Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 06:31
Behavioral task
behavioral1
Sample
JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe
-
Size
1.3MB
-
MD5
b95986a4273ab031fe63f4338019befc
-
SHA1
52b7107faad6290f6cd291ac5cf4e33d65867939
-
SHA256
47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d
-
SHA512
1532219024a0ef7c8014c8b4a5c27c6d7fca194e073074ed6b37c0b8e6389d388628b3418c2cc6fb0fea5fc4ba276c3a27657faf428d3e0c29e918fcb82e45de
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2384 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1996 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1184 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1592 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1392 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1160 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4572 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1012 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1472 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3524 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1180 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1128 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3212 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3332 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 784 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2396 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 316 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3720 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5060 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1244 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2052 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3672 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 672 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3676 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5052 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 732 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 620 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 464 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2212 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 532 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3356 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3952 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3988 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4956 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1188 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 840 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 864 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3004 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4576 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1976 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5032 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4084 1660 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 1660 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x000a000000023b63-10.dat dcrat behavioral2/memory/2536-13-0x0000000000CA0000-0x0000000000DB0000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3556 powershell.exe 2880 powershell.exe 3516 powershell.exe 3536 powershell.exe 1780 powershell.exe 4968 powershell.exe 4972 powershell.exe 2980 powershell.exe 2312 powershell.exe 2448 powershell.exe 216 powershell.exe 4360 powershell.exe 3996 powershell.exe 2324 powershell.exe 2612 powershell.exe 1132 powershell.exe 3024 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation Idle.exe -
Executes dropped EXE 15 IoCs
pid Process 2536 DllCommonsvc.exe 4728 Idle.exe 628 Idle.exe 4304 Idle.exe 1780 Idle.exe 3032 Idle.exe 3896 Idle.exe 2472 Idle.exe 3648 Idle.exe 2956 Idle.exe 2668 Idle.exe 216 Idle.exe 3420 Idle.exe 3960 Idle.exe 2788 Idle.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 17 raw.githubusercontent.com 35 raw.githubusercontent.com 43 raw.githubusercontent.com 48 raw.githubusercontent.com 54 raw.githubusercontent.com 23 raw.githubusercontent.com 53 raw.githubusercontent.com 55 raw.githubusercontent.com 57 raw.githubusercontent.com 18 raw.githubusercontent.com 41 raw.githubusercontent.com 42 raw.githubusercontent.com 56 raw.githubusercontent.com 58 raw.githubusercontent.com 47 raw.githubusercontent.com -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\56085415360792 DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\sppsvc.exe DllCommonsvc.exe File created C:\Program Files\7-Zip\SppExtComObj.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\de-DE\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\e6c9b481da804f DllCommonsvc.exe File created C:\Program Files (x86)\Windows NT\TableTextService\6ccacd8608530f DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files\VideoLAN\VLC\wininit.exe DllCommonsvc.exe File created C:\Program Files\7-Zip\e1ef82546f0b02 DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\WindowsPowerShell\ea9f0e6c9e2dcd DllCommonsvc.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\schemas\AvailableNetwork\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Windows\fr-FR\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\fr-FR\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Windows\WaaS\tasks\StartMenuExperienceHost.exe DllCommonsvc.exe File created C:\Windows\SKB\LanguageModels\sysmon.exe DllCommonsvc.exe File created C:\Windows\SKB\LanguageModels\121e5b5079f7c0 DllCommonsvc.exe File created C:\Windows\schemas\AvailableNetwork\services.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings Idle.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3676 schtasks.exe 5052 schtasks.exe 2212 schtasks.exe 2316 schtasks.exe 2624 schtasks.exe 1592 schtasks.exe 3720 schtasks.exe 732 schtasks.exe 532 schtasks.exe 3436 schtasks.exe 316 schtasks.exe 3672 schtasks.exe 3952 schtasks.exe 3004 schtasks.exe 1180 schtasks.exe 1012 schtasks.exe 3332 schtasks.exe 784 schtasks.exe 4380 schtasks.exe 1188 schtasks.exe 840 schtasks.exe 4304 schtasks.exe 4572 schtasks.exe 4084 schtasks.exe 1996 schtasks.exe 1128 schtasks.exe 3212 schtasks.exe 4956 schtasks.exe 864 schtasks.exe 2384 schtasks.exe 1392 schtasks.exe 1160 schtasks.exe 672 schtasks.exe 464 schtasks.exe 1976 schtasks.exe 1184 schtasks.exe 2396 schtasks.exe 620 schtasks.exe 5032 schtasks.exe 3524 schtasks.exe 1472 schtasks.exe 5060 schtasks.exe 1244 schtasks.exe 2052 schtasks.exe 3356 schtasks.exe 3988 schtasks.exe 4576 schtasks.exe 2076 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 2536 DllCommonsvc.exe 4972 powershell.exe 4972 powershell.exe 3516 powershell.exe 3516 powershell.exe 2880 powershell.exe 2880 powershell.exe 4968 powershell.exe 4968 powershell.exe 2612 powershell.exe 2612 powershell.exe 3556 powershell.exe 3556 powershell.exe 3536 powershell.exe 3536 powershell.exe 3024 powershell.exe 3024 powershell.exe 1132 powershell.exe 1132 powershell.exe 2448 powershell.exe 2448 powershell.exe 1780 powershell.exe 1780 powershell.exe 3996 powershell.exe 3996 powershell.exe 4360 powershell.exe 4360 powershell.exe 2980 powershell.exe 2980 powershell.exe 2324 powershell.exe 2324 powershell.exe 216 powershell.exe 216 powershell.exe 4728 Idle.exe 4728 Idle.exe 2312 powershell.exe 2312 powershell.exe 2312 powershell.exe 3516 powershell.exe 2880 powershell.exe 1132 powershell.exe 4972 powershell.exe 3536 powershell.exe 4968 powershell.exe 3996 powershell.exe 3556 powershell.exe 2612 powershell.exe 2448 powershell.exe 2324 powershell.exe 4360 powershell.exe 3024 powershell.exe 1780 powershell.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 2536 DllCommonsvc.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 3516 powershell.exe Token: SeDebugPrivilege 2880 powershell.exe Token: SeDebugPrivilege 4968 powershell.exe Token: SeDebugPrivilege 4728 Idle.exe Token: SeDebugPrivilege 2612 powershell.exe Token: SeDebugPrivilege 3556 powershell.exe Token: SeDebugPrivilege 3536 powershell.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeDebugPrivilege 1132 powershell.exe Token: SeDebugPrivilege 2448 powershell.exe Token: SeDebugPrivilege 1780 powershell.exe Token: SeDebugPrivilege 3996 powershell.exe Token: SeDebugPrivilege 4360 powershell.exe Token: SeDebugPrivilege 2324 powershell.exe Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 2312 powershell.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 628 Idle.exe Token: SeDebugPrivilege 4304 Idle.exe Token: SeDebugPrivilege 1780 Idle.exe Token: SeDebugPrivilege 3032 Idle.exe Token: SeDebugPrivilege 3896 Idle.exe Token: SeDebugPrivilege 2472 Idle.exe Token: SeDebugPrivilege 3648 Idle.exe Token: SeDebugPrivilege 2956 Idle.exe Token: SeDebugPrivilege 2668 Idle.exe Token: SeDebugPrivilege 216 Idle.exe Token: SeDebugPrivilege 3420 Idle.exe Token: SeDebugPrivilege 3960 Idle.exe Token: SeDebugPrivilege 2788 Idle.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3644 wrote to memory of 4868 3644 JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe 82 PID 3644 wrote to memory of 4868 3644 JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe 82 PID 3644 wrote to memory of 4868 3644 JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe 82 PID 4868 wrote to memory of 1088 4868 WScript.exe 83 PID 4868 wrote to memory of 1088 4868 WScript.exe 83 PID 4868 wrote to memory of 1088 4868 WScript.exe 83 PID 1088 wrote to memory of 2536 1088 cmd.exe 85 PID 1088 wrote to memory of 2536 1088 cmd.exe 85 PID 2536 wrote to memory of 216 2536 DllCommonsvc.exe 135 PID 2536 wrote to memory of 216 2536 DllCommonsvc.exe 135 PID 2536 wrote to memory of 3024 2536 DllCommonsvc.exe 136 PID 2536 wrote to memory of 3024 2536 DllCommonsvc.exe 136 PID 2536 wrote to memory of 4972 2536 DllCommonsvc.exe 137 PID 2536 wrote to memory of 4972 2536 DllCommonsvc.exe 137 PID 2536 wrote to memory of 2880 2536 DllCommonsvc.exe 138 PID 2536 wrote to memory of 2880 2536 DllCommonsvc.exe 138 PID 2536 wrote to memory of 3516 2536 DllCommonsvc.exe 139 PID 2536 wrote to memory of 3516 2536 DllCommonsvc.exe 139 PID 2536 wrote to memory of 3536 2536 DllCommonsvc.exe 140 PID 2536 wrote to memory of 3536 2536 DllCommonsvc.exe 140 PID 2536 wrote to memory of 1780 2536 DllCommonsvc.exe 141 PID 2536 wrote to memory of 1780 2536 DllCommonsvc.exe 141 PID 2536 wrote to memory of 4360 2536 DllCommonsvc.exe 142 PID 2536 wrote to memory of 4360 2536 DllCommonsvc.exe 142 PID 2536 wrote to memory of 3556 2536 DllCommonsvc.exe 143 PID 2536 wrote to memory of 3556 2536 DllCommonsvc.exe 143 PID 2536 wrote to memory of 3996 2536 DllCommonsvc.exe 144 PID 2536 wrote to memory of 3996 2536 DllCommonsvc.exe 144 PID 2536 wrote to memory of 2980 2536 DllCommonsvc.exe 145 PID 2536 wrote to memory of 2980 2536 DllCommonsvc.exe 145 PID 2536 wrote to memory of 2312 2536 DllCommonsvc.exe 146 PID 2536 wrote to memory of 2312 2536 DllCommonsvc.exe 146 PID 2536 wrote to memory of 2324 2536 DllCommonsvc.exe 147 PID 2536 wrote to memory of 2324 2536 DllCommonsvc.exe 147 PID 2536 wrote to memory of 4968 2536 DllCommonsvc.exe 148 PID 2536 wrote to memory of 4968 2536 DllCommonsvc.exe 148 PID 2536 wrote to memory of 2612 2536 DllCommonsvc.exe 149 PID 2536 wrote to memory of 2612 2536 DllCommonsvc.exe 149 PID 2536 wrote to memory of 2448 2536 DllCommonsvc.exe 150 PID 2536 wrote to memory of 2448 2536 DllCommonsvc.exe 150 PID 2536 wrote to memory of 1132 2536 DllCommonsvc.exe 151 PID 2536 wrote to memory of 1132 2536 DllCommonsvc.exe 151 PID 2536 wrote to memory of 4728 2536 DllCommonsvc.exe 168 PID 2536 wrote to memory of 4728 2536 DllCommonsvc.exe 168 PID 4728 wrote to memory of 2108 4728 Idle.exe 170 PID 4728 wrote to memory of 2108 4728 Idle.exe 170 PID 2108 wrote to memory of 3720 2108 cmd.exe 172 PID 2108 wrote to memory of 3720 2108 cmd.exe 172 PID 2108 wrote to memory of 628 2108 cmd.exe 177 PID 2108 wrote to memory of 628 2108 cmd.exe 177 PID 628 wrote to memory of 1316 628 Idle.exe 180 PID 628 wrote to memory of 1316 628 Idle.exe 180 PID 1316 wrote to memory of 864 1316 cmd.exe 182 PID 1316 wrote to memory of 864 1316 cmd.exe 182 PID 1316 wrote to memory of 4304 1316 cmd.exe 183 PID 1316 wrote to memory of 4304 1316 cmd.exe 183 PID 4304 wrote to memory of 2064 4304 Idle.exe 185 PID 4304 wrote to memory of 2064 4304 Idle.exe 185 PID 2064 wrote to memory of 4668 2064 cmd.exe 187 PID 2064 wrote to memory of 4668 2064 cmd.exe 187 PID 2064 wrote to memory of 1780 2064 cmd.exe 189 PID 2064 wrote to memory of 1780 2064 cmd.exe 189 PID 1780 wrote to memory of 1008 1780 Idle.exe 190 PID 1780 wrote to memory of 1008 1780 Idle.exe 190 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47aee639dab46878c5317caa4ed33137b955ad842adf765c73e4f2ad153cc39d.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Downloads\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\schemas\AvailableNetwork\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\dwm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\fr-FR\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\SppExtComObj.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\LanguageModels\sysmon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\23CLvB8Ots.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:3720
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\B4BP5ZSgoJ.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:864
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\45aGjaybPu.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4668
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I0OceA6Xfh.bat"12⤵PID:1008
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:732
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3032 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat"14⤵PID:1616
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1768
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3896 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5AjNu1Vgdj.bat"16⤵PID:1400
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:3964
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2472 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LnIbptgF5R.bat"18⤵PID:4540
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:860
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3648 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\XdxpZ3I66P.bat"20⤵PID:1600
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:1448
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fcYyv3mAUp.bat"22⤵PID:3556
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:3536
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8xeM6k5O3T.bat"24⤵PID:3416
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1780
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3EiKDvRnKw.bat"26⤵PID:4640
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:4572
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3420 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Myoa8e0eVV.bat"28⤵PID:2396
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:3624
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3960 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZZzsG8LzQB.bat"30⤵PID:4560
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:231⤵PID:3828
-
-
C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2788 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nGW3UwTeX7.bat"32⤵PID:3948
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:233⤵PID:724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\providercommon\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1392
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4572
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1472
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\schemas\AvailableNetwork\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\schemas\AvailableNetwork\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Windows\schemas\AvailableNetwork\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dwm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Windows\fr-FR\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\fr-FR\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\7-Zip\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:732
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:620
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2212
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Local Settings\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Local Settings\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\WindowsPowerShell\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:864
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\WindowsPowerShell\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3004
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Windows\SKB\LanguageModels\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\SKB\LanguageModels\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\SKB\LanguageModels\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\de-DE\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD53a6bad9528f8e23fb5c77fbd81fa28e8
SHA1f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
219B
MD568b564c0fb3a76a0606664ecbd119c79
SHA128abee6f594aa8f1c1af5f3a38c03c756f6eb753
SHA25669c320c59ab07d6a4bf952c9c6360647e41bc631c63df680f655bc2b5d96f200
SHA5123b942a16f1b983c645564a34c0e5fa4dc139ec67e289afa7f953102cd6d9218ff96a6c5fadd4bf405663199591cab3c308f8ba8f04fc387ce630ad9f5d42b19f
-
Filesize
219B
MD515cf6c300717adbfd03b27fad86591e4
SHA1ed2c0b7f8477a65c50777c12e17f03ebbbbcec33
SHA256439b32c3e22f7a9487796a28630027d48de1dbd053f12421b8a03f766981ec76
SHA51248c91da9483091d34d1aab43183cb2a707954e27f94bb60e45318cc28dcc4ee80890e2520f893322827469681b07c207a7c7ee0141e64b5825e10b66f1b14bfe
-
Filesize
219B
MD58d1f1eca47ee7d77ee6f7341764cbb95
SHA1a197b4c6b7a1c48e6d656eef2b075f9663a0e2b2
SHA2565265eb2ff82722d972ab4b72e5aa35c86614d00997baea683ba4911537740bac
SHA5122ff8e1b113dea51f44ad70be1ea4b9854b0b7bae7c9b8cec7aa5903b1294324a828355cd01e8eb3b631534dbb498fa65630cfcce8e4396e8ab3dc23851755672
-
Filesize
219B
MD5788e0dcd15c25b1556eb663f9caab8c2
SHA14b413541e78e155d1d748d2b1d4def45b48eaa0a
SHA25692d180aea68fe1030b5fa1978ef559bddde5eb45ca896bd6be5894d9105b5102
SHA512b8b1da7b0a501fe0523bbcebfa88ec5a3843e8c88ac6475cf7d45f3fab28d2a14439427a310f36545aa09e7fde3c8daa9d5abd03bd1d3ecd0df8ccdaa038a125
-
Filesize
219B
MD55d3b8c97e381b8376fbe6df9ada315ec
SHA156b8925c83f63c1c88b5e231846a2bf4dbd785dc
SHA2564d26f91764388754b9e31c9ffcb8cbf7317d299ebebef3e03a69471b4f3b1955
SHA512dca535f36341ddef113d24f982538c19e6ebd095586f5f6eab6a831e59051ad95d59bcc80a316d7a08546930b9debe7cf0c509558b4e20f2c468987ca4763876
-
Filesize
219B
MD5c63debf6fb40d21d75b56f31b40f8967
SHA150dc7bdb0375f76a680c88ec934212c6939ce993
SHA256116efb98c11ee63bb56463f099f7eb5128a561fc1a1df5f2db8f6c6fd7a1da1f
SHA512ccc641d5e767a2eae39ffc7e176b45cf189050629135d1cd00a69a5acdd810ab9c5fd43afb3677a9b60f9fedb86d5a4a478d5c889f9986290e63559cf7bdbe1c
-
Filesize
219B
MD5f113e6a7c2fa9f5006d505808e9a05f4
SHA13d7bc46db7c14330ed923984f4253a5f8cd94fc9
SHA2568750381ec7466eb1bc25bce036e79634fe105be9ef4802242fc0debec417027d
SHA51272819d84f7f47c4a584350d2f146fa6d013e19cf153a10b7a642ec6f1e11e6a5a10ba0ba7b8de703ffdb275ab7ce1869703681929c52add34fa0eefbef7cf2a2
-
Filesize
219B
MD57253672e111eac1e81bd83530da2e6be
SHA106b33e785b30990efee9b70db683e9c9273837dd
SHA2565363e8b5efca2cefe3b5dce78e627ba674af031d032952dcd92bb705e5628e32
SHA5122b19978d7163afd34d2fe5e674ae9196b5dc0efd162cc56b3a4d3b2f592240675de5f9921228b7cefeb3c31ec46de85e7b02bd886e78dba217a2fac8e7da597d
-
Filesize
219B
MD507b197b6cfabaa317d924b30f8173f66
SHA1530b18fc60548005e22621d1cd54170054667032
SHA256e915df648efc0a4c78cc247e5402df71a06beaca7449d48838976ba548054e35
SHA512b147b609e44fca734a4ed29b62f14164da22c402bd0befe8057c0d0c95d6f5568e25a224de885fb610492ce0e4e58abad3cbc389e16a6cae0d7786f9beaa432a
-
Filesize
219B
MD585856119d99c98b56e12df5df2c9df28
SHA14f1ca3c11387454c5b47ac32c0736736939698a3
SHA2561fcedc0861b6bdaf230813c1310a50982a4f124a4b238bbce4546cdf84ea59af
SHA512900ef8ec487c4668c39355185f06cabc67cd1f0ce94268d036818f04a07a7d28d2a70b270a472ab4b1f4bde4ba96244babc17b6fa6f1009c080ba5242ba87832
-
Filesize
219B
MD55b394de472ea9d367d5dbf9f5ccb8dd2
SHA114ff59e1b76535c6f638810db28767daed4794a0
SHA2563926fb9837ba7771ea83ebca006ba20bee2f2901dde2fb73cb7a696095adc8b6
SHA512eaf211aed239b19f46e9bcfa7aadcfa40e6810640bdc8a2eafb5c22772320f55a3cb6c340d109a0b5637d87462211c4652cdf9e86c2aa5c95d430b616f068b3d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
219B
MD5e11af80206b87bc743f9dcadc31e0b16
SHA1954b2035ca301259efaa08f4eb77aef698ea4aca
SHA256242f305378fabe4662cbe76863454ce9ad39b4035acdd51173703ded3f2f9ef2
SHA51268a72a5fc1aadeb5d5f8330b071080b89778581fd426ed36ec625f24f56c952c43e34ab504bda011fa55fac8c73c26e42ee594646b16078fb7c4c4257d774da6
-
Filesize
219B
MD54630d37034c06a333f5e148a9206c2e3
SHA1f3723efd05e8b194306cab7b1223a2c9f2b94460
SHA2565c7d334888fe2fbec193c53671b126f0b5152fbbf3c959297a4383d3ff24fcb9
SHA512c616ef2d3c516ba9c5b590069a42b2947f27aabccf03368a90ed7dc94741d74bba3a1ddb40fc2407653393cf4923184607132b2beb94524a854f05f1816f4730
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478