Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 00:28
Behavioral task
behavioral1
Sample
JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe
-
Size
1.3MB
-
MD5
22abe89f8f3ac704829c29e7197e0fd2
-
SHA1
2913dbf57df2a0c2ab5040e2563daa07026a9b68
-
SHA256
72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a
-
SHA512
58013ec6b158dc0d403e04e790d17093b48361108e2652f74749dcadab86f3f6f92e63443797dc6918019dcde594e98f36eb346dba449d195fd0b5edcfd5fcb9
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 42 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1008 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4204 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2060 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1852 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1364 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4984 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4412 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4996 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2348 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1904 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2464 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2216 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4724 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3840 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2524 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2788 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4236 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4316 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1420 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4508 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1676 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4848 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2096 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1104 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 468 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2272 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1444 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 332 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3748 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1396 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3388 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4324 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1936 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5084 4856 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4284 4856 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0031000000023b7f-10.dat dcrat behavioral2/memory/2936-13-0x0000000000D50000-0x0000000000E60000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4176 powershell.exe 2476 powershell.exe 4992 powershell.exe 3120 powershell.exe 3592 powershell.exe 3100 powershell.exe 2536 powershell.exe 4516 powershell.exe 2228 powershell.exe 1776 powershell.exe 3964 powershell.exe 4828 powershell.exe 1252 powershell.exe 3528 powershell.exe 1348 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation RuntimeBroker.exe -
Executes dropped EXE 14 IoCs
pid Process 2936 DllCommonsvc.exe 3032 RuntimeBroker.exe 2004 RuntimeBroker.exe 972 RuntimeBroker.exe 1388 RuntimeBroker.exe 2172 RuntimeBroker.exe 2320 RuntimeBroker.exe 3208 RuntimeBroker.exe 532 RuntimeBroker.exe 2268 RuntimeBroker.exe 3636 RuntimeBroker.exe 2432 RuntimeBroker.exe 3692 RuntimeBroker.exe 1316 RuntimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 25 raw.githubusercontent.com 42 raw.githubusercontent.com 50 raw.githubusercontent.com 54 raw.githubusercontent.com 16 raw.githubusercontent.com 44 raw.githubusercontent.com 53 raw.githubusercontent.com 24 raw.githubusercontent.com 38 raw.githubusercontent.com 39 raw.githubusercontent.com 52 raw.githubusercontent.com 55 raw.githubusercontent.com 17 raw.githubusercontent.com 45 raw.githubusercontent.com -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\Program Files\Windows Defender\de-DE\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\Accessories\en-US\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Program Files\7-Zip\conhost.exe DllCommonsvc.exe File created C:\Program Files\7-Zip\088424020bedd6 DllCommonsvc.exe File created C:\Program Files\Windows Defender\de-DE\csrss.exe DllCommonsvc.exe File opened for modification C:\Program Files\Windows Defender\de-DE\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\sysmon.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\121e5b5079f7c0 DllCommonsvc.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\DigitalLocker\en-US\sppsvc.exe DllCommonsvc.exe File created C:\Windows\DigitalLocker\en-US\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\taskhostw.exe DllCommonsvc.exe File created C:\Windows\BitLockerDiscoveryVolumeContents\ea9f0e6c9e2dcd DllCommonsvc.exe File created C:\Windows\TAPI\explorer.exe DllCommonsvc.exe File created C:\Windows\TAPI\7a0fd90576e088 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings RuntimeBroker.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3840 schtasks.exe 1444 schtasks.exe 1008 schtasks.exe 1364 schtasks.exe 4724 schtasks.exe 4412 schtasks.exe 4996 schtasks.exe 1904 schtasks.exe 2216 schtasks.exe 1676 schtasks.exe 4204 schtasks.exe 3728 schtasks.exe 2060 schtasks.exe 4048 schtasks.exe 4324 schtasks.exe 532 schtasks.exe 2348 schtasks.exe 2788 schtasks.exe 2040 schtasks.exe 1936 schtasks.exe 1584 schtasks.exe 2464 schtasks.exe 3748 schtasks.exe 1104 schtasks.exe 468 schtasks.exe 2432 schtasks.exe 332 schtasks.exe 1396 schtasks.exe 4236 schtasks.exe 4316 schtasks.exe 2096 schtasks.exe 4984 schtasks.exe 5084 schtasks.exe 4284 schtasks.exe 8 schtasks.exe 1420 schtasks.exe 4848 schtasks.exe 3388 schtasks.exe 2272 schtasks.exe 1852 schtasks.exe 2524 schtasks.exe 4508 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2936 DllCommonsvc.exe 2936 DllCommonsvc.exe 2936 DllCommonsvc.exe 2936 DllCommonsvc.exe 2936 DllCommonsvc.exe 2936 DllCommonsvc.exe 2936 DllCommonsvc.exe 2476 powershell.exe 2476 powershell.exe 3528 powershell.exe 3528 powershell.exe 3592 powershell.exe 3592 powershell.exe 3964 powershell.exe 3964 powershell.exe 1252 powershell.exe 1252 powershell.exe 3120 powershell.exe 3120 powershell.exe 1776 powershell.exe 1776 powershell.exe 4176 powershell.exe 4176 powershell.exe 4828 powershell.exe 3100 powershell.exe 4828 powershell.exe 3100 powershell.exe 2536 powershell.exe 2536 powershell.exe 4516 powershell.exe 4516 powershell.exe 1348 powershell.exe 1348 powershell.exe 2228 powershell.exe 2228 powershell.exe 3964 powershell.exe 4992 powershell.exe 4992 powershell.exe 3120 powershell.exe 2536 powershell.exe 3032 RuntimeBroker.exe 3032 RuntimeBroker.exe 2476 powershell.exe 3528 powershell.exe 1252 powershell.exe 4992 powershell.exe 1776 powershell.exe 3592 powershell.exe 4176 powershell.exe 3100 powershell.exe 4828 powershell.exe 1348 powershell.exe 4516 powershell.exe 2228 powershell.exe 2004 RuntimeBroker.exe 972 RuntimeBroker.exe 1388 RuntimeBroker.exe 2172 RuntimeBroker.exe 2320 RuntimeBroker.exe 3208 RuntimeBroker.exe 532 RuntimeBroker.exe 2268 RuntimeBroker.exe 3636 RuntimeBroker.exe 2432 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 2936 DllCommonsvc.exe Token: SeDebugPrivilege 3964 powershell.exe Token: SeDebugPrivilege 2476 powershell.exe Token: SeDebugPrivilege 3528 powershell.exe Token: SeDebugPrivilege 3592 powershell.exe Token: SeDebugPrivilege 1252 powershell.exe Token: SeDebugPrivilege 3120 powershell.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeDebugPrivilege 4176 powershell.exe Token: SeDebugPrivilege 2228 powershell.exe Token: SeDebugPrivilege 4992 powershell.exe Token: SeDebugPrivilege 2536 powershell.exe Token: SeDebugPrivilege 4828 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 4516 powershell.exe Token: SeDebugPrivilege 1348 powershell.exe Token: SeDebugPrivilege 3032 RuntimeBroker.exe Token: SeDebugPrivilege 2004 RuntimeBroker.exe Token: SeDebugPrivilege 972 RuntimeBroker.exe Token: SeDebugPrivilege 1388 RuntimeBroker.exe Token: SeDebugPrivilege 2172 RuntimeBroker.exe Token: SeDebugPrivilege 2320 RuntimeBroker.exe Token: SeDebugPrivilege 3208 RuntimeBroker.exe Token: SeDebugPrivilege 532 RuntimeBroker.exe Token: SeDebugPrivilege 2268 RuntimeBroker.exe Token: SeDebugPrivilege 3636 RuntimeBroker.exe Token: SeDebugPrivilege 2432 RuntimeBroker.exe Token: SeDebugPrivilege 3692 RuntimeBroker.exe Token: SeDebugPrivilege 1316 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 1684 4456 JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe 82 PID 4456 wrote to memory of 1684 4456 JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe 82 PID 4456 wrote to memory of 1684 4456 JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe 82 PID 1684 wrote to memory of 4576 1684 WScript.exe 83 PID 1684 wrote to memory of 4576 1684 WScript.exe 83 PID 1684 wrote to memory of 4576 1684 WScript.exe 83 PID 4576 wrote to memory of 2936 4576 cmd.exe 85 PID 4576 wrote to memory of 2936 4576 cmd.exe 85 PID 2936 wrote to memory of 4516 2936 DllCommonsvc.exe 129 PID 2936 wrote to memory of 4516 2936 DllCommonsvc.exe 129 PID 2936 wrote to memory of 4176 2936 DllCommonsvc.exe 130 PID 2936 wrote to memory of 4176 2936 DllCommonsvc.exe 130 PID 2936 wrote to memory of 1252 2936 DllCommonsvc.exe 131 PID 2936 wrote to memory of 1252 2936 DllCommonsvc.exe 131 PID 2936 wrote to memory of 2228 2936 DllCommonsvc.exe 132 PID 2936 wrote to memory of 2228 2936 DllCommonsvc.exe 132 PID 2936 wrote to memory of 2476 2936 DllCommonsvc.exe 133 PID 2936 wrote to memory of 2476 2936 DllCommonsvc.exe 133 PID 2936 wrote to memory of 1776 2936 DllCommonsvc.exe 134 PID 2936 wrote to memory of 1776 2936 DllCommonsvc.exe 134 PID 2936 wrote to memory of 3528 2936 DllCommonsvc.exe 135 PID 2936 wrote to memory of 3528 2936 DllCommonsvc.exe 135 PID 2936 wrote to memory of 3964 2936 DllCommonsvc.exe 136 PID 2936 wrote to memory of 3964 2936 DllCommonsvc.exe 136 PID 2936 wrote to memory of 4828 2936 DllCommonsvc.exe 137 PID 2936 wrote to memory of 4828 2936 DllCommonsvc.exe 137 PID 2936 wrote to memory of 3120 2936 DllCommonsvc.exe 138 PID 2936 wrote to memory of 3120 2936 DllCommonsvc.exe 138 PID 2936 wrote to memory of 3592 2936 DllCommonsvc.exe 139 PID 2936 wrote to memory of 3592 2936 DllCommonsvc.exe 139 PID 2936 wrote to memory of 3100 2936 DllCommonsvc.exe 140 PID 2936 wrote to memory of 3100 2936 DllCommonsvc.exe 140 PID 2936 wrote to memory of 2536 2936 DllCommonsvc.exe 141 PID 2936 wrote to memory of 2536 2936 DllCommonsvc.exe 141 PID 2936 wrote to memory of 1348 2936 DllCommonsvc.exe 142 PID 2936 wrote to memory of 1348 2936 DllCommonsvc.exe 142 PID 2936 wrote to memory of 4992 2936 DllCommonsvc.exe 143 PID 2936 wrote to memory of 4992 2936 DllCommonsvc.exe 143 PID 2936 wrote to memory of 3032 2936 DllCommonsvc.exe 158 PID 2936 wrote to memory of 3032 2936 DllCommonsvc.exe 158 PID 3032 wrote to memory of 332 3032 RuntimeBroker.exe 164 PID 3032 wrote to memory of 332 3032 RuntimeBroker.exe 164 PID 332 wrote to memory of 2896 332 cmd.exe 166 PID 332 wrote to memory of 2896 332 cmd.exe 166 PID 332 wrote to memory of 2004 332 cmd.exe 169 PID 332 wrote to memory of 2004 332 cmd.exe 169 PID 2004 wrote to memory of 4200 2004 RuntimeBroker.exe 170 PID 2004 wrote to memory of 4200 2004 RuntimeBroker.exe 170 PID 4200 wrote to memory of 404 4200 cmd.exe 172 PID 4200 wrote to memory of 404 4200 cmd.exe 172 PID 4200 wrote to memory of 972 4200 cmd.exe 173 PID 4200 wrote to memory of 972 4200 cmd.exe 173 PID 972 wrote to memory of 2376 972 RuntimeBroker.exe 174 PID 972 wrote to memory of 2376 972 RuntimeBroker.exe 174 PID 2376 wrote to memory of 4176 2376 cmd.exe 176 PID 2376 wrote to memory of 4176 2376 cmd.exe 176 PID 2376 wrote to memory of 1388 2376 cmd.exe 178 PID 2376 wrote to memory of 1388 2376 cmd.exe 178 PID 1388 wrote to memory of 440 1388 RuntimeBroker.exe 180 PID 1388 wrote to memory of 440 1388 RuntimeBroker.exe 180 PID 440 wrote to memory of 1752 440 cmd.exe 182 PID 440 wrote to memory of 1752 440 cmd.exe 182 PID 440 wrote to memory of 2172 440 cmd.exe 183 PID 440 wrote to memory of 2172 440 cmd.exe 183 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_72bfa5b5d6eca3e0eff61f3aba597749c3ea4fa180d6d6de14b92b8d505cfe1a.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Links\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\BitLockerDiscoveryVolumeContents\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\conhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\PrintHood\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Pictures\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7C7JiPLtAl.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:2896
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sQQ1IAg9p0.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:404
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4176
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:1752
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat"14⤵PID:4508
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4436
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oYNvu0ZNBR.bat"16⤵PID:1040
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:1212
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vXy3H03RZr.bat"18⤵PID:4536
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:4580
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:532 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DFgOOKl5EO.bat"20⤵PID:3108
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5104
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\IycQG8Pfyu.bat"22⤵PID:4784
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:4464
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WzmeI2KvQx.bat"24⤵PID:516
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:4036
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hevtjRcN1r.bat"26⤵PID:440
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:3588
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3692 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7C7JiPLtAl.bat"28⤵PID:2684
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:2600
-
-
C:\Users\Public\RuntimeBroker.exe"C:\Users\Public\RuntimeBroker.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1316 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"30⤵PID:4216
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:4260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Defender\de-DE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\de-DE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Links\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Links\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Links\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\en-US\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Admin\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\7-Zip\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Users\Default\PrintHood\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\TAPI\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\TAPI\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Pictures\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3388
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default\Pictures\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Pictures\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD56c47b3f4e68eebd47e9332eebfd2dd4e
SHA167f0b143336d7db7b281ed3de5e877fa87261834
SHA2568c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA5120acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
198B
MD5b7d6acbb8521fc240d70aba19f392e61
SHA1f9fecb565fa2d179acf837b493e1c33ca82d27d1
SHA2566254edb730043eece7f671e3679be6aac7a8360df34d006f4bc8eeba78dd8edf
SHA5125850631d94053fdcce1dad273fd12ebfba29eb5952bdd5a829e0f3b67c48d5541a02e9aca66b370f1ffc7df13ddbaa0dba3125b2a84b9bb5d0b52618f96bdbf5
-
Filesize
198B
MD58e6dca93241de0eab140f54629a08268
SHA11060c3986aed2f06057e4e00a1a609adfd8e9e98
SHA256a9e759882b63253379ffd00c0700de0220d0371a89b569f47a0977b34c2780a4
SHA5129aef829a08af6e9b5160b245d322ad96c89cb2984b743e2fb4a82d30b58211c78af9310e8270177539cd9dbb5ad100911fb29ea2e8cc375b3c209c76746f9883
-
Filesize
198B
MD5e04d10960f10576ade164a5fd909923d
SHA12e6f0a79892e7c17bca71b499829741e8d0dae19
SHA25605fd52179c1f8aa7f103a3d6bba0c7c215d1b2b364d4afb295c935fd962ed7b5
SHA5123842788077c4606da318ff71f84fde804e79508a7f682c9e7ee8cc72b8aa4c4a2e6891c743ca4c74756cb2a34e902057c5775cd512bf569c6fb4feaaebfd8c96
-
Filesize
198B
MD54d9997b2f4669e604b4d5dfd1680fb56
SHA1055413f236044c6d4098d3ba73d0e948711bcdb3
SHA256bc8df84677a09368139af0260b82e59873405347848debfda77b089b12c28a75
SHA5123752e467b930979312cc6cd777807b28edb0e001c646c14db7748afe6337b0285e124800cec1c4f5e367c26fc1226fdaae272cdd5afc79790e7ca168ba80b297
-
Filesize
198B
MD50010f2f2316b82cb5a8bb9d2f1609784
SHA1c3961eb38ab7cf0b0825d4d4f58b8b4437403b74
SHA2561a0539fdcd74caafcba9c011d80af0d7da1e482972ccbb3408d0aa5e456e48fb
SHA51287fe16d9a23f8edc5fb0b8f0fbd40f0c684bfd1944848c0c86b77c110df023f36fb047ccc57711aaaf3ff72a4a3dc7b43ef12a2a57fc6982d967792664e01896
-
Filesize
198B
MD5fb316ea889c59832c20f4c79aadb0c21
SHA136fd9df9fdec94eb3aee9e5f7d10d046c3bda7ed
SHA256887f23310f27a3e0affec6140354ec1491443c8d0ee711937830678be14a2bd7
SHA512777caa52e707a790fc707104f5091593f093f19655f26e38682fbe81089ef93a25220b2c37feeff39211a036276e197475c601e54135d0b123a561a44ec14862
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
198B
MD5345f206976b1bb17411421aecf058ae4
SHA17b0c93692d6a64eaf5e9eec58a0b8c6df4b3124f
SHA2566c43189e0b146ca839e9a5f239d0992ca937bc413cd2434d99f6203f3c3a955d
SHA51202a9906914a24d9db01080a20ff6c2ed51e4b4fe501896aed1a5f6c82e82f59a8d3828922ccf72f81a4c86df3064363f7de7e4400d8a3d155e49c9ad464b2ef0
-
Filesize
198B
MD5a2712cb36d2fdf641ff3752359b94990
SHA182ea981b2867e69c45c94652192ebc82a36d35e3
SHA256f5c9b730b31552da202902d568fbe00350194b021d019156454491bb34da3b8d
SHA512faf4418af1248dad996913e534d30e29a2ba843e8e5d8da48082596ac561479827a6fe11a36764dc1c767925d79522b3c43f785051e67f4012a7a020b16ebc0f
-
Filesize
198B
MD5684a6f80fd7954ade7a0e19d5e7ec079
SHA11906a6cc44dba653254dd4a6c759e8cfb7dad02c
SHA256189c0f0dc5e8e0a0657c1bb0bc3d7955683bed02231537a655cd16a48adfaaf6
SHA512d74ea7eb68d1f63a6dff4ae5a6c149f0956f6a373c0a435f2077efe4127b2e5c3eb5be269d5240002d0a23153c5710fbb828d367d05dbea8bcfb57ba26ef5294
-
Filesize
198B
MD5606ccb36cd7e56e8494af614f13fae49
SHA146ffe7e7243df29a567db3fe6ba97bea45f5c621
SHA25646ed1c493b188ed8d073133a7f172628ed2e39491c9283897ab6b09cda00633b
SHA5126e99c0ec55c2f5232feb6f2e43521111ad9686ace0a046ae89f20b57c278f2291b1c29a9eaa912a974f00741befbc8911cdcbaa1e2b9ce60c3461eef51add79f
-
Filesize
198B
MD54ea3d1a7f1125a2a32c85db396dcad33
SHA1700efcc6cc56091d0609b5a0d9fa3e16937fce19
SHA25664377973453c75863ab6fd4578ae09855f2d3d1b94d7da40c1c414b083e0a8f6
SHA512e66d4a740641b25de81314622fe79537a07a795193d3a33330b8fd46b174e0dbab1313e6d2aa18f4b9f0153e1574ed7d121b0146f60a14d3194b7be4baa59032
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478