Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 01:40

General

  • Target

    JaffaCakes118_bd8b6811e7951c4fef58c44893deb3d759eee13df58f9c4264894f9680e0ed7e.exe

  • Size

    1.3MB

  • MD5

    c3c35789f8cc2f6b412be9f5cc493cdc

  • SHA1

    89e42ca9727da8194c0824bdd0e8831a471a3b3e

  • SHA256

    bd8b6811e7951c4fef58c44893deb3d759eee13df58f9c4264894f9680e0ed7e

  • SHA512

    0863fb196501ee9f29169199fd3eafaef2176e34b0796c18960eed9b2e8553ed0777034eb107421fd3b91d9aeeb43455893ed2d0c9486e09d8098ba25eb17ebc

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 33 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Drops file in Program Files directory 16 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd8b6811e7951c4fef58c44893deb3d759eee13df58f9c4264894f9680e0ed7e.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd8b6811e7951c4fef58c44893deb3d759eee13df58f9c4264894f9680e0ed7e.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3848
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3480
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\dllhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\es-ES\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:5012
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2208
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4544
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\explorer.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2372
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3496
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3484
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\StartMenuExperienceHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4184
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4272
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dwm.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2136
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CB83hCeehX.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1208
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1624
              • C:\Program Files\Uninstall Information\conhost.exe
                "C:\Program Files\Uninstall Information\conhost.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4568
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4500
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:3976
                    • C:\Program Files\Uninstall Information\conhost.exe
                      "C:\Program Files\Uninstall Information\conhost.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1144
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6raUEgr1vJ.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:64
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:2724
                          • C:\Program Files\Uninstall Information\conhost.exe
                            "C:\Program Files\Uninstall Information\conhost.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4416
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\826UXRAQMN.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1416
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:1292
                                • C:\Program Files\Uninstall Information\conhost.exe
                                  "C:\Program Files\Uninstall Information\conhost.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2284
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:4456
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:1784
                                      • C:\Program Files\Uninstall Information\conhost.exe
                                        "C:\Program Files\Uninstall Information\conhost.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:3488
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat"
                                          15⤵
                                            PID:3428
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              16⤵
                                                PID:640
                                              • C:\Program Files\Uninstall Information\conhost.exe
                                                "C:\Program Files\Uninstall Information\conhost.exe"
                                                16⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3280
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fZs2sOO0th.bat"
                                                  17⤵
                                                    PID:1308
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      18⤵
                                                        PID:4696
                                                      • C:\Program Files\Uninstall Information\conhost.exe
                                                        "C:\Program Files\Uninstall Information\conhost.exe"
                                                        18⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3592
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat"
                                                          19⤵
                                                            PID:404
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              20⤵
                                                                PID:4712
                                                              • C:\Program Files\Uninstall Information\conhost.exe
                                                                "C:\Program Files\Uninstall Information\conhost.exe"
                                                                20⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4428
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RnBkS9jGYw.bat"
                                                                  21⤵
                                                                    PID:916
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      22⤵
                                                                        PID:4408
                                                                      • C:\Program Files\Uninstall Information\conhost.exe
                                                                        "C:\Program Files\Uninstall Information\conhost.exe"
                                                                        22⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3864
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat"
                                                                          23⤵
                                                                            PID:860
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              24⤵
                                                                                PID:324
                                                                              • C:\Program Files\Uninstall Information\conhost.exe
                                                                                "C:\Program Files\Uninstall Information\conhost.exe"
                                                                                24⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1996
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat"
                                                                                  25⤵
                                                                                    PID:2884
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      26⤵
                                                                                        PID:1156
                                                                                      • C:\Program Files\Uninstall Information\conhost.exe
                                                                                        "C:\Program Files\Uninstall Information\conhost.exe"
                                                                                        26⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:3032
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2304
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4848
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2636
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Windows\Resources\dllhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:5032
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Resources\dllhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4696
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\dllhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2240
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\DllCommonsvc.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1676
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\DllCommonsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1888
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\DllCommonsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2616
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4540
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:324
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\SIGNUP\conhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3056
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\explorer.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3624
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1624
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2488
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Gadgets\explorer.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3864
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2508
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Sidebar\Gadgets\explorer.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4412
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\DllCommonsvc.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1268
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\DllCommonsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:956
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\DllCommonsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4932
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2708
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2328
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\conhost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4660
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\StartMenuExperienceHost.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4664
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1064
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\StartMenuExperienceHost.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1952
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1944
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:464
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:692
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2756
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2332
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\dwm.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4108

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                      Filesize

                                      1KB

                                      MD5

                                      baf55b95da4a601229647f25dad12878

                                      SHA1

                                      abc16954ebfd213733c4493fc1910164d825cac8

                                      SHA256

                                      ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                      SHA512

                                      24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      d85ba6ff808d9e5444a4b369f5bc2730

                                      SHA1

                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                      SHA256

                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                      SHA512

                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      77d622bb1a5b250869a3238b9bc1402b

                                      SHA1

                                      d47f4003c2554b9dfc4c16f22460b331886b191b

                                      SHA256

                                      f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                      SHA512

                                      d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      3a6bad9528f8e23fb5c77fbd81fa28e8

                                      SHA1

                                      f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                      SHA256

                                      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                      SHA512

                                      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      bd5940f08d0be56e65e5f2aaf47c538e

                                      SHA1

                                      d7e31b87866e5e383ab5499da64aba50f03e8443

                                      SHA256

                                      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                                      SHA512

                                      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      2e907f77659a6601fcc408274894da2e

                                      SHA1

                                      9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                      SHA256

                                      385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                      SHA512

                                      34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                    • C:\Users\Admin\AppData\Local\Temp\6raUEgr1vJ.bat

                                      Filesize

                                      215B

                                      MD5

                                      57dfd36de72f43fc3e4ae32532b55058

                                      SHA1

                                      7f341d124c6a24df81bba95c96d6a6ce1697a167

                                      SHA256

                                      fad44c4c75e26b65bddd14884a4be83e9246578cadd947396681d9997fa965dd

                                      SHA512

                                      7f22ac629b60fbc7669794d74fe96d63ceafe8fb48390d0f245d85a213fed631a15049da03e5f251ee881ffde91c9b250098bb48334c54e8a9de8a71cfe719a7

                                    • C:\Users\Admin\AppData\Local\Temp\826UXRAQMN.bat

                                      Filesize

                                      215B

                                      MD5

                                      ffdd92e5f3491cce8697338b9b65b6be

                                      SHA1

                                      2b0c0413d1613a6e34c3381572d93e0397372120

                                      SHA256

                                      1a9565c473b97652ea3104f3afa830639fd41e572f80ba9e455fbffdcb0c8d90

                                      SHA512

                                      49f2a0ee41935d1c536e27c88e3f6f79cb6678323f6f34e6b3da60890bfa1b1c4782ad8c458904cedbb2a78a20bbdbe42fe5d1aba48278d55d91dd636def41de

                                    • C:\Users\Admin\AppData\Local\Temp\CB83hCeehX.bat

                                      Filesize

                                      215B

                                      MD5

                                      d77f9d3ebf7b50c4a791b9f3b10bcf8a

                                      SHA1

                                      bd6c845c341941e7f9c8ef5731a908051d90a662

                                      SHA256

                                      22d07e6ad3e49db5fc1d152f9ac97adfea50dde96f96ac4ed18994bf4fea24db

                                      SHA512

                                      399a84ed314d68c65699eb4de008df5f45fddf988f4149d7df50417698ed936dfb7154360aa888c2eead486ba6d35ccb2bd02cc54c35309a737a776211250acc

                                    • C:\Users\Admin\AppData\Local\Temp\GsZYO5BIqk.bat

                                      Filesize

                                      215B

                                      MD5

                                      0a8fb94f9e89aaa3fcc6d634eaa72409

                                      SHA1

                                      6ad6a5daf17750250a8404377553e6d8c0c207bf

                                      SHA256

                                      a00c7bd5a07b65e53643543d0207e2b25db13f13f904b0b7fd60fddf492956c7

                                      SHA512

                                      0d26e1a41498169a9092e3cca779ceeb717add685bbac3a4d6d6d6d91fff75f6c611c2227f81139206e5f6246e12d82502fc4eedfaf6f0c9b442e5f889c93536

                                    • C:\Users\Admin\AppData\Local\Temp\RnBkS9jGYw.bat

                                      Filesize

                                      215B

                                      MD5

                                      7f048eeb911aafbed5feb023af5ed9fb

                                      SHA1

                                      33796bc2522d2459b831986fd71ea2a6c8204caf

                                      SHA256

                                      79fa799823d90a5e08e9f4984e405525472c1554c1110d02dc8930006edeef61

                                      SHA512

                                      c9fd4abb840f48004e36045d2f23017801ce02da5de4b80e1aff9ee78c6f3eda59f027bb9adb201bf78bc93154a7047275e5be03260aded9f4311ff545a4a124

                                    • C:\Users\Admin\AppData\Local\Temp\VeFqpJq3BV.bat

                                      Filesize

                                      215B

                                      MD5

                                      ad36064ca0f6dd393c9d68241d02e33c

                                      SHA1

                                      eae697c4dc6e3ae666159c44d4d66eaa3f47671e

                                      SHA256

                                      6ede65280d89beceab3d2b6fd21ed4fc27015ba5dfef6665bee053adf40ea8eb

                                      SHA512

                                      977b51a188829d380af94cb3f53dfd48e312bfc9bce66ef5be5b5a2cf172ec83af405090e3dd7abc4f24f004478c7af1e3b1b9491cd298cf3c588ef4ab640b93

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1nwbxdis.kpu.ps1

                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    • C:\Users\Admin\AppData\Local\Temp\bhowVEGEG8.bat

                                      Filesize

                                      215B

                                      MD5

                                      016df12cc12537c6c5503e4fcf550388

                                      SHA1

                                      2b3dfd73b08028d028b1cce3acaf82c2be80390a

                                      SHA256

                                      03da3d1cb641f951d7a284d053e2bf7631edeb5055986b5c7bc3a59de437bd1f

                                      SHA512

                                      778a48cae1f64f43bf8276d0d83df75a10613d0867539a8fd8d14bc0a3287d53d900e4deffa1c082835a6052c47f6edd11ec6003057ace98ae0c5cf4854232d2

                                    • C:\Users\Admin\AppData\Local\Temp\fZs2sOO0th.bat

                                      Filesize

                                      215B

                                      MD5

                                      9c8e6d7b5ae4efb8663afeb062c1d7bd

                                      SHA1

                                      7ca3f0daef35e0aea2b4f425710c5efcef5c6421

                                      SHA256

                                      8a26d95f9699c2d48f8c57da14949beac5d78e0d7c0b2bd0ffa3317cd3216148

                                      SHA512

                                      27a2c74b19599eccaefedfe325fee302a1bae78b5d2d21eb179dccc5d1dba93f84596fd79d4071fec4ffa31d965f2c5953bf9f44d9e171e3592863657b738dd5

                                    • C:\Users\Admin\AppData\Local\Temp\p9sA7N8NGm.bat

                                      Filesize

                                      215B

                                      MD5

                                      c86a559167cebfea73e6bc200531aa16

                                      SHA1

                                      3ae90b2a08deb339ae746ef35560fe3d61939894

                                      SHA256

                                      4b7087ed6c71e198096e69648df53536ed3eb1a1ff9fb2752425b84aa6da54a6

                                      SHA512

                                      f4960e2e86559e603af690f20597649ce1e32f9924c29354e1912f09e8139a13f5f7a97b5dcdda5e9db73ee316f386680aaed16980b5ce5fd09434d9b4089176

                                    • C:\Users\Admin\AppData\Local\Temp\x8TIUMdSeB.bat

                                      Filesize

                                      215B

                                      MD5

                                      1d1a468efc24f6a4322b5195ea0192bf

                                      SHA1

                                      208a8a82fb42b1a09f8e06c2dd7342aeb65d1eee

                                      SHA256

                                      97356e617b78e98795f271c262b8ffb87232d1cb79bf708fb8dc354f70cae181

                                      SHA512

                                      1be66c1efabfed99ee13aba07d2bd644d26dc5a6ff64f72d5b8602802323603bc4000a2f441c01f649ac55b6ae5cbfce619c721946ab7aeca2a7c883df5bcdc0

                                    • C:\Users\Admin\AppData\Local\Temp\zDcPfnAXs0.bat

                                      Filesize

                                      215B

                                      MD5

                                      bf7a19028945e9240558be310c91d797

                                      SHA1

                                      dcaba85fd2379d53092275bf2e8944665611a6d4

                                      SHA256

                                      b21eda385ece66435f35464cad3055c80be8aa8e33ab3fe52aa371d5a7de87f6

                                      SHA512

                                      22b95ed44cab34b3638d20c8e67b574edfa0cbfb7f5b2822d75551b052c62d92f43c864ca3c5f6e3eb74ccc742caf41a8e201bc002acd755f420f410cecddfbf

                                    • C:\providercommon\1zu9dW.bat

                                      Filesize

                                      36B

                                      MD5

                                      6783c3ee07c7d151ceac57f1f9c8bed7

                                      SHA1

                                      17468f98f95bf504cc1f83c49e49a78526b3ea03

                                      SHA256

                                      8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                      SHA512

                                      c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                    • C:\providercommon\DllCommonsvc.exe

                                      Filesize

                                      1.0MB

                                      MD5

                                      bd31e94b4143c4ce49c17d3af46bcad0

                                      SHA1

                                      f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                      SHA256

                                      b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                      SHA512

                                      f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                    • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                      Filesize

                                      197B

                                      MD5

                                      8088241160261560a02c84025d107592

                                      SHA1

                                      083121f7027557570994c9fc211df61730455bb5

                                      SHA256

                                      2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                      SHA512

                                      20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                    • memory/2244-12-0x00007FFF30333000-0x00007FFF30335000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/2244-17-0x0000000003130000-0x000000000313C000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/2244-13-0x0000000000DE0000-0x0000000000EF0000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2244-14-0x00000000030F0000-0x0000000003102000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/2244-15-0x0000000003140000-0x000000000314C000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/2244-16-0x0000000003120000-0x000000000312C000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/2284-204-0x0000000001000000-0x0000000001012000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/3592-223-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/4544-55-0x00000197F2C00000-0x00000197F2C22000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/4568-183-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

                                      Filesize

                                      72KB