Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 00:39

General

  • Target

    JaffaCakes118_6e3669a8b99618a8c690bc516f8694fd8e384d65bb9093540e38e76268830528.exe

  • Size

    1.3MB

  • MD5

    7bef1c792bd992a92335790de3c7174f

  • SHA1

    d933d294739059082693c4895d80b0c2908500b5

  • SHA256

    6e3669a8b99618a8c690bc516f8694fd8e384d65bb9093540e38e76268830528

  • SHA512

    f41438b8dbac80f293e6034ed22b31cff7e43544e5e2d42804d9a0aa923c35796339be9ec20ea2dbf63444bd44212cb25ad302e21031bfd718e240d9dd846b0f

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 27 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e3669a8b99618a8c690bc516f8694fd8e384d65bb9093540e38e76268830528.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e3669a8b99618a8c690bc516f8694fd8e384d65bb9093540e38e76268830528.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3476
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3808
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4240
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Configuration\Schema\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4532
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4708
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3816
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SearchApp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1924
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3136
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2396
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\wininit.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4912
          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3660
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2132
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:3132
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1744
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3856
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:4968
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:208
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUc4JDtx8N.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2704
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:4720
                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4492
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:2888
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:5112
                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:232
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2104
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:2696
                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:4776
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\23CLvB8Ots.bat"
                                            16⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:2828
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              17⤵
                                                PID:1196
                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                                17⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4856
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat"
                                                  18⤵
                                                    PID:4216
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      19⤵
                                                        PID:5064
                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                                        19⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2492
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat"
                                                          20⤵
                                                            PID:2080
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              21⤵
                                                                PID:4428
                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                                                21⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5060
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat"
                                                                  22⤵
                                                                    PID:3872
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      23⤵
                                                                        PID:1860
                                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                                                        23⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2832
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bkUsYtfOrG.bat"
                                                                          24⤵
                                                                            PID:3764
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              25⤵
                                                                                PID:3708
                                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                                                                25⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2104
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lLU0orPlEL.bat"
                                                                                  26⤵
                                                                                    PID:2488
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      27⤵
                                                                                        PID:1436
                                                                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                                                                        27⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2264
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"
                                                                                          28⤵
                                                                                            PID:1368
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              29⤵
                                                                                                PID:456
                                                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe"
                                                                                                29⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3960
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:332
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4976
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Configuration\Schema\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4740
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2496
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1364
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:832
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4880
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4588
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3872
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\providercommon\SearchApp.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2804
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2408
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\providercommon\SearchApp.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2948
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\providercommon\smss.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1656
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4480
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\providercommon\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3496
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3316
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2836
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3812
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4176
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3400
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\OfficeClickToRun.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2188
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\Migration\WTR\smss.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1760
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3896
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\smss.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4852
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\providercommon\wininit.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4512
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3176
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\providercommon\wininit.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4356

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OfficeClickToRun.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        baf55b95da4a601229647f25dad12878

                                        SHA1

                                        abc16954ebfd213733c4493fc1910164d825cac8

                                        SHA256

                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                        SHA512

                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                        SHA1

                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                        SHA256

                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                        SHA512

                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        d28a889fd956d5cb3accfbaf1143eb6f

                                        SHA1

                                        157ba54b365341f8ff06707d996b3635da8446f7

                                        SHA256

                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                        SHA512

                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        2e907f77659a6601fcc408274894da2e

                                        SHA1

                                        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                        SHA256

                                        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                        SHA512

                                        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        59d97011e091004eaffb9816aa0b9abd

                                        SHA1

                                        1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

                                        SHA256

                                        18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

                                        SHA512

                                        d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

                                      • C:\Users\Admin\AppData\Local\Temp\23CLvB8Ots.bat

                                        Filesize

                                        254B

                                        MD5

                                        ae79f8eb1eae33dfa7b31222fd2e76f3

                                        SHA1

                                        8f78d5328eba78b6eb7f3f6901faf4e7fd1094d3

                                        SHA256

                                        7ac227c1bcbda84339a2f6fef3245ffd6dbd69feb617c7887304c1ed68dff725

                                        SHA512

                                        b5a7c0042ece94ce185417f18c7735d3bac6e9d603eedf2890cd6d3aa98254ba281ec0200513c1939ce0100f5167530d9f1721c0e8fc0e86908f1d2aeb719ba2

                                      • C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat

                                        Filesize

                                        254B

                                        MD5

                                        33ccd1b30bdb57bb58c2e5fed7a569f3

                                        SHA1

                                        4796da16d86abbc8ae7a32606950e1cf6b84f3fb

                                        SHA256

                                        f584e02d558ec97aa3b095f3a8d79bb8aa8068a1575227cd8ae97470161f5df7

                                        SHA512

                                        56b28d74e74af2b43f9f9a194d7a15260da6aaa7a60f38facac53f0b9d96e56efa860c24e1326320656163e118f1c2820785ebf4a1983ec2ffcad28484a606e8

                                      • C:\Users\Admin\AppData\Local\Temp\WtQmBjXbDh.bat

                                        Filesize

                                        254B

                                        MD5

                                        62548ff2a22d56c15ed066555a2d07b1

                                        SHA1

                                        f90b8831852b192ca343bb0bc0dc7ee8c3587f62

                                        SHA256

                                        b0c967fd139352e8a613d3488fde4d53c90b98e0030088b55be03d70ae1fd0b9

                                        SHA512

                                        7233bdc1ce8fdf4f735d15fe733a7d3682a7ca29a550fc8cf4b9594d3aa7e60d38ce299b5c7a2ade62f05344b0b2e854e57e7ac373e668cb5ce21d2081bceae8

                                      • C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat

                                        Filesize

                                        254B

                                        MD5

                                        1015934a12e996b595a92d6cc4ba82fe

                                        SHA1

                                        b24bbbde5f115eb581d833d5c02ae126bd71a22c

                                        SHA256

                                        a80e205c0d0f34b8c1dd894d7d56545fd6f6fd38dbfc0e74768f2f94e9f7e1ab

                                        SHA512

                                        8953f86902d5625eb4a80e0c5521978b6d8b7efde0aa5a8e7f44a73cc42f773294e80bb905d4f38d550ef6fc89dba8a00b2b8be8483892e60367cff653af78cd

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q2a0tlms.jku.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Local\Temp\bkUsYtfOrG.bat

                                        Filesize

                                        254B

                                        MD5

                                        e7ff179f6150794547fedb05d1018a28

                                        SHA1

                                        3491431b3ad104c3e7f8eb825ce2551d8dc4d3ab

                                        SHA256

                                        8b48bc2de4610bc3bc526ebafc89c28323543258ca4d4c6635c8f4c17674cf70

                                        SHA512

                                        4cb77e5ce46197a65cf935e3ec7ea4fcf2f2977f6d7519383b404be7461fde0363449991edeb227adfe1233fb9a0d91d35fa27835a3fcaee64a1814b6c9e3b78

                                      • C:\Users\Admin\AppData\Local\Temp\cV1vwDPsky.bat

                                        Filesize

                                        254B

                                        MD5

                                        4bc6f1bb0bc7f824c7ad31dac0561ddb

                                        SHA1

                                        06427deb235a397662ddc5f1f2d454021dfd881f

                                        SHA256

                                        46c112732f51c8a32e2bafea78c19bef46308ada25a504373425799540f47f4d

                                        SHA512

                                        45f38efa1cef28c1294b949fb599122ebf13b48c5b88799112adb18bcd77d9e437d9c591234e254ef9ff4a57b3156c61b060efee66109d23bdb607ec7c5ef8a1

                                      • C:\Users\Admin\AppData\Local\Temp\eXOrkcF5G0.bat

                                        Filesize

                                        254B

                                        MD5

                                        9c0a9d32ec53d89ecb0e053d07db09fd

                                        SHA1

                                        2882837630e03e0fe92d8976e88ab04255e1f767

                                        SHA256

                                        8b24db81c0a2514d686df0677a06a8322147f7c00e173708569c925319181bc8

                                        SHA512

                                        3a09471a63902025290c1a40db301fe2303589f6a31024aff9aebaa09bf281ec50939745d5397f4377c146385036c39b33f1396b66e2a67efc9e02a80a1c91dc

                                      • C:\Users\Admin\AppData\Local\Temp\kUc4JDtx8N.bat

                                        Filesize

                                        254B

                                        MD5

                                        24155e9b504f2fb30cc927019ea76d18

                                        SHA1

                                        8bb0eb78ccdd65d03ddcd1931f7248bfc940625c

                                        SHA256

                                        195e2017c0fd8b5614b4da975a9199882da42d959ef02e0ed9f95c03a79d8a89

                                        SHA512

                                        ca4ef27ce95021b3fabc5befc07f64477c0177ae6df6b7cb51764df350a0f19eb12b5e1cc4685ef2275c4eba7841b08ee31ad5ad656fb617b40e5761e634203a

                                      • C:\Users\Admin\AppData\Local\Temp\lLU0orPlEL.bat

                                        Filesize

                                        254B

                                        MD5

                                        b2650eb1e49617d4059542fb4a705cf2

                                        SHA1

                                        8b5226c17667015bfe8cd24bec4190d26e7f5af4

                                        SHA256

                                        cb181003537b2beb7d48ed562a8f53f4ceccf148d66309dbaedaa81319909a24

                                        SHA512

                                        50d04d996053b7c1d7971d0c2ec477562f69d4415ad9ff11be23bd2462c741fafa4ee9fd36ef9116b4d0cc3f7ea37652656f4f7fc83bf39b49f0fc053a29fe91

                                      • C:\Users\Admin\AppData\Local\Temp\qO35UmqwIy.bat

                                        Filesize

                                        254B

                                        MD5

                                        6cf8ebf358d45cab35d671fc5f943a45

                                        SHA1

                                        024d20ec1af23aec70359b1a2b2fa2af69880b92

                                        SHA256

                                        33cff539804fc243d315d4551f02c202f7a322bd2dd077704fdc0cc4aacede0f

                                        SHA512

                                        3fb76f7fbcf0d65d836bb5d51442d3ae53836f5b67832ac98e55dd202d7021f8859c01990877cb22e804df72de265ffb6f0257c96f3787e1e1a74137407a0c40

                                      • C:\Users\Admin\AppData\Local\Temp\sJ59Arupck.bat

                                        Filesize

                                        254B

                                        MD5

                                        5c6ec532599759e846049ece4fe886d4

                                        SHA1

                                        adb4beb22f8f0312c24b05cc994c27a191bd1d93

                                        SHA256

                                        91f4c2f775b3fe9b5800e273af7a8095087e9fbf1668e60023ffc1b09297c805

                                        SHA512

                                        19a87fa32fe923c0e44a34221fdf92a00152bf227e58d9cfc7ee166d5029f46346a01002adbedea15cf34fb04c64d1730ead4827302a91ae47a3f38a924f2ee8

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/1260-17-0x00000000031A0000-0x00000000031AC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/1260-16-0x0000000003170000-0x000000000317C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/1260-15-0x0000000003190000-0x000000000319C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/1260-14-0x0000000003160000-0x0000000003172000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1260-13-0x0000000000EE0000-0x0000000000FF0000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/1260-12-0x00007FFF25DF3000-0x00007FFF25DF5000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2264-230-0x0000000002980000-0x0000000002992000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2492-205-0x0000000002D50000-0x0000000002D62000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/3660-138-0x0000000002C40000-0x0000000002C52000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4708-47-0x0000022826910000-0x0000022826932000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/4856-198-0x00000000018D0000-0x00000000018E2000-memory.dmp

                                        Filesize

                                        72KB