dcrat | 093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe
Size

1.3MB
MD5

7b27f3a94280a7b2fd587bcc61b0b766
SHA1

4433b22fff151f69ac1befeeb1e6eafdafd9518b
SHA256

093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471
SHA512

133b379958caaf48965fb089ac3a1c81a4980678120f9a596c2567601ea9562af58f4179c975f3eeff3c2edee395cf628531f523796b4a9fa8f5ddbaae4c69df
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2516	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4008	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3204	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3148	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1512	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	672	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4424	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4968	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3612	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	1892	schtasks.exe	87
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	1892	schtasks.exe	87

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c9c-10.dat	dcrat
behavioral2/memory/3428-13-0x00000000008F0000-0x0000000000A00000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1332	powershell.exe
1744	powershell.exe
1876	powershell.exe
1488	powershell.exe
4196	powershell.exe
1492	powershell.exe
436	powershell.exe
3192	powershell.exe
4868	powershell.exe
1624	powershell.exe
3860	powershell.exe
1160	powershell.exe

Checks computer location settings 2 TTPs 17 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	powershell.exe

Executes dropped EXE 15 IoCs

pid	Process
3428	DllCommonsvc.exe
4332	DllCommonsvc.exe
3676	powershell.exe
3876	powershell.exe
3764	powershell.exe
2356	powershell.exe
448	powershell.exe
2496	powershell.exe
804	powershell.exe
3984	powershell.exe
3244	powershell.exe
1308	powershell.exe
1904	powershell.exe
4220	powershell.exe
3680	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
46	raw.githubusercontent.com
55	raw.githubusercontent.com
24	raw.githubusercontent.com
38	raw.githubusercontent.com
53	raw.githubusercontent.com
19	raw.githubusercontent.com
39	raw.githubusercontent.com
44	raw.githubusercontent.com
54	raw.githubusercontent.com
56	raw.githubusercontent.com
57	raw.githubusercontent.com
20	raw.githubusercontent.com
40	raw.githubusercontent.com
45	raw.githubusercontent.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\dwm.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\6cb0b6c459d5d3	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\9e8d7a4ca61bd9	DllCommonsvc.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Setup\State\conhost.exe	DllCommonsvc.exe
File created	C:\Windows\Setup\State\088424020bedd6	DllCommonsvc.exe
File created	C:\Windows\DiagTrack\Scenarios\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Windows\LiveKernelReports\DllCommonsvc.exe	DllCommonsvc.exe
File created	C:\Windows\PLA\Reports\it-IT\backgroundTaskHost.exe	DllCommonsvc.exe
File opened for modification	C:\Windows\PLA\Reports\it-IT\backgroundTaskHost.exe	DllCommonsvc.exe
File created	C:\Windows\PLA\Reports\it-IT\eddb19405b7ce1	DllCommonsvc.exe
File created	C:\Windows\es-ES\dllhost.exe	DllCommonsvc.exe
File created	C:\Windows\es-ES\5940a34987c991	DllCommonsvc.exe
File created	C:\Windows\Resources\Ease of Access Themes\powershell.exe	DllCommonsvc.exe
File created	C:\Windows\DiagTrack\Scenarios\e1ef82546f0b02	DllCommonsvc.exe
File created	C:\Windows\LiveKernelReports\a76d7bf15d8370	DllCommonsvc.exe
File created	C:\Windows\Resources\Ease of Access Themes\e978f868350d50	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
404	schtasks.exe
4928	schtasks.exe
2112	schtasks.exe
4008	schtasks.exe
3064	schtasks.exe
804	schtasks.exe
1628	schtasks.exe
2516	schtasks.exe
2096	schtasks.exe
4804	schtasks.exe
4424	schtasks.exe
2676	schtasks.exe
684	schtasks.exe
2076	schtasks.exe
2064	schtasks.exe
3204	schtasks.exe
832	schtasks.exe
996	schtasks.exe
3464	schtasks.exe
3612	schtasks.exe
2484	schtasks.exe
3148	schtasks.exe
4488	schtasks.exe
1088	schtasks.exe
4968	schtasks.exe
4600	schtasks.exe
4552	schtasks.exe
2376	schtasks.exe
1512	schtasks.exe
672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
3428	DllCommonsvc.exe
4196	powershell.exe
1876	powershell.exe
1332	powershell.exe
4868	powershell.exe
1488	powershell.exe
1744	powershell.exe
1332	powershell.exe
4196	powershell.exe
1876	powershell.exe
4868	powershell.exe
1488	powershell.exe
1744	powershell.exe
4332	DllCommonsvc.exe
1624	powershell.exe
1624	powershell.exe
436	powershell.exe
436	powershell.exe
1160	powershell.exe
1160	powershell.exe
1492	powershell.exe
1492	powershell.exe
3860	powershell.exe
3860	powershell.exe
3192	powershell.exe
3192	powershell.exe
436	powershell.exe
1624	powershell.exe
1492	powershell.exe
1160	powershell.exe
3860	powershell.exe
3192	powershell.exe
3676	powershell.exe
3876	powershell.exe
3764	powershell.exe
2356	powershell.exe
448	powershell.exe
2496	powershell.exe
804	powershell.exe
3984	powershell.exe
3244	powershell.exe
1308	powershell.exe
1904	powershell.exe
4220	powershell.exe
3680	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	DllCommonsvc.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	4332	DllCommonsvc.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	804	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3132	5100	JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe	83
PID 5100 wrote to memory of 3132	5100	JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe	83
PID 5100 wrote to memory of 3132	5100	JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe	83
PID 3132 wrote to memory of 1268	3132	WScript.exe	84
PID 3132 wrote to memory of 1268	3132	WScript.exe	84
PID 3132 wrote to memory of 1268	3132	WScript.exe	84
PID 1268 wrote to memory of 3428	1268	cmd.exe	86
PID 1268 wrote to memory of 3428	1268	cmd.exe	86
PID 3428 wrote to memory of 1332	3428	DllCommonsvc.exe	104
PID 3428 wrote to memory of 1332	3428	DllCommonsvc.exe	104
PID 3428 wrote to memory of 1744	3428	DllCommonsvc.exe	105
PID 3428 wrote to memory of 1744	3428	DllCommonsvc.exe	105
PID 3428 wrote to memory of 4868	3428	DllCommonsvc.exe	106
PID 3428 wrote to memory of 4868	3428	DllCommonsvc.exe	106
PID 3428 wrote to memory of 1876	3428	DllCommonsvc.exe	107
PID 3428 wrote to memory of 1876	3428	DllCommonsvc.exe	107
PID 3428 wrote to memory of 1488	3428	DllCommonsvc.exe	108
PID 3428 wrote to memory of 1488	3428	DllCommonsvc.exe	108
PID 3428 wrote to memory of 4196	3428	DllCommonsvc.exe	109
PID 3428 wrote to memory of 4196	3428	DllCommonsvc.exe	109
PID 3428 wrote to memory of 4332	3428	DllCommonsvc.exe	116
PID 3428 wrote to memory of 4332	3428	DllCommonsvc.exe	116
PID 4332 wrote to memory of 1492	4332	DllCommonsvc.exe	132
PID 4332 wrote to memory of 1492	4332	DllCommonsvc.exe	132
PID 4332 wrote to memory of 436	4332	DllCommonsvc.exe	133
PID 4332 wrote to memory of 436	4332	DllCommonsvc.exe	133
PID 4332 wrote to memory of 1624	4332	DllCommonsvc.exe	134
PID 4332 wrote to memory of 1624	4332	DllCommonsvc.exe	134
PID 4332 wrote to memory of 3192	4332	DllCommonsvc.exe	135
PID 4332 wrote to memory of 3192	4332	DllCommonsvc.exe	135
PID 4332 wrote to memory of 3860	4332	DllCommonsvc.exe	136
PID 4332 wrote to memory of 3860	4332	DllCommonsvc.exe	136
PID 4332 wrote to memory of 1160	4332	DllCommonsvc.exe	137
PID 4332 wrote to memory of 1160	4332	DllCommonsvc.exe	137
PID 4332 wrote to memory of 536	4332	DllCommonsvc.exe	144
PID 4332 wrote to memory of 536	4332	DllCommonsvc.exe	144
PID 536 wrote to memory of 2428	536	cmd.exe	146
PID 536 wrote to memory of 2428	536	cmd.exe	146
PID 536 wrote to memory of 3676	536	cmd.exe	153
PID 536 wrote to memory of 3676	536	cmd.exe	153
PID 3676 wrote to memory of 3624	3676	powershell.exe	161
PID 3676 wrote to memory of 3624	3676	powershell.exe	161
PID 3624 wrote to memory of 624	3624	cmd.exe	163
PID 3624 wrote to memory of 624	3624	cmd.exe	163
PID 3624 wrote to memory of 3876	3624	cmd.exe	165
PID 3624 wrote to memory of 3876	3624	cmd.exe	165
PID 3876 wrote to memory of 1540	3876	powershell.exe	167
PID 3876 wrote to memory of 1540	3876	powershell.exe	167
PID 1540 wrote to memory of 3108	1540	cmd.exe	169
PID 1540 wrote to memory of 3108	1540	cmd.exe	169
PID 1540 wrote to memory of 3764	1540	cmd.exe	174
PID 1540 wrote to memory of 3764	1540	cmd.exe	174
PID 3764 wrote to memory of 3228	3764	powershell.exe	176
PID 3764 wrote to memory of 3228	3764	powershell.exe	176
PID 3228 wrote to memory of 4440	3228	cmd.exe	178
PID 3228 wrote to memory of 4440	3228	cmd.exe	178
PID 3228 wrote to memory of 2356	3228	cmd.exe	180
PID 3228 wrote to memory of 2356	3228	cmd.exe	180
PID 2356 wrote to memory of 4024	2356	powershell.exe	182
PID 2356 wrote to memory of 4024	2356	powershell.exe	182
PID 4024 wrote to memory of 1696	4024	cmd.exe	184
PID 4024 wrote to memory of 1696	4024	cmd.exe	184
PID 4024 wrote to memory of 448	4024	cmd.exe	186
PID 4024 wrote to memory of 448	4024	cmd.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_093b7e95d3d1c10b0289246bd79d9c9c4ac0012d4b19544f526b9ac965eed471.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DiagTrack\Scenarios\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4196
    - - C:\providercommon\DllCommonsvc.exe
        
        "C:\providercommon\DllCommonsvc.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4332
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Reports\it-IT\backgroundTaskHost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:436
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Setup\State\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\es-ES\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Resources\Ease of Access Themes\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GIggINWQmx.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:2428
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:624
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\i32OxRBhll.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:3108
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4440
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:1696
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat"
        16⤵
        
        PID:1424
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3704
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat"
        18⤵
        
        PID:1268
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:2568
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uugdhbmYnk.bat"
        20⤵
        
        PID:1664
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4432
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3984
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\THL7XCWxQ1.bat"
        22⤵
        
        PID:684
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:2536
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\m1RNSv4oba.bat"
        24⤵
        
        PID:2248
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:884
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
        26⤵
        
        PID:5064
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:4512
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
        28⤵
        
        PID:1876
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:2812
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4220
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\a4RGbRhdNM.bat"
        30⤵
        
        PID:436
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:444
        
        C:\Windows\Resources\Ease of Access Themes\powershell.exe
        
        "C:\Windows\Resources\Ease of Access Themes\powershell.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3680
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6qhkY4Aj1y.bat"
        32⤵
        
        PID:3376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        33⤵
        
        PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Pictures\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Windows\DiagTrack\Scenarios\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\DiagTrack\Scenarios\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Windows\DiagTrack\Scenarios\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\Edge\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\DllCommonsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\Windows\LiveKernelReports\DllCommonsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Windows\PLA\Reports\it-IT\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\PLA\Reports\it-IT\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Windows\PLA\Reports\it-IT\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\Setup\State\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Setup\State\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Windows\Setup\State\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Windows\es-ES\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\es-ES\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Users\Default\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 13 /tr "'C:\Windows\Resources\Ease of Access Themes\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Windows\Resources\Ease of Access Themes\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

Filesize
1KB

MD5
7f3c0ae41f0d9ae10a8985a2c327b8fb

SHA1
d58622bf6b5071beacf3b35bb505bde2000983e3

SHA256
519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

SHA512
8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
100481e7f609d3d0f6ee1c9f9763e76a

SHA1
8d40fb0785b73a8fdbb21f4e31f85f4a951ccd75

SHA256
bd182926b762eeb857994b1691f66889ce9d911d6255d2edb605810a6cc794eb

SHA512
0cd525254a47fe8981d41264f59bb65c1fcdceac1b840a0ab8244c3632ef1e4e08dcd41b343c026b56bad1d5484ab5a53600761ec74f24298072146a7bb795c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0aa63dbb46d451e47a7a682c64af776d

SHA1
3b0026f2dae8e9c491ccaa40133755779de35aaa

SHA256
9158038718d41172c22a3c1a15852405e3e1c8e2c44fa066328eb1520e5d977b

SHA512
4d2564850c2ab1bc71089412f19147df4a1cd3075aa2039aa894271b333cd9c510b7ba4d70889f24d45d8b366d8b5167abdcf24314e4753420337c7d34e7c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
436B

MD5
f0694dcb8f28bf390e3d3481660e38d8

SHA1
600e449d663b179e4bc17ba5e133e1481f0f74bb

SHA256
7292872475ae034db2a19405755f57c4e1ecc945b45287b1e49668e6a5bd226a

SHA512
0338cfff51baaa332bb8589136a769f3b9dac66d7c57ace6d2d893997330d750fee6ed518ca8171d6b73a0cba4ac98eacbfd8b2facf4be68a1178e88975ae9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\4oJokgKWVw.bat

Filesize
222B

MD5
a06a26981e8cf84ff26c3cbf80e82ed1

SHA1
c63eb278cbba85096a6215d02588012a74f60806

SHA256
62f5d32f564a65064b61b43bd089798e5a7e1b7a4319be66bc0dee8896bfce68

SHA512
a99c3b46f04d449742e7958127abbb182c07a87acc70892ca871cf591e3afe8a417e4c7db46d9394e667e0c123e9de014d99c2d81cea0c8a315368cfe818c5ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\6qhkY4Aj1y.bat

Filesize
222B

MD5
0b6b33ba81a87f01c44afe07d7919c59

SHA1
6bb8186d27f9156f980fbfc7cfaee41c41e1b8ce

SHA256
da3da52359fac48db5ba8ac5ca87abf4e13622290c427b1116e896b3de74fafa

SHA512
808a82e3ed3f5743a8bba5f5b2bb87d54d91112a6b72e935083a01cb8fe8f3386e9af53de3d410b9e72e75d8dc15bb5aad67fb47635d9644da3dfc3fd3d001bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\GIggINWQmx.bat

Filesize
222B

MD5
3741d810ab31911a3eabd4f506ac60b5

SHA1
d3496597390ed6250798adbf0262de1423e6c883

SHA256
19a605441468d0ce7508dc27982bf661c8db61ee39f4323a45ae89e5a5a1e929

SHA512
c00d22f297252077a126c98f53baf92a71cd9375938cc8c729857e42d8b7a28a8afb73a2daac5556e396eeb51a0de2e8041ee642077f2f768df8457f2cd7c6ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\NYP5fOsMgV.bat

Filesize
222B

MD5
9ab3380e7ce8097611b5a09581a34ad3

SHA1
7f288bc5afc33f29c662d3abed87e021b0f60b15

SHA256
131b64914def0dceb4f8d5c83a704f186db15c454dea169482912fe6f6b2f5e5

SHA512
e25ab5144d7044344ab38c8b73870eba512c054c4365a7e6eb0c215cbbfe60e48e5273164ac94fbed460c17c573826c261711326d2927f2103fbd8eb040bc51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat

Filesize
222B

MD5
3d9c4de28be868832ab76bd61f882a05

SHA1
1aa155ab0eff69b982a5f983d3604172839027d8

SHA256
370118b49ade61c864aef9da17e2dc51c627635f61cc8020e879ff671661891e

SHA512
c99a44bd53c3dd27d5ed7f2ea2985cb886d2bb4b1437af8d77b3fb3e96c029c9256cf057816cbc5f90c1541615b51cf3ed26b825d9fd46ba421d615b1a8fe83b

Download Submit
C:\Users\Admin\AppData\Local\Temp\THL7XCWxQ1.bat

Filesize
222B

MD5
f3479d9edc303a257b28e0544b8bea8a

SHA1
1351673a0ac83866227fb5b5bda32e718b18794e

SHA256
79aab8c153db405dce3387abb0179b918b4b19c9d4f74d6ed1d49d148424c68b

SHA512
4654ba2d8e05f0353bce2f5b90adb103a6354906dee41eeab32ae8acf5e6ff6ba9bd74fecf9ca3b80183e89fd010b4b413c9d89de52bfe478278472ab2adf14a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2r40iht5.g1g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a4RGbRhdNM.bat

Filesize
222B

MD5
661ff0f73d331d20c5ca047531e69cfe

SHA1
9f1927e992a69ffa2cb3f32485e3e24cb735bcdc

SHA256
a757596fbf4187032e280d5024e7d7471290eba4f1019aac0e45317d95e29c43

SHA512
1381171ea74e046f157c1c19db8594068a192d77df7c87516c40c36a95a9e29c3c0783931646cd62e31c4c27d6edc05f941923ada69f11e281a82ac7e644727a

Download Submit
C:\Users\Admin\AppData\Local\Temp\i32OxRBhll.bat

Filesize
222B

MD5
c19307643bff8bc947cbd1d68574741a

SHA1
b732edb5b16399b2e38e6050c2c10649f2af1bf0

SHA256
9230632cafff012614b21dff1e661bece89b47b5249f0db7e01e92fb45d2853f

SHA512
d8f122467427b4cf160939fa27e327997272d536d0ec6740bf2dfac6884bf747b5ac66a0b4092f61337fe5bf96fadb3f760ee62d714006d8b97a3b8b8ef7898a

Download Submit
C:\Users\Admin\AppData\Local\Temp\m1RNSv4oba.bat

Filesize
222B

MD5
a0fc22683952d93ef9b9a9553543f513

SHA1
d23e0c210f5a380de04eb4419c93002b7bf0fd7e

SHA256
4c3f0945f349db83149a7de76566c1ab2f629697187537549c8788e16d5b15ef

SHA512
b885b18ec6caa9832ff38992207d11e0f7a06173351b4b2b7858459d0a3eb977674fe6aa84776ca6115fa243dd3c0259cf285a412e48ac5e57eef0ffc4252224

Download Submit
C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat

Filesize
222B

MD5
045324e2828ceed81a266865ccb8d545

SHA1
b7e9c6139aa7164774ef0a76278324a67318816b

SHA256
6badf379f77819aa79bb18d004c620ad4ca91444964fdeda45211be2bdba9b78

SHA512
80a756018cd072d5f392fe7e55c2e281537482d04ec28f78b201708c71b86c782ab610803aa0d3c8b69b116fbf5d3dd9bec529d53d653c3f565ebad6df3f9b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat

Filesize
222B

MD5
7ab5541efaa8cbe5e67f61c778c364b1

SHA1
52bec8a5850e7ef1fa721a49d35c3ab2b9d1f6f2

SHA256
95850f153837f22832783c162ffa2298aca5a5c6906362d791ce2775ae37e915

SHA512
93b71af88a1e00be1fe230f62a8d21028b33b889a76ec9e5354e345c661ec0c6e1b502312d768f2871e510d0b9d5bfc61133e80a71f9bec891d2e3be123afb26

Download Submit
C:\Users\Admin\AppData\Local\Temp\uugdhbmYnk.bat

Filesize
222B

MD5
72ea1cd64388e53273dfd110e46e3571

SHA1
92b5ff878b8d362ed731c12b0da5f0cb44af8bf4

SHA256
7c4c600cf859d7f38223d428c25b0467139b1af520e62e5a4b745ce5f0abdb6c

SHA512
ec84adb8d04d239a44abfd720305fda244761e2219c69791db65c22af79dc059a31eeb5e4f89381bcbd7bd0089a82f5ea5ab86df1317e0fd041d65a67eab45c3

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/448-209-0x0000000000950000-0x0000000000962000-memory.dmp

Filesize
72KB

Download
memory/1904-247-0x0000000002B70000-0x0000000002B82000-memory.dmp

Filesize
72KB

Download
memory/3244-234-0x00000000009D0000-0x00000000009E2000-memory.dmp

Filesize
72KB

Download
memory/3428-17-0x0000000002D50000-0x0000000002D5C000-memory.dmp

Filesize
48KB

Download
memory/3428-16-0x0000000002BE0000-0x0000000002BEC000-memory.dmp

Filesize
48KB

Download
memory/3428-15-0x0000000002D60000-0x0000000002D6C000-memory.dmp

Filesize
48KB

Download
memory/3428-14-0x0000000002BC0000-0x0000000002BD2000-memory.dmp

Filesize
72KB

Download
memory/3428-13-0x00000000008F0000-0x0000000000A00000-memory.dmp

Filesize
1.1MB

Download
memory/3428-12-0x00007FFA5D983000-0x00007FFA5D985000-memory.dmp

Filesize
8KB

Download
memory/3676-184-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Filesize
72KB

Download
memory/4196-36-0x0000021F4BB60000-0x0000021F4BB82000-memory.dmp

Filesize
136KB

Download
memory/4332-86-0x0000000002B00000-0x0000000002B12000-memory.dmp

Filesize
72KB

Download