Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 00:38
Behavioral task
behavioral1
Sample
JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe
-
Size
1.3MB
-
MD5
d9468ae2c998694c7d94edbdbe9e2e26
-
SHA1
ed6b929cb36c3992dbd526c70977c067f2a54966
-
SHA256
79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138
-
SHA512
b2d2078abaf2a2bad4e195afeb9c119a1f177442e4abe3ce6126244af588994b556f9b1703034c027e55cc35976dce3200bdfd362c1cf441fe83c3988a09bbe3
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3812 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2404 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2932 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2976 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2040 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4464 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2236 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4920 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4432 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2024 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3604 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4436 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3340 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3360 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 392 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5100 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3224 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3432 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 452 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1128 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 316 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2164 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 372 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4896 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 1284 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2392 1284 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b97-10.dat dcrat behavioral2/memory/1148-13-0x00000000004A0000-0x00000000005B0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3452 powershell.exe 704 powershell.exe 4364 powershell.exe 1252 powershell.exe 4620 powershell.exe 5044 powershell.exe 1036 powershell.exe 3936 powershell.exe 628 powershell.exe 4792 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Executes dropped EXE 15 IoCs
pid Process 1148 DllCommonsvc.exe 3212 DllCommonsvc.exe 708 DllCommonsvc.exe 2932 DllCommonsvc.exe 2604 DllCommonsvc.exe 4736 DllCommonsvc.exe 1956 DllCommonsvc.exe 2592 DllCommonsvc.exe 4916 DllCommonsvc.exe 1348 DllCommonsvc.exe 1472 DllCommonsvc.exe 2280 DllCommonsvc.exe 3432 DllCommonsvc.exe 4676 DllCommonsvc.exe 4084 DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 39 raw.githubusercontent.com 46 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 15 raw.githubusercontent.com 16 raw.githubusercontent.com 45 raw.githubusercontent.com 50 raw.githubusercontent.com 55 raw.githubusercontent.com 42 raw.githubusercontent.com 25 raw.githubusercontent.com 40 raw.githubusercontent.com 41 raw.githubusercontent.com 56 raw.githubusercontent.com 57 raw.githubusercontent.com -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\images\services.exe DllCommonsvc.exe File opened for modification C:\Program Files\Internet Explorer\images\services.exe DllCommonsvc.exe File created C:\Program Files\Internet Explorer\images\c5b4cb5e9653cc DllCommonsvc.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Containers\serviced\csrss.exe DllCommonsvc.exe File created C:\Windows\Containers\serviced\886983d96e3d3e DllCommonsvc.exe File created C:\Windows\SystemResources\ShellComponents.DragDrop\explorer.exe DllCommonsvc.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe DllCommonsvc.exe File created C:\Windows\Vss\Writers\smss.exe DllCommonsvc.exe File created C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\lsass.exe DllCommonsvc.exe File created C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\6203df4a6bafc7 DllCommonsvc.exe File created C:\Windows\SystemResources\ShellComponents.DragDrop\7a0fd90576e088 DllCommonsvc.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\a76d7bf15d8370 DllCommonsvc.exe File created C:\Windows\Vss\Writers\69ddcba757bf72 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings DllCommonsvc.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2404 schtasks.exe 3432 schtasks.exe 452 schtasks.exe 2392 schtasks.exe 392 schtasks.exe 2976 schtasks.exe 2040 schtasks.exe 4432 schtasks.exe 2024 schtasks.exe 4436 schtasks.exe 2256 schtasks.exe 2932 schtasks.exe 2692 schtasks.exe 3604 schtasks.exe 3340 schtasks.exe 1128 schtasks.exe 3812 schtasks.exe 2236 schtasks.exe 4920 schtasks.exe 3224 schtasks.exe 372 schtasks.exe 4896 schtasks.exe 5100 schtasks.exe 4464 schtasks.exe 3360 schtasks.exe 316 schtasks.exe 2164 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 1148 DllCommonsvc.exe 4620 powershell.exe 4620 powershell.exe 3936 powershell.exe 3936 powershell.exe 1252 powershell.exe 1252 powershell.exe 704 powershell.exe 704 powershell.exe 1036 powershell.exe 1036 powershell.exe 3452 powershell.exe 3452 powershell.exe 4364 powershell.exe 4364 powershell.exe 628 powershell.exe 628 powershell.exe 4792 powershell.exe 4792 powershell.exe 5044 powershell.exe 5044 powershell.exe 3212 DllCommonsvc.exe 3212 DllCommonsvc.exe 5044 powershell.exe 4620 powershell.exe 1252 powershell.exe 3936 powershell.exe 4364 powershell.exe 1036 powershell.exe 628 powershell.exe 704 powershell.exe 3452 powershell.exe 4792 powershell.exe 708 DllCommonsvc.exe 2932 DllCommonsvc.exe 2604 DllCommonsvc.exe 4736 DllCommonsvc.exe 1956 DllCommonsvc.exe 2592 DllCommonsvc.exe 4916 DllCommonsvc.exe 1348 DllCommonsvc.exe 1472 DllCommonsvc.exe 2280 DllCommonsvc.exe 3432 DllCommonsvc.exe 4676 DllCommonsvc.exe 4084 DllCommonsvc.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1148 DllCommonsvc.exe Token: SeDebugPrivilege 4620 powershell.exe Token: SeDebugPrivilege 3936 powershell.exe Token: SeDebugPrivilege 1252 powershell.exe Token: SeDebugPrivilege 628 powershell.exe Token: SeDebugPrivilege 704 powershell.exe Token: SeDebugPrivilege 1036 powershell.exe Token: SeDebugPrivilege 3452 powershell.exe Token: SeDebugPrivilege 4364 powershell.exe Token: SeDebugPrivilege 4792 powershell.exe Token: SeDebugPrivilege 3212 DllCommonsvc.exe Token: SeDebugPrivilege 5044 powershell.exe Token: SeDebugPrivilege 708 DllCommonsvc.exe Token: SeDebugPrivilege 2932 DllCommonsvc.exe Token: SeDebugPrivilege 2604 DllCommonsvc.exe Token: SeDebugPrivilege 4736 DllCommonsvc.exe Token: SeDebugPrivilege 1956 DllCommonsvc.exe Token: SeDebugPrivilege 2592 DllCommonsvc.exe Token: SeDebugPrivilege 4916 DllCommonsvc.exe Token: SeDebugPrivilege 1348 DllCommonsvc.exe Token: SeDebugPrivilege 1472 DllCommonsvc.exe Token: SeDebugPrivilege 2280 DllCommonsvc.exe Token: SeDebugPrivilege 3432 DllCommonsvc.exe Token: SeDebugPrivilege 4676 DllCommonsvc.exe Token: SeDebugPrivilege 4084 DllCommonsvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 784 3692 JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe 82 PID 3692 wrote to memory of 784 3692 JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe 82 PID 3692 wrote to memory of 784 3692 JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe 82 PID 784 wrote to memory of 4588 784 WScript.exe 83 PID 784 wrote to memory of 4588 784 WScript.exe 83 PID 784 wrote to memory of 4588 784 WScript.exe 83 PID 4588 wrote to memory of 1148 4588 cmd.exe 85 PID 4588 wrote to memory of 1148 4588 cmd.exe 85 PID 1148 wrote to memory of 5044 1148 DllCommonsvc.exe 114 PID 1148 wrote to memory of 5044 1148 DllCommonsvc.exe 114 PID 1148 wrote to memory of 3452 1148 DllCommonsvc.exe 115 PID 1148 wrote to memory of 3452 1148 DllCommonsvc.exe 115 PID 1148 wrote to memory of 1036 1148 DllCommonsvc.exe 116 PID 1148 wrote to memory of 1036 1148 DllCommonsvc.exe 116 PID 1148 wrote to memory of 3936 1148 DllCommonsvc.exe 117 PID 1148 wrote to memory of 3936 1148 DllCommonsvc.exe 117 PID 1148 wrote to memory of 628 1148 DllCommonsvc.exe 118 PID 1148 wrote to memory of 628 1148 DllCommonsvc.exe 118 PID 1148 wrote to memory of 4792 1148 DllCommonsvc.exe 119 PID 1148 wrote to memory of 4792 1148 DllCommonsvc.exe 119 PID 1148 wrote to memory of 1252 1148 DllCommonsvc.exe 120 PID 1148 wrote to memory of 1252 1148 DllCommonsvc.exe 120 PID 1148 wrote to memory of 4620 1148 DllCommonsvc.exe 121 PID 1148 wrote to memory of 4620 1148 DllCommonsvc.exe 121 PID 1148 wrote to memory of 704 1148 DllCommonsvc.exe 122 PID 1148 wrote to memory of 704 1148 DllCommonsvc.exe 122 PID 1148 wrote to memory of 4364 1148 DllCommonsvc.exe 123 PID 1148 wrote to memory of 4364 1148 DllCommonsvc.exe 123 PID 1148 wrote to memory of 3212 1148 DllCommonsvc.exe 133 PID 1148 wrote to memory of 3212 1148 DllCommonsvc.exe 133 PID 3212 wrote to memory of 4968 3212 DllCommonsvc.exe 137 PID 3212 wrote to memory of 4968 3212 DllCommonsvc.exe 137 PID 4968 wrote to memory of 1516 4968 cmd.exe 140 PID 4968 wrote to memory of 1516 4968 cmd.exe 140 PID 4968 wrote to memory of 708 4968 cmd.exe 142 PID 4968 wrote to memory of 708 4968 cmd.exe 142 PID 708 wrote to memory of 2240 708 DllCommonsvc.exe 145 PID 708 wrote to memory of 2240 708 DllCommonsvc.exe 145 PID 2240 wrote to memory of 2088 2240 cmd.exe 147 PID 2240 wrote to memory of 2088 2240 cmd.exe 147 PID 2240 wrote to memory of 2932 2240 cmd.exe 148 PID 2240 wrote to memory of 2932 2240 cmd.exe 148 PID 2932 wrote to memory of 4596 2932 DllCommonsvc.exe 151 PID 2932 wrote to memory of 4596 2932 DllCommonsvc.exe 151 PID 4596 wrote to memory of 1064 4596 cmd.exe 153 PID 4596 wrote to memory of 1064 4596 cmd.exe 153 PID 4596 wrote to memory of 2604 4596 cmd.exe 154 PID 4596 wrote to memory of 2604 4596 cmd.exe 154 PID 2604 wrote to memory of 2860 2604 DllCommonsvc.exe 155 PID 2604 wrote to memory of 2860 2604 DllCommonsvc.exe 155 PID 2860 wrote to memory of 636 2860 cmd.exe 157 PID 2860 wrote to memory of 636 2860 cmd.exe 157 PID 2860 wrote to memory of 4736 2860 cmd.exe 158 PID 2860 wrote to memory of 4736 2860 cmd.exe 158 PID 4736 wrote to memory of 1932 4736 DllCommonsvc.exe 159 PID 4736 wrote to memory of 1932 4736 DllCommonsvc.exe 159 PID 1932 wrote to memory of 4444 1932 cmd.exe 161 PID 1932 wrote to memory of 4444 1932 cmd.exe 161 PID 1932 wrote to memory of 1956 1932 cmd.exe 162 PID 1932 wrote to memory of 1956 1932 cmd.exe 162 PID 1956 wrote to memory of 2236 1956 DllCommonsvc.exe 163 PID 1956 wrote to memory of 2236 1956 DllCommonsvc.exe 163 PID 2236 wrote to memory of 4792 2236 cmd.exe 165 PID 2236 wrote to memory of 4792 2236 cmd.exe 165 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79b1493352e30f733c560b0137bad63e4daa67a69b66c5654831dfe94634e138.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Containers\serviced\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemResources\ShellComponents.DragDrop\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1516
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2088
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1064
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\biigBqxW9T.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:636
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\O1BWw2qr2X.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:4444
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cnsnMHUbNI.bat"16⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4792
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5G5G1KH0qy.bat"18⤵PID:2584
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:4572
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vXy3H03RZr.bat"20⤵PID:4592
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:4468
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UxOjVeUiuv.bat"22⤵PID:1276
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:460
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iVopF68B7o.bat"24⤵PID:4848
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:2864
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WzmeI2KvQx.bat"26⤵PID:4964
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:636
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3432 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat"28⤵PID:4892
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:1364
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4676 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDWALPrpmL.bat"30⤵PID:4984
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:4008
-
-
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat"32⤵PID:4932
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:3728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\images\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3812
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\images\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\providercommon\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\providercommon\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\providercommon\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\providercommon\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3360
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\providercommon\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\Vss\Writers\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Windows\Vss\Writers\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\Containers\serviced\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Containers\serviced\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:452
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\Containers\serviced\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\PrintDialog\microsoft.system.package.metadata\Autogen\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemResources\ShellComponents.DragDrop\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\SystemResources\ShellComponents.DragDrop\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\SystemResources\ShellComponents.DragDrop\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
241B
MD5d67fe672c7b3cf29a8552c8696772428
SHA1161ea0eefd421a2949b1ed57ad5766522d2987e5
SHA256896f303ae6c418cb0d3c7058e1d4ba287930b0f47876e3fe5a0614d9530f9680
SHA512390d5c4a077f78564313b19dcbc7de3d3362d7413c9ab601c8041f2bb3778ad934939f8f2a4a9d0c039be93508af98966f10dcbbfe9ce0c66d4236ede28619ee
-
Filesize
241B
MD581cd3862c8880db68b2abf9694273530
SHA13c810bbe106156e20b3ba728a649f9db50174803
SHA2564561f45cabb9dd5ffa5d7ad7f8e713227eefa21a01fc5244acab8b4bc72860c0
SHA512bb844109dd94c43dcc73d67fdca6957e0bb101d78cc675883bd67750406a59e3605a661c3417051aba673329649deaa704397cd2f76316485f605b572d99158a
-
Filesize
241B
MD58b6f9394e2d18219b743e7c63cea16f9
SHA1df1c405082ab62a9ca4ad27f346b197b59dce3d6
SHA2568efa9f329caed8aa13f3aa2e4ad3e531b27f6062b18fa52c733e3d2f363c5c0e
SHA51278f76c0f692018a852f4e3105ac386ddd2eb2b12de2bd47164994375c4856256cb0c4043dd9c90767d87c208c71d32d81cac2a6557d677b970bfdf215a54c89b
-
Filesize
241B
MD5c4d8fd15682107f9d9648e0c98126e09
SHA18fed7807e061dffd9022001d058dff39c0afb292
SHA256b75fa55960469ebf7b8a2bccd13065908431ebfd669ad7c34e3b642df39e3d57
SHA512fd44ec987fd19ae32e427bd80ef7ac120cff3d2dcdc70023ebd9d591d8781048e917cd471e854dc014f208e52045286f33b0dbcd1d44d3f144ba8c0c218cb11f
-
Filesize
241B
MD5dbaf94f0f02f5dbf8ba440f19f37459a
SHA13639c5723f28c6bca1920fcb4da55de937f1542b
SHA25664db02f6f9901a6493d12947a72ca7c3e2a4ca3298ee0144292ec7dab4ddbed6
SHA512d3b3d56c68c4c59262053de25fce1ac54d476b37874f2acc1bd93cb8f582dd968b4c795b0594ca9bab5aea5ab91b8ef33061fad81c84e154453d2e64961f9cba
-
Filesize
241B
MD5b558043a69fe0bfb7379c3eb999cf4ac
SHA19dadcda9bf4a774a798f4aac6c1b7491786e32c6
SHA256f75149a0ea12bf48947dc84dad5d21694bcb37ca5bb59b870d0afcce1359f3f6
SHA512fb18b7edf37429fec2bb8ff97bb29547a47364da31c5ecd91bbb65813c7099f4c5d4b9a4df8553302124f978c85413922dba858b7c505f83297f0a6b7a5fb0c7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
241B
MD5581e725225839ce62bb4055b46da373a
SHA133a0b0cf95c27918259f8364f8f54724b3a7b855
SHA2562b5085c23b6e0324e86896bba325ef893947fe35a807967d509e7d9086225b5e
SHA512c7bad1cf292fc6c08d5f3fe045cacca71bdd61f24b223440e00a1b2f904acdc98b1efbde80c0507bd02329810fa6d65bb804a6ea3fd4e99f1dbede45d9d40c9f
-
Filesize
241B
MD56c12b27c3f8a600f50aae486998ceac1
SHA13266e096f90695e47e6227e414e8a2688ec44d9b
SHA256d0eea40cbd3ff251e52ae9e8cca428f469e80e1a3a2da96873047f7a5fc71f30
SHA512cb8b0530a2586466355c91a06184e368605698740552e573da667ab5e6ff906085d85e66c07742e344f648fb5db71537e052867fa81278107c8eb5bcc63f4b1e
-
Filesize
241B
MD53790dce1a20b1807f5281e51de99c1ab
SHA1c3176defd42522bc918f9561ee65eda422064291
SHA256af2f3c389903cb8a15363a9feca65df0fb2e249168a2c2c86b6a9f970d533836
SHA5122dfb71081ea9c90b4e3bc2b8dd893816ed7ff6ca2b33e0c56c6b9359f98163545b3ab982f88028002dcbde5fdc65392b9b5482d9cb0f672c0a1ee285de69ebda
-
Filesize
241B
MD5ee9de1b2d30c04d3d92d6256636ac98f
SHA1cf195d20cbe62b8636495113f0d8cbb573c7a958
SHA25691f0a3750d56bc8c1c3c76a3fb2a683f4d54a0b0f004cc8db7fd48d5b59d590d
SHA512438c72f06c78ca43ae67dba0492b67019390693ec86ce47ff795eec857fa042b3e4772700a621a436ae1427ff036cadad9664abdcf7e16f602f36d8596961941
-
Filesize
241B
MD596d6020f5479360ef46c63d4b6966062
SHA1fc41b6f55280acaebdab5eb0cf1881dbb84b03b6
SHA256cf7b852d58a879286b76d71e2facb3291e8e44a711c7dfe38d44b9e6fec6bdef
SHA512fad071c9d37d7a856db6a5f3680289a550cf7d9d666dfa0227b7273026a2834c9269d9e9330809c55ce223e4a23f0220eda20699fbf755ff88cec803acb4ade4
-
Filesize
241B
MD54ae138b4cf3b53b91580162e0f67f310
SHA14b62c2b7b6dcef059d44c310d9494b82a1af983d
SHA256c321515c123e1eb80d8720366f757a3ad0c368fd939611a14ba72690a4c5d239
SHA512db6c61cfcd6de3cf1ff5d2dab220eadcb2bcda442f2582c7d73e0aafb9afd305400ad00d9f02ac1945885184b3f3dc0c97f5d25ab2a3ee28b75cd931103ecaef
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478