Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2024 05:43

General

  • Target

    JaffaCakes118_034b2a05353c57c99a509eb4ec62b41d0932b39223089bd1d41243387858c58d.exe

  • Size

    1.3MB

  • MD5

    41cbb8d59a3587705c3ad07b9799811a

  • SHA1

    d40744a16badbe139b09fb0d904ac2c134ac728b

  • SHA256

    034b2a05353c57c99a509eb4ec62b41d0932b39223089bd1d41243387858c58d

  • SHA512

    9c97191a0ca2a2ded86476272dbfd60b197416020edf9176dda875ad115bb0081b6048531eecf7eef7b4721b5766f5dc79bdf48be7cfa2ffa487826624e5f768

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_034b2a05353c57c99a509eb4ec62b41d0932b39223089bd1d41243387858c58d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_034b2a05353c57c99a509eb4ec62b41d0932b39223089bd1d41243387858c58d.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3196
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4104
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4696
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\lsass.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3040
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1388
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\SppExtComObj.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2224
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\fontdrvhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5000
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\My Documents\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1668
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\images\conhost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3656
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\it-IT\System.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1684
          • C:\Users\Default\fontdrvhost.exe
            "C:\Users\Default\fontdrvhost.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1236
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1924
              • C:\Windows\system32\w32tm.exe
                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                7⤵
                  PID:3448
                • C:\Users\Default\fontdrvhost.exe
                  "C:\Users\Default\fontdrvhost.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1092
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5008
                    • C:\Windows\system32\w32tm.exe
                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                      9⤵
                        PID:4324
                      • C:\Users\Default\fontdrvhost.exe
                        "C:\Users\Default\fontdrvhost.exe"
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3716
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat"
                          10⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3968
                          • C:\Windows\system32\w32tm.exe
                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                            11⤵
                              PID:2672
                            • C:\Users\Default\fontdrvhost.exe
                              "C:\Users\Default\fontdrvhost.exe"
                              11⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2224
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat"
                                12⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3944
                                • C:\Windows\system32\w32tm.exe
                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                  13⤵
                                    PID:2316
                                  • C:\Users\Default\fontdrvhost.exe
                                    "C:\Users\Default\fontdrvhost.exe"
                                    13⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:1668
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6qhkY4Aj1y.bat"
                                      14⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2496
                                      • C:\Windows\system32\w32tm.exe
                                        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                        15⤵
                                          PID:3600
                                        • C:\Users\Default\fontdrvhost.exe
                                          "C:\Users\Default\fontdrvhost.exe"
                                          15⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:1728
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat"
                                            16⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1196
                                            • C:\Windows\system32\w32tm.exe
                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                              17⤵
                                                PID:3452
                                              • C:\Users\Default\fontdrvhost.exe
                                                "C:\Users\Default\fontdrvhost.exe"
                                                17⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Modifies registry class
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of WriteProcessMemory
                                                PID:1936
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat"
                                                  18⤵
                                                    PID:4536
                                                    • C:\Windows\system32\w32tm.exe
                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                      19⤵
                                                        PID:2072
                                                      • C:\Users\Default\fontdrvhost.exe
                                                        "C:\Users\Default\fontdrvhost.exe"
                                                        19⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1924
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat"
                                                          20⤵
                                                            PID:4948
                                                            • C:\Windows\system32\w32tm.exe
                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                              21⤵
                                                                PID:4396
                                                              • C:\Users\Default\fontdrvhost.exe
                                                                "C:\Users\Default\fontdrvhost.exe"
                                                                21⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3024
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
                                                                  22⤵
                                                                    PID:1744
                                                                    • C:\Windows\system32\w32tm.exe
                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                      23⤵
                                                                        PID:4716
                                                                      • C:\Users\Default\fontdrvhost.exe
                                                                        "C:\Users\Default\fontdrvhost.exe"
                                                                        23⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3716
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat"
                                                                          24⤵
                                                                            PID:2244
                                                                            • C:\Windows\system32\w32tm.exe
                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                              25⤵
                                                                                PID:384
                                                                              • C:\Users\Default\fontdrvhost.exe
                                                                                "C:\Users\Default\fontdrvhost.exe"
                                                                                25⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4804
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat"
                                                                                  26⤵
                                                                                    PID:4584
                                                                                    • C:\Windows\system32\w32tm.exe
                                                                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                      27⤵
                                                                                        PID:1604
                                                                                      • C:\Users\Default\fontdrvhost.exe
                                                                                        "C:\Users\Default\fontdrvhost.exe"
                                                                                        27⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Modifies registry class
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2660
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6qhkY4Aj1y.bat"
                                                                                          28⤵
                                                                                            PID:3052
                                                                                            • C:\Windows\system32\w32tm.exe
                                                                                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                              29⤵
                                                                                                PID:3892
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\lsass.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1240
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3968
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3076
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3940
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3780
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2032
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Public\SppExtComObj.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3384
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:5004
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\SppExtComObj.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4548
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default\fontdrvhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3744
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4064
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Default\fontdrvhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4912
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\My Documents\System.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2204
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Admin\My Documents\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4996
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\My Documents\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2576
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\images\conhost.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3244
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\conhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:4312
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\images\conhost.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:2312
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\System.exe'" /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3460
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\it-IT\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1052
                                      • C:\Windows\system32\schtasks.exe
                                        schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\it-IT\System.exe'" /rl HIGHEST /f
                                        1⤵
                                        • Process spawned unexpected child process
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:1480

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

                                        Filesize

                                        1KB

                                        MD5

                                        baf55b95da4a601229647f25dad12878

                                        SHA1

                                        abc16954ebfd213733c4493fc1910164d825cac8

                                        SHA256

                                        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                        SHA512

                                        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                        Filesize

                                        2KB

                                        MD5

                                        d85ba6ff808d9e5444a4b369f5bc2730

                                        SHA1

                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                        SHA256

                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                        SHA512

                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        2e907f77659a6601fcc408274894da2e

                                        SHA1

                                        9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                        SHA256

                                        385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                        SHA512

                                        34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        6d42b6da621e8df5674e26b799c8e2aa

                                        SHA1

                                        ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                        SHA256

                                        5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                        SHA512

                                        53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        d28a889fd956d5cb3accfbaf1143eb6f

                                        SHA1

                                        157ba54b365341f8ff06707d996b3635da8446f7

                                        SHA256

                                        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                        SHA512

                                        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                        Filesize

                                        944B

                                        MD5

                                        cadef9abd087803c630df65264a6c81c

                                        SHA1

                                        babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                        SHA256

                                        cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                        SHA512

                                        7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                      • C:\Users\Admin\AppData\Local\Temp\6qhkY4Aj1y.bat

                                        Filesize

                                        197B

                                        MD5

                                        3b2ced833ca05543e98a307265abfd3d

                                        SHA1

                                        f7113cd0e6832fe00273627959fc1cd0c2c85e42

                                        SHA256

                                        ee2f402d686c5e6a4586b2fbf92dcecaf38ecce81b8c87535565d117f6450ebc

                                        SHA512

                                        46038f13d6f2ee11df5a8c1f44d8330dce5bbc6928de695cabcb35ba6b5d1bcaca25676b1b25eb70c031fe3be0c3a9a509b3d51de4e9d7ea333abd9d9bd39514

                                      • C:\Users\Admin\AppData\Local\Temp\7bDnwPuEug.bat

                                        Filesize

                                        197B

                                        MD5

                                        7d9262a8d666fd59737c902b7ea13da8

                                        SHA1

                                        2a245fcf693f137ffccee337abc48717f0beaed3

                                        SHA256

                                        709d8af4a4241a15c6b6ad49355d5bb67a22614c85983d19c91d303d93456728

                                        SHA512

                                        506c4ab6e9925457bb078ee3a465b757a043a9d89e63c5f6b5ba0e61a5b84611fe04627413c1708f4afaf6cdb465ff5f864de29fd19516765bcaffd62835262e

                                      • C:\Users\Admin\AppData\Local\Temp\AXFqcUy7ES.bat

                                        Filesize

                                        197B

                                        MD5

                                        2ff1f2e2cfe3e8e619f0e9c92d7709b0

                                        SHA1

                                        2f5fc47a4a84dbb5004082f1cbc4a31299eb5c08

                                        SHA256

                                        7fb9e3586cb5291aa86ee17fc4e14f6dfc87e9749d165525b8d70ea0558a3c26

                                        SHA512

                                        fc12a346976b01fdae790a5e5889c705296887c02d6750471f3b7889a3c597a0167be0b6a3af956aadbdd8fc2f14a5ae1416673d555aa73389cbb2b2f21fbc2d

                                      • C:\Users\Admin\AppData\Local\Temp\FaowIOOII5.bat

                                        Filesize

                                        197B

                                        MD5

                                        3827cb6f933ec047e192df37667914bc

                                        SHA1

                                        2cc40fc7b273f105f2741cbe34530c0bfc4e35db

                                        SHA256

                                        214be4ee3583e5b48f7d87e0a8bfaa3e7eb255d2e8e5c8c8892a03c597669e95

                                        SHA512

                                        edd9c1474b36d2b8b2a53552a10407520eaac84e0fdc3941f9da79c3deef2c74aa9d56516d556dd28157e9d00b6a704019a1f0927b4cf30954ddf72ae52ce526

                                      • C:\Users\Admin\AppData\Local\Temp\SQTB2Yz9K3.bat

                                        Filesize

                                        197B

                                        MD5

                                        57f45784f1f50579eafea25d2ae97717

                                        SHA1

                                        39ceeb9bb32310c316eb4d76a61db1b820555f2f

                                        SHA256

                                        d9ea9fbcc249cc76ae59a8d95b2017a975bb3aa93e62c030893a5c3ddf607d51

                                        SHA512

                                        eaa60f973153ac7c36bc311693ed383c358360af37345ace9f9e05b34502ef8008d2e2b5c4b32e170b0df0992edea26f1670af6399b9abdab0ab5ef9630cf14a

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ixdwoqb.5jy.ps1

                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                      • C:\Users\Admin\AppData\Local\Temp\c0TJHXkWh8.bat

                                        Filesize

                                        197B

                                        MD5

                                        c28ef2316b458b8dbe18211222c47bf2

                                        SHA1

                                        0e58c98ac0eb8e0bd9bdd67ed00f768a37ef8ba5

                                        SHA256

                                        c8006abc1d33f7054cc03547213f0d08ab054d9679aea890942953589e94599e

                                        SHA512

                                        224b88bb0fd4fe45047472b5f43c34ec820744bc630dbc54992831f9c44ae4299f63273f5e686baecef459111e791432caf7f458b0c36354393cbfb5ce6edc9a

                                      • C:\Users\Admin\AppData\Local\Temp\oxTQ808hvM.bat

                                        Filesize

                                        197B

                                        MD5

                                        570bd77115f46cfaf8570d640716de5c

                                        SHA1

                                        86c4993ff49fd5d6f008cf59b4c4a6002f2fc193

                                        SHA256

                                        737415ca95c765f934d2e70ef0d33c9a971a091a3e0a9fa7b698819527a248dc

                                        SHA512

                                        a8dec115d04a85968ad24e5c4968eeea0d915cf2750f45ece89728d5eaf4c3a9b63de54e4595a4c4588df2130bd3eeec14239a298808a05a9278ad03a982d0e0

                                      • C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat

                                        Filesize

                                        197B

                                        MD5

                                        a82408a17f5dfb28c4ce7be8c126ebc7

                                        SHA1

                                        83340f8569336f24af7a73579a17ace1771bd17c

                                        SHA256

                                        6d63b8389b8f864a11d90024ffd62e19eba46beebbe36b82e0eb746019ddc3a5

                                        SHA512

                                        710133f2471fec2ef9b1b6634ddc6452b9618c1cd1e38a5654cb431f66ab44ea70e97bc55a3e3b89d39269c5ac4bcb613b59e7fefc42d38e357a5ea214ad9d93

                                      • C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat

                                        Filesize

                                        197B

                                        MD5

                                        e35dfcac3df74a6edb1c0faabeffe5cc

                                        SHA1

                                        8fb5484660e21f26d4736f41ff0964db5414005b

                                        SHA256

                                        4c91269ed8322427e12cf3978f78c6c3d66946088e0eb3d86e00d00bb04f7a76

                                        SHA512

                                        a960a2d781ce3f443aa5e6c3f793472f4765fc1dad0eb1f63bdb6317feb6ed41cd91ee5d3ef32856ec4223a17ae5cf46f29a39479291a3380807e6ef9599ef42

                                      • C:\Users\Admin\AppData\Local\Temp\tpXWVAFTZv.bat

                                        Filesize

                                        197B

                                        MD5

                                        8d8b9be256dcad7b9dde6bd684ff89f7

                                        SHA1

                                        484628a5be1c988e0eb85089462152942c29dc99

                                        SHA256

                                        553240252c0ab1596f8fed8547cedb0fd41afaca4adc298716265a866a9c8381

                                        SHA512

                                        3617796fe7bd17155f0fde5a63e20c2daa36a189009d28caae5d0902cc237f88a0b0103cf7220836f7b6e7802c25ad61c28a462829eff45d35dcfb83fcbbd61c

                                      • C:\Users\Admin\AppData\Local\Temp\ys6bB5gfdY.bat

                                        Filesize

                                        197B

                                        MD5

                                        38219303ced276c227a94131a951fd07

                                        SHA1

                                        a8e2ed84a0e992a667af50ac9e29608f06cd0c5f

                                        SHA256

                                        a9d343f6e81874234a7375dc4c26a43a63e3664ecde6ca8bbd716b2bb20da787

                                        SHA512

                                        ec129208267b14f61950123447c89074238d3898abe82d8d96892825de1b7255ea45ce561edf41c71c2520d3a056cfbfe1b7f49e23f5b24c669cd98724068531

                                      • C:\providercommon\1zu9dW.bat

                                        Filesize

                                        36B

                                        MD5

                                        6783c3ee07c7d151ceac57f1f9c8bed7

                                        SHA1

                                        17468f98f95bf504cc1f83c49e49a78526b3ea03

                                        SHA256

                                        8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                        SHA512

                                        c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                      • C:\providercommon\DllCommonsvc.exe

                                        Filesize

                                        1.0MB

                                        MD5

                                        bd31e94b4143c4ce49c17d3af46bcad0

                                        SHA1

                                        f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                        SHA256

                                        b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                        SHA512

                                        f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                      • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                        Filesize

                                        197B

                                        MD5

                                        8088241160261560a02c84025d107592

                                        SHA1

                                        083121f7027557570994c9fc211df61730455bb5

                                        SHA256

                                        2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                        SHA512

                                        20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                      • memory/1236-146-0x000000001BD60000-0x000000001BECA000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1388-118-0x00000148BEF20000-0x00000148BF08A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1668-170-0x0000000002D50000-0x0000000002D62000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1668-130-0x0000020F57FE0000-0x0000020F5814A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1668-57-0x0000020F57D70000-0x0000020F57D92000-memory.dmp

                                        Filesize

                                        136KB

                                      • memory/1668-175-0x000000001C840000-0x000000001C9AA000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1684-131-0x000001DD74E30000-0x000001DD74F9A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1728-178-0x0000000002460000-0x0000000002472000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1728-183-0x000000001BDA0000-0x000000001BF0A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1924-198-0x000000001BBE0000-0x000000001BD4A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/1924-193-0x0000000002190000-0x00000000021A2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1936-186-0x00000000031D0000-0x00000000031E2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2224-124-0x000001972D8B0000-0x000001972DA1A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/2224-167-0x000000001C330000-0x000000001C49A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/3040-140-0x00000179CE780000-0x00000179CE8EA000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/3656-137-0x0000020B575D0000-0x0000020B5773A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/3716-160-0x000000001BFA0000-0x000000001C10A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/4104-17-0x0000000002F60000-0x0000000002F6C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/4104-14-0x0000000002D90000-0x0000000002DA2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4104-12-0x00007FFD30E43000-0x00007FFD30E45000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4104-13-0x0000000000B00000-0x0000000000C10000-memory.dmp

                                        Filesize

                                        1.1MB

                                      • memory/4104-16-0x0000000002DA0000-0x0000000002DAC000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/4104-15-0x000000001B840000-0x000000001B84C000-memory.dmp

                                        Filesize

                                        48KB

                                      • memory/4696-125-0x0000024962EE0000-0x000002496304A000-memory.dmp

                                        Filesize

                                        1.4MB

                                      • memory/4804-213-0x00000000013A0000-0x00000000013B2000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/5000-134-0x000001CBABA50000-0x000001CBABBBA000-memory.dmp

                                        Filesize

                                        1.4MB