wrote to memory of 676	1544	cmd.exe	167
PID 676 wrote to memory of 1564	676	sihost.exe	169
PID 676 wrote to memory of 1564	676	sihost.exe	169
PID 1564 wrote to memory of 3908	1564	cmd.exe	171
PID 1564 wrote to memory of 3908	1564	cmd.exe	171
PID 1564 wrote to memory of 4664	1564	cmd.exe	175
PID 1564 wrote to memory of 4664	1564	cmd.exe	175
PID 4664 wrote to memory of 4496	4664	sihost.exe	178
PID 4664 wrote to memory of 4496	4664	sihost.exe	178
PID 4496 wrote to memory of 1876	4496	cmd.exe	180
PID 4496 wrote to memory of 1876	4496	cmd.exe	180
PID 4496 wrote to memory of 3196	4496	cmd.exe	182
PID 4496 wrote to memory of 3196	4496	cmd.exe	182
PID 3196 wrote to memory of 3328	3196	sihost.exe	184
PID 3196 wrote to memory of 3328	3196	sihost.exe	184
PID 3328 wrote to memory of 1224	3328	cmd.exe	186
PID 3328 wrote to memory of 1224	3328	cmd.exe	186
PID 3328 wrote to memory of 4640	3328	cmd.exe	189
PID 3328 wrote to memory of 4640	3328	cmd.exe	189
PID 4640 wrote to memory of 2764	4640	sihost.exe	191
PID 4640 wrote to memory of 2764	4640	sihost.exe	191
PID 2764 wrote to memory of 3236	2764	cmd.exe	193
PID 2764 wrote to memory of 3236	2764	cmd.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5c2796bbc70bc4979604fec316491d230b4b93115d6c7f0c853c562fc5d4e954.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4972
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppReadiness\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3328
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:928
    - - C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2696
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sSDDfDN1Wn.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:1156
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3908
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:1876
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fcYyv3mAUp.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1224
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3236
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CxpWyGgMb4.bat"
        16⤵
        
        PID:3488
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:4428
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3648
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\45aGjaybPu.bat"
        18⤵
        
        PID:1752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4712
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\76lQa6YaxV.bat"
        20⤵
        
        PID:2344
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:816
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat"
        22⤵
        
        PID:4952
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:1340
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat"
        24⤵
        
        PID:4912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:3668
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"
        26⤵
        
        PID:4328
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:3960
        
        C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe
        
        "C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:68

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\ja-JP\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\AppReadiness\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\uk-UA\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\Gadgets\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\Skins\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft OneDrive\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Microsoft OneDrive\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Public\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Users\Public\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\45aGjaybPu.bat

Filesize
225B

MD5
d9c51b6e6761650d39d2393281003697

SHA1
2cf391f020984fd3aea2dbf090634e4bd41645a8

SHA256
6282d1a9192f39698ef99ab8e16d0b9e6c5bbe7513781b4f8d2603c9a3b6ec87

SHA512
47d31f47791759736c1b54cee87120f7755f694d33db0d8d1d66a7d1514646d7ac47371ccb91f435630ba586d6868e093cffcdfccfafd58d2f0df30cb379a962

Download Submit
C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat

Filesize
225B

MD5
0aa7575b6571f502ca10d3643b31fe1e

SHA1
6062b22ce6c3891ac8c8630dfa7ff8544451f330

SHA256
f3f3a53a8ce5b2e68f131892b3c561138035dc6a8dab10b7a3864464269eed98

SHA512
e0461d10f6d2f933ca81bb0cbc2b4650818d436a2f91d33ab427a76c0938089a1479ce43dfb11d50795f37662aa5e59aa8db0cf9dc34d270e47c7c0fa9b28f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\76lQa6YaxV.bat

Filesize
225B

MD5
d491f63980b411b268cb33c3716f16c3

SHA1
b52118e008662fc408c1ff29101de458e1e08a94

SHA256
6a5213b5c6119da54c7d027f805d02b2c6eb1c91533f8157b247d8ed0851332a

SHA512
31b5f2dc1b3dc4c317f9c43ba9635f42c9cc61632c058b0aba3fbb986930044b576915cbef102cf8559872175a86f594ff8e1dbb5a3f3cecda533407dc99f854

Download Submit
C:\Users\Admin\AppData\Local\Temp\CxpWyGgMb4.bat

Filesize
225B

MD5
d3a3e96dd0bf1c102ed3736e929f9df9

SHA1
1665dd065b3d7ac6df183f8cb7885a2ee972f4e3

SHA256
2ecfce02f2355b962dc9a1984adf8476e1e0c8154ab90bb820785070e5e1a0c9

SHA512
972741fb74fa4f6b76e4991417d1ec3f2f8e083da0e8d6410367dd098821acc5c71ef7f9d137906a48d0ce5df758e3f953c8ccfff3bc2f48f8bb2477d98e8ab8

Download Submit
C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat

Filesize
225B

MD5
25603ab5e433bb250be2fd5985410172

SHA1
40179decaecd7f12392a29ce1bdac299701fa95d

SHA256
6876d7d2c06f843a60d183727f5fe940cca675d4cfe9f3c398e38a67a5a472b4

SHA512
38e786f1b25d54e1d6d7e47407c1a04aa738d431909f4850312c9f09eefad5db950b2348f4c1d538d2ff70f76b0a61ae1289a32663350f62d15fe0ecb64eb3b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oupdpj3XpI.bat

Filesize
225B

MD5
1864670a0e134bb62cdc3038765bb112

SHA1
f635c81215b797e9b51afa70c7355b47bc168944

SHA256
79fb6ecbfaec3a42a1ab21f5d6b54e3be91ff9891aef555aacee58bdf044632d

SHA512
c620599c9cf85aa59ca73d5ecd6eed1ab44309ac0ddd1c6c3bebeddc4998427b4b7c24137e8a1f29f1de0addb6d9ac771c1639aeac86777f2e6e72f3f787382f

Download Submit
C:\Users\Admin\AppData\Local\Temp\YpSpsobUXT.bat

Filesize
225B

MD5
7e1b353a569343c3ebeeb6d9318e40d7

SHA1
034db33fad0e64c3060d90cbad5025b5fb1fb6e4

SHA256
1b5e87de94a2bddc44609464f7a050aae6729c0fa037dd052767fbc7177738c9

SHA512
4bd04683b9714b99404244cccf8552dab7999c71f305062097916ece7731e5e06eef0b5d6033c7b22ce82efa9ab69df8cbdb7c1e38c2d2fd4494cf69ac058e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat

Filesize
225B

MD5
443296dab45e4fd8eb50ee337cdfcaee

SHA1
2bff7ebcce041b21601b81a1d45608e9ac37ee1d

SHA256
d39775ecabee6ad2fcc1a799608b99770d37609cc442d9456618486ada6f5231

SHA512
ab060c74ba300f51288b921395c08c21b347d887b538f5b78771ab999a08bfd831f61a1013374c40c2803c0e31007eb55b2ba393a0d778692db8bda789dfc726

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jftyu1qv.e1j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcYyv3mAUp.bat

Filesize
225B

MD5
0ccd986da617401e462afcaef41cdcb4

SHA1
25ca1f5c49c5bbcca45488788aea672c4afc7911

SHA256
55fcbdd570ec1b34a6e24bfffae85dddf9b400dd91d0d7e71ea4f97a738d52e8

SHA512
03260a64a50a950a02270cefe9e34ed9442737e408ffd3c8314bfb657b31770a0885bd3fc2a862a438e8c361ab1a09967e9b0f390ddfe62e1e8fcf42d8b47221

Download Submit
C:\Users\Admin\AppData\Local\Temp\sSDDfDN1Wn.bat

Filesize
225B

MD5
c0ce074d78ddc2f1ec9aef6982cf04aa

SHA1
bf63452a88dd3cba388225f240d329ee25b414e8

SHA256
8b2b381cbd1023ea6ceeea0469643c958cbd42eff2a2910be324ba1768bf3b19

SHA512
50be311442683fd943ad1ca4cf3808641082a2a7b924a4a39d48a008e03615495f3d9bb27c104292aa755b36d8ce5065b26c7f6e75e8657e5efc414f52803146

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/676-205-0x000000001B090000-0x000000001B0A2000-memory.dmp

Filesize
72KB

Download
memory/676-210-0x000000001BE60000-0x000000001BFCA000-memory.dmp

Filesize
1.4MB

Download
memory/1508-53-0x000001AEBCC80000-0x000001AEBCCA2000-memory.dmp

Filesize
136KB

Download
memory/1876-14-0x0000000001020000-0x0000000001032000-memory.dmp

Filesize
72KB

Download
memory/1876-12-0x00007FFF45453000-0x00007FFF45455000-memory.dmp

Filesize
8KB

Download
memory/1876-13-0x0000000000630000-0x0000000000740000-memory.dmp

Filesize
1.1MB

Download
memory/1876-15-0x0000000002900000-0x000000000290C000-memory.dmp

Filesize
48KB

Download
memory/1876-16-0x00000000028E0000-0x00000000028EC000-memory.dmp

Filesize
48KB

Download
memory/1876-17-0x00000000028F0000-0x00000000028FC000-memory.dmp

Filesize
48KB

Download
memory/2696-158-0x0000000001220000-0x0000000001232000-memory.dmp

Filesize
72KB

Download
memory/3196-220-0x0000000000EF0000-0x0000000000F02000-memory.dmp

Filesize
72KB

Download
memory/3648-240-0x000000001B370000-0x000000001B382000-memory.dmp

Filesize
72KB

Download
memory/4640-227-0x00000000017F0000-0x0000000001802000-memory.dmp

Filesize
72KB

Download
memory/4664-213-0x0000000000C80000-0x0000000000C92000-memory.dmp

Filesize
72KB

Download