Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 04:59
Behavioral task
behavioral1
Sample
JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe
-
Size
1.3MB
-
MD5
4448a79abfa79adcdb7c7f0d80f81ead
-
SHA1
9b4657ed79341b6d9a7d41ed02ef017c17b8ffe6
-
SHA256
84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637
-
SHA512
590fae0f70ca8e779623fb9905ed964aa60a3f8e4f825cfe1730402a86d46259021d5e102053c46637e7e47588ab16a720ec3a9ded1aed77fd24e235b77e2ac2
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3060 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2372 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3164 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 428 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3668 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2800 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4180 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3460 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 432 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3896 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4784 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1528 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2852 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3916 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2112 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4232 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 380 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1888 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4016 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2788 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2092 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4532 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2196 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1496 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1088 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3720 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4316 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5100 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2136 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2420 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2312 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2864 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2152 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1160 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3640 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2552 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2208 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4880 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 728 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1780 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3940 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3644 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 400 3532 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3968 3532 schtasks.exe 90 -
resource yara_rule behavioral2/files/0x000e000000023bb7-10.dat dcrat behavioral2/memory/4772-13-0x0000000000980000-0x0000000000A90000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3260 powershell.exe 4804 powershell.exe 2828 powershell.exe 1296 powershell.exe 1424 powershell.exe 852 powershell.exe 2300 powershell.exe 3504 powershell.exe 388 powershell.exe 4964 powershell.exe 992 powershell.exe 2808 powershell.exe 2336 powershell.exe 3556 powershell.exe 1308 powershell.exe 2236 powershell.exe 2600 powershell.exe -
Checks computer location settings 2 TTPs 16 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation StartMenuExperienceHost.exe -
Executes dropped EXE 14 IoCs
pid Process 4772 DllCommonsvc.exe 3716 StartMenuExperienceHost.exe 3236 StartMenuExperienceHost.exe 4504 StartMenuExperienceHost.exe 3840 StartMenuExperienceHost.exe 860 StartMenuExperienceHost.exe 3720 StartMenuExperienceHost.exe 3972 StartMenuExperienceHost.exe 3116 StartMenuExperienceHost.exe 4012 StartMenuExperienceHost.exe 2872 StartMenuExperienceHost.exe 3908 StartMenuExperienceHost.exe 4244 StartMenuExperienceHost.exe 4980 StartMenuExperienceHost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
flow ioc 50 raw.githubusercontent.com 51 raw.githubusercontent.com 53 raw.githubusercontent.com 37 raw.githubusercontent.com 48 raw.githubusercontent.com 38 raw.githubusercontent.com 16 raw.githubusercontent.com 24 raw.githubusercontent.com 44 raw.githubusercontent.com 49 raw.githubusercontent.com 17 raw.githubusercontent.com 43 raw.githubusercontent.com 39 raw.githubusercontent.com 52 raw.githubusercontent.com -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\TextInputHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\55b276f4edf653 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\smss.exe DllCommonsvc.exe File created C:\Program Files\Internet Explorer\images\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Registry.exe DllCommonsvc.exe File created C:\Program Files\7-Zip\Lang\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Program Files\Internet Explorer\images\e6c9b481da804f DllCommonsvc.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\7a0fd90576e088 DllCommonsvc.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\ee2ad38f3d4382 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Multimedia Platform\69ddcba757bf72 DllCommonsvc.exe File created C:\Program Files\7-Zip\Lang\sppsvc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Adobe\22eafd247d37c3 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings StartMenuExperienceHost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2568 schtasks.exe 2852 schtasks.exe 4016 schtasks.exe 2196 schtasks.exe 1088 schtasks.exe 5100 schtasks.exe 3460 schtasks.exe 3896 schtasks.exe 2312 schtasks.exe 2152 schtasks.exe 728 schtasks.exe 3968 schtasks.exe 380 schtasks.exe 1160 schtasks.exe 2112 schtasks.exe 2108 schtasks.exe 1496 schtasks.exe 3720 schtasks.exe 2420 schtasks.exe 3640 schtasks.exe 3856 schtasks.exe 3668 schtasks.exe 2208 schtasks.exe 1780 schtasks.exe 2788 schtasks.exe 2092 schtasks.exe 4532 schtasks.exe 532 schtasks.exe 3164 schtasks.exe 3940 schtasks.exe 2800 schtasks.exe 432 schtasks.exe 2136 schtasks.exe 1528 schtasks.exe 4316 schtasks.exe 4232 schtasks.exe 2864 schtasks.exe 2552 schtasks.exe 3060 schtasks.exe 2372 schtasks.exe 4784 schtasks.exe 3916 schtasks.exe 1888 schtasks.exe 4880 schtasks.exe 3644 schtasks.exe 400 schtasks.exe 428 schtasks.exe 4180 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4772 DllCommonsvc.exe 4964 powershell.exe 4964 powershell.exe 1296 powershell.exe 1296 powershell.exe 1424 powershell.exe 1424 powershell.exe 4804 powershell.exe 4804 powershell.exe 992 powershell.exe 992 powershell.exe 2236 powershell.exe 2236 powershell.exe 852 powershell.exe 852 powershell.exe 2300 powershell.exe 2300 powershell.exe 3504 powershell.exe 3504 powershell.exe 3260 powershell.exe 3260 powershell.exe 2808 powershell.exe 2808 powershell.exe 2828 powershell.exe 2828 powershell.exe 2600 powershell.exe 2600 powershell.exe 2336 powershell.exe 2336 powershell.exe 3556 powershell.exe 3556 powershell.exe 4804 powershell.exe 388 powershell.exe 388 powershell.exe 1308 powershell.exe 1308 powershell.exe 3556 powershell.exe 3716 StartMenuExperienceHost.exe 3716 StartMenuExperienceHost.exe 1424 powershell.exe 4964 powershell.exe 2808 powershell.exe 2300 powershell.exe 2828 powershell.exe 1296 powershell.exe 388 powershell.exe 3504 powershell.exe 992 powershell.exe 2236 powershell.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 4772 DllCommonsvc.exe Token: SeDebugPrivilege 2808 powershell.exe Token: SeDebugPrivilege 2300 powershell.exe Token: SeDebugPrivilege 4804 powershell.exe Token: SeDebugPrivilege 4964 powershell.exe Token: SeDebugPrivilege 1296 powershell.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe Token: SeDebugPrivilege 388 powershell.exe Token: SeDebugPrivilege 992 powershell.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 852 powershell.exe Token: SeDebugPrivilege 3504 powershell.exe Token: SeDebugPrivilege 3260 powershell.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 3716 StartMenuExperienceHost.exe Token: SeDebugPrivilege 2336 powershell.exe Token: SeDebugPrivilege 3556 powershell.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeDebugPrivilege 3236 StartMenuExperienceHost.exe Token: SeDebugPrivilege 4504 StartMenuExperienceHost.exe Token: SeDebugPrivilege 3840 StartMenuExperienceHost.exe Token: SeDebugPrivilege 860 StartMenuExperienceHost.exe Token: SeDebugPrivilege 3720 StartMenuExperienceHost.exe Token: SeDebugPrivilege 3972 StartMenuExperienceHost.exe Token: SeDebugPrivilege 3116 StartMenuExperienceHost.exe Token: SeDebugPrivilege 4012 StartMenuExperienceHost.exe Token: SeDebugPrivilege 2872 StartMenuExperienceHost.exe Token: SeDebugPrivilege 3908 StartMenuExperienceHost.exe Token: SeDebugPrivilege 4244 StartMenuExperienceHost.exe Token: SeDebugPrivilege 4980 StartMenuExperienceHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 3972 4808 JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe 85 PID 4808 wrote to memory of 3972 4808 JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe 85 PID 4808 wrote to memory of 3972 4808 JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe 85 PID 3972 wrote to memory of 1280 3972 WScript.exe 87 PID 3972 wrote to memory of 1280 3972 WScript.exe 87 PID 3972 wrote to memory of 1280 3972 WScript.exe 87 PID 1280 wrote to memory of 4772 1280 cmd.exe 89 PID 1280 wrote to memory of 4772 1280 cmd.exe 89 PID 4772 wrote to memory of 1308 4772 DllCommonsvc.exe 140 PID 4772 wrote to memory of 1308 4772 DllCommonsvc.exe 140 PID 4772 wrote to memory of 2808 4772 DllCommonsvc.exe 141 PID 4772 wrote to memory of 2808 4772 DllCommonsvc.exe 141 PID 4772 wrote to memory of 992 4772 DllCommonsvc.exe 142 PID 4772 wrote to memory of 992 4772 DllCommonsvc.exe 142 PID 4772 wrote to memory of 4964 4772 DllCommonsvc.exe 143 PID 4772 wrote to memory of 4964 4772 DllCommonsvc.exe 143 PID 4772 wrote to memory of 1296 4772 DllCommonsvc.exe 144 PID 4772 wrote to memory of 1296 4772 DllCommonsvc.exe 144 PID 4772 wrote to memory of 2828 4772 DllCommonsvc.exe 145 PID 4772 wrote to memory of 2828 4772 DllCommonsvc.exe 145 PID 4772 wrote to memory of 4804 4772 DllCommonsvc.exe 146 PID 4772 wrote to memory of 4804 4772 DllCommonsvc.exe 146 PID 4772 wrote to memory of 3260 4772 DllCommonsvc.exe 147 PID 4772 wrote to memory of 3260 4772 DllCommonsvc.exe 147 PID 4772 wrote to memory of 2300 4772 DllCommonsvc.exe 148 PID 4772 wrote to memory of 2300 4772 DllCommonsvc.exe 148 PID 4772 wrote to memory of 3556 4772 DllCommonsvc.exe 150 PID 4772 wrote to memory of 3556 4772 DllCommonsvc.exe 150 PID 4772 wrote to memory of 2236 4772 DllCommonsvc.exe 151 PID 4772 wrote to memory of 2236 4772 DllCommonsvc.exe 151 PID 4772 wrote to memory of 852 4772 DllCommonsvc.exe 153 PID 4772 wrote to memory of 852 4772 DllCommonsvc.exe 153 PID 4772 wrote to memory of 388 4772 DllCommonsvc.exe 154 PID 4772 wrote to memory of 388 4772 DllCommonsvc.exe 154 PID 4772 wrote to memory of 2336 4772 DllCommonsvc.exe 156 PID 4772 wrote to memory of 2336 4772 DllCommonsvc.exe 156 PID 4772 wrote to memory of 1424 4772 DllCommonsvc.exe 158 PID 4772 wrote to memory of 1424 4772 DllCommonsvc.exe 158 PID 4772 wrote to memory of 2600 4772 DllCommonsvc.exe 159 PID 4772 wrote to memory of 2600 4772 DllCommonsvc.exe 159 PID 4772 wrote to memory of 3504 4772 DllCommonsvc.exe 160 PID 4772 wrote to memory of 3504 4772 DllCommonsvc.exe 160 PID 4772 wrote to memory of 3716 4772 DllCommonsvc.exe 173 PID 4772 wrote to memory of 3716 4772 DllCommonsvc.exe 173 PID 3716 wrote to memory of 1528 3716 StartMenuExperienceHost.exe 181 PID 3716 wrote to memory of 1528 3716 StartMenuExperienceHost.exe 181 PID 1528 wrote to memory of 732 1528 cmd.exe 183 PID 1528 wrote to memory of 732 1528 cmd.exe 183 PID 1528 wrote to memory of 3236 1528 cmd.exe 191 PID 1528 wrote to memory of 3236 1528 cmd.exe 191 PID 3236 wrote to memory of 2208 3236 StartMenuExperienceHost.exe 193 PID 3236 wrote to memory of 2208 3236 StartMenuExperienceHost.exe 193 PID 2208 wrote to memory of 3064 2208 cmd.exe 195 PID 2208 wrote to memory of 3064 2208 cmd.exe 195 PID 2208 wrote to memory of 4504 2208 cmd.exe 199 PID 2208 wrote to memory of 4504 2208 cmd.exe 199 PID 4504 wrote to memory of 2860 4504 StartMenuExperienceHost.exe 202 PID 4504 wrote to memory of 2860 4504 StartMenuExperienceHost.exe 202 PID 2860 wrote to memory of 2932 2860 cmd.exe 204 PID 2860 wrote to memory of 2932 2860 cmd.exe 204 PID 2860 wrote to memory of 3840 2860 cmd.exe 206 PID 2860 wrote to memory of 3840 2860 cmd.exe 206 PID 3840 wrote to memory of 2464 3840 StartMenuExperienceHost.exe 208 PID 3840 wrote to memory of 2464 3840 StartMenuExperienceHost.exe 208 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_84484bcfc9ca9bc392a3356f48fce449d274b361cbde4f5c174e232ad1dd8637.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\StartMenuExperienceHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:388
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SXiopUTlQe.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:732
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:3064
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\04VLARgLyy.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:2932
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Tcsv1v0qfT.bat"12⤵PID:2464
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:4968
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iVu5YTRuDT.bat"14⤵PID:852
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1992
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kQw8FYVnXF.bat"16⤵PID:4936
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3172
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hJP5Gj8VmP.bat"18⤵PID:4764
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:1496
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3116 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dXV640YnNf.bat"20⤵PID:5092
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:3552
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4012 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\cSLzsZ1i8q.bat"22⤵PID:2880
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:532
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UTkrWZWekQ.bat"24⤵PID:1200
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:3856
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3908 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\574RqM7W2b.bat"26⤵PID:908
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:4544
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SXiopUTlQe.bat"28⤵PID:3120
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:4536
-
-
C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9ncYvmuuF5.bat"30⤵PID:5024
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3164
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\providercommon\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\providercommon\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3896
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1528
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4232
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Public\AccountPictures\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2196
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\images\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\StartMenuExperienceHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
223B
MD5e69a2e84970199d69c2739f96c499620
SHA195cb9ebc7152747708823d7537cb941cbcb91278
SHA2565d77a2c0beda020fd1f18fbddd5648dff68ff3e6f867398e8e52f1ffcabe6f44
SHA512e0d60fd1ec803dcc411a48d868c2605c166d07ebd15a30d5084dc4c9a289fb90a1a4f7567a9305166f951a18e81898790824e777e87caad574d31d0f94da0f70
-
Filesize
223B
MD52a0caa2972a3a469ed7ac40d36b401e4
SHA1d613d8f8ddc9a3107a8d9075f0f64300f6290637
SHA2569504d181acfc92c46c470f4a8a0ae019f1b789012d8cfaff689a4c60c288db02
SHA512dfad1f04cf720e3f403ee6dae111dce916fa4b449332e8dc92ad3ac8bfa277153ac0dcefcb44a6cfdf007ff87f0b7dc78bef709fefefb431b74b6c970ac9cb69
-
Filesize
223B
MD5edee9d67e46456522fa75728f7a8ce1f
SHA173366f7c327bca129b289194363aca2332d932fb
SHA256ce3235a7ff8f81f1069573acb45ae3bd67c6fe875781565df2d079147abb59ee
SHA512ca38aa0ca04b2d9866bf06d27337910898c32271a58661c29c72be6eb74ef535ff637e776299b9ba84a5bbffeeb5bb7e01d5a25bdc4c41b24881eb0c425980ec
-
Filesize
223B
MD5f11eda70329b46c9c6a5a5b177af2866
SHA1d2cac1c8708cc170a508087089748c42974e9f82
SHA25616a5957bd1b2c6d61fd710141ebd8d0833492f1d95c63087ba6fb703207fdf4e
SHA512df8658c71e2ceaee7c45489f71478be84668e3105a1f398eeba3d75e2962dd387ec877afcdaf922e0b2448b0552d26fc6222e33263526b1f8fd847b0af66e263
-
Filesize
223B
MD54fdc5e6258e84b15872eabea0f87a43b
SHA187a8475d083b0f81269f403157360ed691348271
SHA256502ff2a96bf3ac22c81c788253cd991ffee06fd99f464713e553a4e39678ce8c
SHA512dd172322879307ed75287ba2db4ad0f12686e8dfd0dfa761efd1758f1dec5d2cabb9c028454cd9a9bdd9f39264f64a3d764dc4ee2dce85e8c30306c2761f0933
-
Filesize
223B
MD5515bdf6419812b63048b163fc20d70f6
SHA1f340c0d7cd2391c2bac55f2db1f68f9bb4d3fd09
SHA2569d78c2693ece38592dd3eb3cb3c0b6c3be8628c4e5576e484eaffb70ea25d45a
SHA51271457aeb3313f143a7600c6cb9c705abfa5a7fcdfde7099e585248aab33dfaaa4f28638f92f3eb26b63b4b129669057e1e3d9de1730576c18d35ea49145787be
-
Filesize
223B
MD5843b07b206d15c33c2a05fd4deded533
SHA1c1537977a1f6eb2221cca4ecef8fdb222cd0320f
SHA256e25f51c4b5965612653e6769671e5e37f2b3e35635c4fe5d1868b3c3d79ae61f
SHA5120b79225cb651e94b0685259b7158a692cd1e11b3780890c2e1f50140104c7bde6f438a902bcbb525b528c96b0fbebd326963518c6b14de639dd83501306f9d53
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
223B
MD574ba90db96ce57cb194f43270d257fb3
SHA1112920b348cf455f505045b7c9417f6b1b6c9810
SHA25654b0a7f827025a3f304b3b47be88cc214829aa095fc27385fea3ed878b7c77ea
SHA512406dffa7679f4c2305be9f5dedbce2fb70c5939a4e6a546fd545bee8cc96dd48fb514216ae583d05ea9b0435fc119ad297b35cfb9e2ffff9f6859adad2616f6d
-
Filesize
223B
MD53eaf481c3b9e56d9805d6d4d9d235b83
SHA1704d154bb6f11c681e5f03bc40dc6956446984d8
SHA256b997f6c749e626d5e5de43f51e828a4fb38e4b9fb8b64e1ecbd16d999de7f9b9
SHA51227ae48ff236079beb577d203977dfaaf1b524c1753ebbb57eb7a7a95fadf2fe3afd10c62850b4351fbecf2738f49b997d8822cc58293c7ac2f76242c202c1a60
-
Filesize
223B
MD5413f94e959d3cba0bf5843f8afc38a33
SHA1774ca4fe4aef70dc57fcc5f4efd9ffc7103d36b5
SHA256c8d5c820231b107dd3ee5aa6fcef5af3dfdb024d7a61bc50a742110a094589ed
SHA51244d943b6033168460b5076871cccd5ca811c1d8fa1966c566a6c62de1765ec6457d03186b3a203db0f14ca4deaf3dc42e8edcd1dc8aadc6453fd4cd6d77ca930
-
Filesize
223B
MD5a62a66f3719bb2dc5c67579440ba7cbd
SHA12ecc41554de75338700d76b9be60bf3563578a0f
SHA25669723f64330e87bc4b50439c0163694b3727856c835ea220d2f79d3fe90b9df2
SHA512f868c139f77c3ac7c5f9c51fd915c050659dada9fc486528cd1576070e52fa2f33799932f48d38a27010fe125552b04f693f51ae0ee790f6b9e876d40fc20e11
-
Filesize
223B
MD5caa38db47494c0316d89286e030abf1f
SHA14baa598249e6e5dabc0e59854c86d45bb634d8a4
SHA2565f6254bc1a23177a7c8e02458523938182d435a5797ce1561f0ca113daf2686a
SHA512c36db8d31c469e8d5b4637207cd6b558d8b61964e1dc14d867574297e96ab839332ae73a23f41c16d53a1155cf3ca9dbdeb7bb2e822f7e043fb7a2877e90ca9e
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478