dcrat | dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe
Size

1.3MB
MD5

f881b76d06402dcf78ca64540da3d9f6
SHA1

ace8988ea925758dacbb0a2bb135f2a0c994c890
SHA256

dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc
SHA512

d60449ab08172e4bff713be4add0f04746f79a24662a3a3cc717a138b7bb2ddd93cd4ae401cfbdc311f1f6784811944bb6f0306cf089924c569a057565137fdc
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1468	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	944	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3108	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4712	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4260	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3448	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1408	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5000	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4952	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2472	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4280	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3924	4864	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4864	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c92-10.dat	dcrat
behavioral2/memory/1456-13-0x00000000002B0000-0x00000000003C0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3844	powershell.exe
3968	powershell.exe
4724	powershell.exe
1084	powershell.exe
4504	powershell.exe
4912	powershell.exe
1460	powershell.exe
4024	powershell.exe
5052	powershell.exe
3176	powershell.exe
1348	powershell.exe
3128	powershell.exe
4636	powershell.exe
1784	powershell.exe
1864	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Registry.exe

Executes dropped EXE 16 IoCs

pid	Process
1456	DllCommonsvc.exe
2052	Registry.exe
4608	Registry.exe
3204	Registry.exe
2548	Registry.exe
2748	Registry.exe
720	Registry.exe
3660	Registry.exe
4612	Registry.exe
3476	Registry.exe
1000	Registry.exe
4988	Registry.exe
2304	Registry.exe
3156	Registry.exe
3220	Registry.exe
4896	Registry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
40	raw.githubusercontent.com
47	raw.githubusercontent.com
17	raw.githubusercontent.com
25	raw.githubusercontent.com
44	raw.githubusercontent.com
45	raw.githubusercontent.com
46	raw.githubusercontent.com
54	raw.githubusercontent.com
39	raw.githubusercontent.com
41	raw.githubusercontent.com
55	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com
57	raw.githubusercontent.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe	DllCommonsvc.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\55b276f4edf653	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\taskhostw.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Google\Temp\ea9f0e6c9e2dcd	DllCommonsvc.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SKB\LanguageModels\ee2ad38f3d4382	DllCommonsvc.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe	DllCommonsvc.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\29c1c3cc0f7685	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\TextInputHost.exe	DllCommonsvc.exe
File created	C:\Windows\DigitalLocker\en-US\22eafd247d37c3	DllCommonsvc.exe
File created	C:\Windows\CSC\services.exe	DllCommonsvc.exe
File created	C:\Windows\SKB\LanguageModels\Registry.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Registry.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2392	schtasks.exe
856	schtasks.exe
5040	schtasks.exe
4036	schtasks.exe
2368	schtasks.exe
2328	schtasks.exe
4108	schtasks.exe
3432	schtasks.exe
4696	schtasks.exe
4976	schtasks.exe
4012	schtasks.exe
2172	schtasks.exe
4448	schtasks.exe
5000	schtasks.exe
4776	schtasks.exe
2472	schtasks.exe
3924	schtasks.exe
4296	schtasks.exe
1732	schtasks.exe
2400	schtasks.exe
3676	schtasks.exe
1852	schtasks.exe
4676	schtasks.exe
696	schtasks.exe
3108	schtasks.exe
4960	schtasks.exe
4680	schtasks.exe
944	schtasks.exe
4712	schtasks.exe
224	schtasks.exe
376	schtasks.exe
4260	schtasks.exe
3448	schtasks.exe
1160	schtasks.exe
4952	schtasks.exe
1336	schtasks.exe
4280	schtasks.exe
1468	schtasks.exe
3032	schtasks.exe
868	schtasks.exe
5008	schtasks.exe
1408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1456	DllCommonsvc.exe
1784	powershell.exe
1784	powershell.exe
4724	powershell.exe
4724	powershell.exe
3176	powershell.exe
3176	powershell.exe
4504	powershell.exe
4504	powershell.exe
3128	powershell.exe
3128	powershell.exe
3844	powershell.exe
3844	powershell.exe
5052	powershell.exe
5052	powershell.exe
4024	powershell.exe
4024	powershell.exe
1460	powershell.exe
1460	powershell.exe
1348	powershell.exe
1348	powershell.exe
3968	powershell.exe
3968	powershell.exe
4912	powershell.exe
4912	powershell.exe
4636	powershell.exe
4636	powershell.exe
1864	powershell.exe
1864	powershell.exe
1084	powershell.exe
1084	powershell.exe
4912	powershell.exe
1084	powershell.exe
1784	powershell.exe
1784	powershell.exe
4724	powershell.exe
4724	powershell.exe
5052	powershell.exe
1348	powershell.exe
4504	powershell.exe
3176	powershell.exe
1864	powershell.exe
3844	powershell.exe
3968	powershell.exe
3128	powershell.exe
4024	powershell.exe
1460	powershell.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	DllCommonsvc.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1348	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4636	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2052	Registry.exe
Token: SeDebugPrivilege	4608	Registry.exe
Token: SeDebugPrivilege	3204	Registry.exe
Token: SeDebugPrivilege	2548	Registry.exe
Token: SeDebugPrivilege	2748	Registry.exe
Token: SeDebugPrivilege	720	Registry.exe
Token: SeDebugPrivilege	3660	Registry.exe
Token: SeDebugPrivilege	4612	Registry.exe
Token: SeDebugPrivilege	3476	Registry.exe
Token: SeDebugPrivilege	1000	Registry.exe
Token: SeDebugPrivilege	4988	Registry.exe
Token: SeDebugPrivilege	2304	Registry.exe
Token: SeDebugPrivilege	3156	Registry.exe
Token: SeDebugPrivilege	3220	Registry.exe
Token: SeDebugPrivilege	4896	Registry.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 1180	3672	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe	83
PID 3672 wrote to memory of 1180	3672	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe	83
PID 3672 wrote to memory of 1180	3672	JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe	83
PID 1180 wrote to memory of 4896	1180	WScript.exe	84
PID 1180 wrote to memory of 4896	1180	WScript.exe	84
PID 1180 wrote to memory of 4896	1180	WScript.exe	84
PID 4896 wrote to memory of 1456	4896	cmd.exe	86
PID 4896 wrote to memory of 1456	4896	cmd.exe	86
PID 1456 wrote to memory of 1084	1456	DllCommonsvc.exe	131
PID 1456 wrote to memory of 1084	1456	DllCommonsvc.exe	131
PID 1456 wrote to memory of 5052	1456	DllCommonsvc.exe	132
PID 1456 wrote to memory of 5052	1456	DllCommonsvc.exe	132
PID 1456 wrote to memory of 4912	1456	DllCommonsvc.exe	133
PID 1456 wrote to memory of 4912	1456	DllCommonsvc.exe	133
PID 1456 wrote to memory of 3176	1456	DllCommonsvc.exe	134
PID 1456 wrote to memory of 3176	1456	DllCommonsvc.exe	134
PID 1456 wrote to memory of 3844	1456	DllCommonsvc.exe	135
PID 1456 wrote to memory of 3844	1456	DllCommonsvc.exe	135
PID 1456 wrote to memory of 1348	1456	DllCommonsvc.exe	136
PID 1456 wrote to memory of 1348	1456	DllCommonsvc.exe	136
PID 1456 wrote to memory of 1864	1456	DllCommonsvc.exe	137
PID 1456 wrote to memory of 1864	1456	DllCommonsvc.exe	137
PID 1456 wrote to memory of 1784	1456	DllCommonsvc.exe	138
PID 1456 wrote to memory of 1784	1456	DllCommonsvc.exe	138
PID 1456 wrote to memory of 4636	1456	DllCommonsvc.exe	141
PID 1456 wrote to memory of 4636	1456	DllCommonsvc.exe	141
PID 1456 wrote to memory of 3128	1456	DllCommonsvc.exe	143
PID 1456 wrote to memory of 3128	1456	DllCommonsvc.exe	143
PID 1456 wrote to memory of 1460	1456	DllCommonsvc.exe	144
PID 1456 wrote to memory of 1460	1456	DllCommonsvc.exe	144
PID 1456 wrote to memory of 4024	1456	DllCommonsvc.exe	145
PID 1456 wrote to memory of 4024	1456	DllCommonsvc.exe	145
PID 1456 wrote to memory of 3968	1456	DllCommonsvc.exe	146
PID 1456 wrote to memory of 3968	1456	DllCommonsvc.exe	146
PID 1456 wrote to memory of 4724	1456	DllCommonsvc.exe	147
PID 1456 wrote to memory of 4724	1456	DllCommonsvc.exe	147
PID 1456 wrote to memory of 4504	1456	DllCommonsvc.exe	148
PID 1456 wrote to memory of 4504	1456	DllCommonsvc.exe	148
PID 1456 wrote to memory of 1360	1456	DllCommonsvc.exe	161
PID 1456 wrote to memory of 1360	1456	DllCommonsvc.exe	161
PID 1360 wrote to memory of 3220	1360	cmd.exe	163
PID 1360 wrote to memory of 3220	1360	cmd.exe	163
PID 1360 wrote to memory of 2052	1360	cmd.exe	165
PID 1360 wrote to memory of 2052	1360	cmd.exe	165
PID 2052 wrote to memory of 2348	2052	Registry.exe	173
PID 2052 wrote to memory of 2348	2052	Registry.exe	173
PID 2348 wrote to memory of 916	2348	cmd.exe	176
PID 2348 wrote to memory of 916	2348	cmd.exe	176
PID 2348 wrote to memory of 4608	2348	cmd.exe	181
PID 2348 wrote to memory of 4608	2348	cmd.exe	181
PID 4608 wrote to memory of 1012	4608	Registry.exe	183
PID 4608 wrote to memory of 1012	4608	Registry.exe	183
PID 1012 wrote to memory of 4952	1012	cmd.exe	185
PID 1012 wrote to memory of 4952	1012	cmd.exe	185
PID 1012 wrote to memory of 3204	1012	cmd.exe	190
PID 1012 wrote to memory of 3204	1012	cmd.exe	190
PID 3204 wrote to memory of 4636	3204	Registry.exe	192
PID 3204 wrote to memory of 4636	3204	Registry.exe	192
PID 4636 wrote to memory of 3476	4636	cmd.exe	194
PID 4636 wrote to memory of 3476	4636	cmd.exe	194
PID 4636 wrote to memory of 2548	4636	cmd.exe	196
PID 4636 wrote to memory of 2548	4636	cmd.exe	196
PID 2548 wrote to memory of 1704	2548	Registry.exe	198
PID 2548 wrote to memory of 1704	2548	Registry.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd810987dee86ad4621efa2e580838af295ce257d47c41a97c98fe2be32cc1cc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Links\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\TextInputHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Temp\taskhostw.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\LocalLow\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\sppsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\smss.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\LanguageModels\Registry.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Wykr9ZxSDm.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1360
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:3220
      - C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TA6UjH3MJQ.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:916
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:4952
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3204
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3476
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DCuC0H4DXb.bat"
        13⤵
        
        PID:1704
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:3632
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        15⤵
        
        PID:4828
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:2312
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DCuC0H4DXb.bat"
        17⤵
        
        PID:1348
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:2472
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat"
        19⤵
        
        PID:2360
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:60
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4612
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat"
        21⤵
        
        PID:4728
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1216
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat"
        23⤵
        
        PID:4896
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2804
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat"
        25⤵
        
        PID:4072
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:3468
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4988
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat"
        27⤵
        
        PID:1636
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:720
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OyPKZ08zKl.bat"
        29⤵
        
        PID:4084
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:4632
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0MFyH7TMVd.bat"
        31⤵
        
        PID:212
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:688
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        32⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8iYvsD9nO.bat"
        33⤵
        
        PID:3192
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        34⤵
        
        PID:3796
        
        C:\Windows\SKB\LanguageModels\Registry.exe
        
        "C:\Windows\SKB\LanguageModels\Registry.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Links\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Links\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Links\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Windows\DigitalLocker\en-US\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\DigitalLocker\en-US\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\Temp\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\LocalLow\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\LocalLow\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\LocalLow\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\providercommon\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\providercommon\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\providercommon\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Public\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Windows\SKB\LanguageModels\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\SKB\LanguageModels\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Registry.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\0MFyH7TMVd.bat

Filesize
207B

MD5
ace3fcf76aeb18d5f2702dae2aa33d86

SHA1
bf41f8fbc78c72b8fec8e5baee32662ba14daf5c

SHA256
30d229f0237be0d6758f64d34f08cb06fb484c2cf3d02cc4c0fe57c6de6eb188

SHA512
83d86404e32aa1578435f94c9c7aa41403e8120597cc6fe5398ddc934d18e184594e30778d243235810291e3fedba0f47435c9ad0631256e67da82f6d3d89bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\5EJ4eIa89C.bat

Filesize
207B

MD5
5b0abb3defb70cd876aa734e4d6326a5

SHA1
9e2e6a996f5b00a92a1cd54e142e4900cda285b5

SHA256
cd18b5c29d435222129128d3146113bd782e20cda121e7e7f28a1ac025f68a0e

SHA512
f2cf0b3cb9b8faadebb792b3510cc73b9b96b2ad7f23b222691f0d5b6ef026adee4ec697aa32dd4a0a372b83e290363c2862a8067344cdb57036536359266c70

Download Submit
C:\Users\Admin\AppData\Local\Temp\CL2HVdYORd.bat

Filesize
207B

MD5
f9050abf6aa074382ecc282bf8ccb732

SHA1
5ed48ca9a996685a25f37078028b97f479f0e3ce

SHA256
9b2aae9e7b03f2764e65adac2c1d1236e1016117f3eadeb9b7856b72afa5d7d5

SHA512
b20e418d06df4f5d4c01075f8af20592e671bb7186c735730a129e00160ed2f5d7811dc0507298d013920205a1cd8a1abde6787cbc791e762f0ad27f87e25aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\DCuC0H4DXb.bat

Filesize
207B

MD5
1f83b00689cd9335461749a2866bcdd9

SHA1
a72a09c619f578cafd9da22b7d9a52bb5b33e4f8

SHA256
e2abb8748acb7e254301fbbb4d3cbbef80e6ca6f82f73e9b681c0796fdb43a6d

SHA512
0df1408034ee07b8a74e3b8c214f38050a2562b57b565177daaa1f48253884be00251f2e0d4b6609839fde12f6fb1a604ce092f2e1c64fd11eff5eeb773e74db

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD5NsnfB5C.bat

Filesize
207B

MD5
8a164af306a626e7f9ea966b6d8c2742

SHA1
d845fb6db7b1b9d22378dda6482dfe3ba6ace51b

SHA256
39a8aad99376e64b8fe5da06f6125ff6d1700042bd8969ecedea985640aed493

SHA512
b7af2e19570fa9a5a82b57a23730c69e1fab5c4b18f99ca08f8df0bbfc12e9993336f233c039f665873b43d9e432aa4d564b99e3225ea61594e64fcdaaed170e

Download Submit
C:\Users\Admin\AppData\Local\Temp\OyPKZ08zKl.bat

Filesize
207B

MD5
1cf45d47fb6eeb2fd905cdfee68a4a5c

SHA1
b5d8be0413a30ae566b3deb001b41fd188221899

SHA256
589188cce426be687c18db5cf18bedc0af3eabc56002b87a37735daae7bbed55

SHA512
0eb0efc0a5cde51c7494c1631d665ef43781fc4cb28d760425b4c264aeff4db2129d4fc2fdc3f66b407150061d93352efb7675bc9a0a9e8b15213b43e452a3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\R8iYvsD9nO.bat

Filesize
207B

MD5
42515997febe0a3a57d33af53190e825

SHA1
b93a19e3ff8f3cb9c97ab85b52e975dc66861e9f

SHA256
9d3e0472d34a709af55cd1d869895592a0e5889ecc2644e5952aeb71c0be4d53

SHA512
ee7cae073532b4d042c88c2f06392aff3f6d576d3e96982adac6ceb1412ae87424c5c49f144302c91cb1ba14ceb5502560a18e23015bb6f680a10c7d759f86f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\TA6UjH3MJQ.bat

Filesize
207B

MD5
d364ed87157035b8739889e31d3bd07c

SHA1
ae7babaa545b6152a16681ab0c68303779335ad5

SHA256
388398f097d106609270bc22a5a09a31073d53bebbdddc13012db9b9bd7b8a1d

SHA512
a6099795c322b5f98a1280ad392e5e2502e41b3e63a7a0417e0511c2455cecc66fb838e8d542819dfa9346bf7206a106f9a444931504c6dd8431c6baf2e4dd24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wykr9ZxSDm.bat

Filesize
207B

MD5
c8b2c95b061779967ae08177209052af

SHA1
9a00379263b448e03818fc53219454d139f2affb

SHA256
04a2c078c124209c77d0397372f1ec6c7898f4bc6418d40cd8f47937c5180b66

SHA512
b35bb60231d7682ca082f15ce1eb9adca20a0acdc82b5561516e35da8fa77f6476be1f865e22591defdd376ecdf24be733dea101939e12ba9a99c89a4b2168f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZmgdUlucqh.bat

Filesize
207B

MD5
fa9bf5095678692b2803cff57e7f0946

SHA1
d8aed9ead74f9310000b824b43e357ce73d60a58

SHA256
ae9f34031e64e9aa5062506b2129a3293f785621d9dd864b17273ba83f6d6cb7

SHA512
e5db1da05e047a780b652730695239915d76b529f9c57a148659a615c17e6764253eea68d060ae00f1eb550cc2ce3b05f756a5874261b3349a8c92799dba1337

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mywllgid.xnx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\moqrXfpsIj.bat

Filesize
207B

MD5
f387ebdaf16cd4012b0865a7b5e3cb51

SHA1
0934769aaa172fc05e790e76dae52975c671a1e2

SHA256
ee24f8440dfeb887b61e14af9e1aa5ec3170553bc1c4f78ba7bbe69b7d471c92

SHA512
17d4cf8fb81376ce0c7c5dfcf33486983ee62ad3a5913495a3c0ad360314341527232f47ab37f21315e2394fc14e58167140e5c8822e84e6c51ccf0885924d2a

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1456-17-0x0000000002510000-0x000000000251C000-memory.dmp

Filesize
48KB

Download
memory/1456-13-0x00000000002B0000-0x00000000003C0000-memory.dmp

Filesize
1.1MB

Download
memory/1456-12-0x00007FFA0FDD3000-0x00007FFA0FDD5000-memory.dmp

Filesize
8KB

Download
memory/1456-16-0x00000000024F0000-0x00000000024FC000-memory.dmp

Filesize
48KB

Download
memory/1456-15-0x0000000002500000-0x000000000250C000-memory.dmp

Filesize
48KB

Download
memory/1456-14-0x00000000024E0000-0x00000000024F2000-memory.dmp

Filesize
72KB

Download
memory/1784-59-0x00000279B22B0000-0x00000279B22D2000-memory.dmp

Filesize
136KB

Download
memory/2052-218-0x00000000025C0000-0x00000000025D2000-memory.dmp

Filesize
72KB

Download
memory/2304-291-0x0000000001900000-0x0000000001912000-memory.dmp

Filesize
72KB

Download
memory/2548-240-0x0000000001160000-0x0000000001172000-memory.dmp

Filesize
72KB

Download
memory/3156-298-0x0000000001340000-0x0000000001352000-memory.dmp

Filesize
72KB

Download
memory/3660-259-0x0000000003110000-0x0000000003122000-memory.dmp

Filesize
72KB

Download
memory/4608-227-0x0000000002920000-0x0000000002932000-memory.dmp

Filesize
72KB

Download
memory/4612-266-0x00000000017B0000-0x00000000017C2000-memory.dmp

Filesize
72KB

Download
memory/4896-311-0x0000000000ED0000-0x0000000000EE2000-memory.dmp

Filesize
72KB

Download