dcrat | 85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe
Size

1.3MB
MD5

9dc28c1dea6b79854f0adb8a7805c7d7
SHA1

20e7498a342e3ef2668e6302a7544319c38d9c1a
SHA256

85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe
SHA512

509ef6d760c41054de00759da5bf6da02512d72878d295723a9397a34f93d8ca1de22d756d32968a66f84ee7a276a059370606136094ff5765b1826b5f43ffb5
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1636	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1248	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	516	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	896	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4208	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	184	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4984	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	388	1132	schtasks.exe	86
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3468	1132	schtasks.exe	86

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x0007000000023c8f-10.dat	dcrat
behavioral2/memory/4368-13-0x0000000000DB0000-0x0000000000EC0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3480	powershell.exe
3432	powershell.exe
2572	powershell.exe
1224	powershell.exe
2816	powershell.exe
3840	powershell.exe
3436	powershell.exe
2900	powershell.exe
1136	powershell.exe
3172	powershell.exe
4060	powershell.exe
3244	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 15 IoCs

pid	Process
4368	DllCommonsvc.exe
3004	winlogon.exe
1320	winlogon.exe
4228	winlogon.exe
852	winlogon.exe
2628	winlogon.exe
1436	winlogon.exe
1396	winlogon.exe
4280	winlogon.exe
4812	winlogon.exe
4156	winlogon.exe
3436	winlogon.exe
4600	winlogon.exe
1032	winlogon.exe
1248	winlogon.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
39	raw.githubusercontent.com
52	raw.githubusercontent.com
42	raw.githubusercontent.com
43	raw.githubusercontent.com
50	raw.githubusercontent.com
16	raw.githubusercontent.com
17	raw.githubusercontent.com
23	raw.githubusercontent.com
36	raw.githubusercontent.com
38	raw.githubusercontent.com
54	raw.githubusercontent.com
44	raw.githubusercontent.com
51	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Program Files\Windows Defender\9e8d7a4ca61bd9	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\wininit.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\56085415360792	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Boot\Misc\PCAT\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Windows\IdentityCRL\production\SearchApp.exe	DllCommonsvc.exe
File created	C:\Windows\IdentityCRL\production\38384e6a620884	DllCommonsvc.exe
File created	C:\Windows\Tasks\RuntimeBroker.exe	DllCommonsvc.exe
File created	C:\Windows\Tasks\9e8d7a4ca61bd9	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	DllCommonsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2468	schtasks.exe
4208	schtasks.exe
2028	schtasks.exe
4856	schtasks.exe
4984	schtasks.exe
3056	schtasks.exe
2640	schtasks.exe
4284	schtasks.exe
3452	schtasks.exe
1248	schtasks.exe
2404	schtasks.exe
388	schtasks.exe
1504	schtasks.exe
208	schtasks.exe
1900	schtasks.exe
3916	schtasks.exe
3632	schtasks.exe
1156	schtasks.exe
3468	schtasks.exe
1552	schtasks.exe
1324	schtasks.exe
184	schtasks.exe
2496	schtasks.exe
1636	schtasks.exe
1040	schtasks.exe
4332	schtasks.exe
4676	schtasks.exe
2648	schtasks.exe
896	schtasks.exe
4504	schtasks.exe
1732	schtasks.exe
2840	schtasks.exe
516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
4368	DllCommonsvc.exe
1136	powershell.exe
1136	powershell.exe
3244	powershell.exe
3244	powershell.exe
2572	powershell.exe
2572	powershell.exe
3840	powershell.exe
3840	powershell.exe
3432	powershell.exe
3432	powershell.exe
4060	powershell.exe
4060	powershell.exe
2816	powershell.exe
2816	powershell.exe
3436	powershell.exe
3436	powershell.exe
3480	powershell.exe
3480	powershell.exe
2900	powershell.exe
2900	powershell.exe
1224	powershell.exe
1224	powershell.exe
3172	powershell.exe
3172	powershell.exe
3436	powershell.exe
3432	powershell.exe
3244	powershell.exe
4060	powershell.exe
2816	powershell.exe
3480	powershell.exe
2572	powershell.exe
2900	powershell.exe
1136	powershell.exe
1224	powershell.exe
3840	powershell.exe
3172	powershell.exe
3004	winlogon.exe
1320	winlogon.exe
4228	winlogon.exe
852	winlogon.exe
2628	winlogon.exe
1436	winlogon.exe
1396	winlogon.exe
4280	winlogon.exe
4812	winlogon.exe
4156	winlogon.exe
3436	winlogon.exe
4600	winlogon.exe
1032	winlogon.exe
1248	winlogon.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	DllCommonsvc.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	2816	powershell.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	3480	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	1224	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	3004	winlogon.exe
Token: SeDebugPrivilege	1320	winlogon.exe
Token: SeDebugPrivilege	4228	winlogon.exe
Token: SeDebugPrivilege	852	winlogon.exe
Token: SeDebugPrivilege	2628	winlogon.exe
Token: SeDebugPrivilege	1436	winlogon.exe
Token: SeDebugPrivilege	1396	winlogon.exe
Token: SeDebugPrivilege	4280	winlogon.exe
Token: SeDebugPrivilege	4812	winlogon.exe
Token: SeDebugPrivilege	4156	winlogon.exe
Token: SeDebugPrivilege	3436	winlogon.exe
Token: SeDebugPrivilege	4600	winlogon.exe
Token: SeDebugPrivilege	1032	winlogon.exe
Token: SeDebugPrivilege	1248	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4592	3124	JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe	82
PID 3124 wrote to memory of 4592	3124	JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe	82
PID 3124 wrote to memory of 4592	3124	JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe	82
PID 4592 wrote to memory of 4240	4592	WScript.exe	83
PID 4592 wrote to memory of 4240	4592	WScript.exe	83
PID 4592 wrote to memory of 4240	4592	WScript.exe	83
PID 4240 wrote to memory of 4368	4240	cmd.exe	85
PID 4240 wrote to memory of 4368	4240	cmd.exe	85
PID 4368 wrote to memory of 2900	4368	DllCommonsvc.exe	120
PID 4368 wrote to memory of 2900	4368	DllCommonsvc.exe	120
PID 4368 wrote to memory of 1136	4368	DllCommonsvc.exe	121
PID 4368 wrote to memory of 1136	4368	DllCommonsvc.exe	121
PID 4368 wrote to memory of 3436	4368	DllCommonsvc.exe	122
PID 4368 wrote to memory of 3436	4368	DllCommonsvc.exe	122
PID 4368 wrote to memory of 3244	4368	DllCommonsvc.exe	123
PID 4368 wrote to memory of 3244	4368	DllCommonsvc.exe	123
PID 4368 wrote to memory of 3840	4368	DllCommonsvc.exe	124
PID 4368 wrote to memory of 3840	4368	DllCommonsvc.exe	124
PID 4368 wrote to memory of 2816	4368	DllCommonsvc.exe	125
PID 4368 wrote to memory of 2816	4368	DllCommonsvc.exe	125
PID 4368 wrote to memory of 1224	4368	DllCommonsvc.exe	126
PID 4368 wrote to memory of 1224	4368	DllCommonsvc.exe	126
PID 4368 wrote to memory of 4060	4368	DllCommonsvc.exe	128
PID 4368 wrote to memory of 4060	4368	DllCommonsvc.exe	128
PID 4368 wrote to memory of 2572	4368	DllCommonsvc.exe	129
PID 4368 wrote to memory of 2572	4368	DllCommonsvc.exe	129
PID 4368 wrote to memory of 3432	4368	DllCommonsvc.exe	130
PID 4368 wrote to memory of 3432	4368	DllCommonsvc.exe	130
PID 4368 wrote to memory of 3172	4368	DllCommonsvc.exe	131
PID 4368 wrote to memory of 3172	4368	DllCommonsvc.exe	131
PID 4368 wrote to memory of 3480	4368	DllCommonsvc.exe	132
PID 4368 wrote to memory of 3480	4368	DllCommonsvc.exe	132
PID 4368 wrote to memory of 4788	4368	DllCommonsvc.exe	144
PID 4368 wrote to memory of 4788	4368	DllCommonsvc.exe	144
PID 4788 wrote to memory of 2692	4788	cmd.exe	146
PID 4788 wrote to memory of 2692	4788	cmd.exe	146
PID 4788 wrote to memory of 3004	4788	cmd.exe	147
PID 4788 wrote to memory of 3004	4788	cmd.exe	147
PID 3004 wrote to memory of 2468	3004	winlogon.exe	150
PID 3004 wrote to memory of 2468	3004	winlogon.exe	150
PID 2468 wrote to memory of 2892	2468	cmd.exe	152
PID 2468 wrote to memory of 2892	2468	cmd.exe	152
PID 2468 wrote to memory of 1320	2468	cmd.exe	155
PID 2468 wrote to memory of 1320	2468	cmd.exe	155
PID 1320 wrote to memory of 4988	1320	winlogon.exe	158
PID 1320 wrote to memory of 4988	1320	winlogon.exe	158
PID 4988 wrote to memory of 3732	4988	cmd.exe	160
PID 4988 wrote to memory of 3732	4988	cmd.exe	160
PID 4988 wrote to memory of 4228	4988	cmd.exe	162
PID 4988 wrote to memory of 4228	4988	cmd.exe	162
PID 4228 wrote to memory of 2520	4228	winlogon.exe	164
PID 4228 wrote to memory of 2520	4228	winlogon.exe	164
PID 2520 wrote to memory of 3076	2520	cmd.exe	166
PID 2520 wrote to memory of 3076	2520	cmd.exe	166
PID 2520 wrote to memory of 852	2520	cmd.exe	167
PID 2520 wrote to memory of 852	2520	cmd.exe	167
PID 852 wrote to memory of 1336	852	winlogon.exe	168
PID 852 wrote to memory of 1336	852	winlogon.exe	168
PID 1336 wrote to memory of 4244	1336	cmd.exe	170
PID 1336 wrote to memory of 4244	1336	cmd.exe	170
PID 1336 wrote to memory of 2628	1336	cmd.exe	171
PID 1336 wrote to memory of 2628	1336	cmd.exe	171
PID 2628 wrote to memory of 428	2628	winlogon.exe	172
PID 2628 wrote to memory of 428	2628	winlogon.exe	172

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_85cfbf1e77e7aa28552f5e95dd29349fdaf5094610a3068c46bc02b244a22fbe.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1136
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\MsEdgeCrashpad\reports\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsass.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IdentityCRL\production\SearchApp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\StartMenuExperienceHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3480
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lwGsKj7cdV.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4788
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2692
      - C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2892
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:3732
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:3076
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:4244
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eKnLpNzAx9.bat"
        15⤵
        
        PID:428
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        16⤵
        
        PID:1584
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mylROGge0S.bat"
        17⤵
        
        PID:3336
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        18⤵
        
        PID:1796
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat"
        19⤵
        
        PID:312
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:4912
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat"
        21⤵
        
        PID:4832
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:1828
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mylROGge0S.bat"
        23⤵
        
        PID:756
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        24⤵
        
        PID:2472
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MQa1PIx8rY.bat"
        25⤵
        
        PID:3076
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        26⤵
        
        PID:2496
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3436
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat"
        27⤵
        
        PID:3128
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        28⤵
        
        PID:4780
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat"
        29⤵
        
        PID:3996
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        30⤵
        
        PID:916
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1032
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat"
        31⤵
        
        PID:3396
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        32⤵
        
        PID:2040
        
        C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe
        
        "C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe"
        32⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\regid.1991-06.com.microsoft\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\providercommon\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\providercommon\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\providercommon\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\providercommon\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Windows\IdentityCRL\production\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\production\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\Windows\IdentityCRL\production\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\Tasks\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\providercommon\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\winlogon.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
232B

MD5
12e767dceff83d07886725473f0fabd6

SHA1
809c851519db9421dc00f7d96abf8cb707814fa5

SHA256
8168b0da198880b15a3ad4b4759481ce567ef789b6c084fca99d6a5245cc2a39

SHA512
3de536f3661d2a499a64b5dac8bf71e6256c5b36f0f1d6eec8cf524b4b7275afebadc3a318d1ca5a6423cb868feafb11a923145529704cf6bfd9c465c94fa545

Download Submit
C:\Users\Admin\AppData\Local\Temp\2wxi7FenmH.bat

Filesize
224B

MD5
556279e4cfe7051034b9ee1289f2a025

SHA1
67999d9336d38fd3388d67d780d97667ecc2ebcc

SHA256
c927ce2f67d77df0bf27cb86a276170d1d53cbfba949c8d8d7fe05e0e208df2a

SHA512
c350329938955d675a557ee2c9148456ae371c7c0d3d1d1fb22a5ad73c816dfea70de2bb7aa0c93c33934bdacc18b4c3ae5ca3d314b1050529f8b9b2cc1670c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6n1oUPmZQq.bat

Filesize
224B

MD5
db5a9feb6ee0274730ae775100117cad

SHA1
39ae87a5f802cb0246709fef91aecb44179cc683

SHA256
2fd46f6a8a214153b816520003361d519c6e09ecce37eb11785b8744d996e3a4

SHA512
b1aacb0a0f2e29740ced9a17536f575bdd4ee7cdbf884df2fb55122ec4bfa60a38d216a39d2f6a179e93357b88b1bf51f3d2e64704d60e3810c9d19635b01461

Download Submit
C:\Users\Admin\AppData\Local\Temp\HZWv28qLDz.bat

Filesize
224B

MD5
539da04c83fbfbc39a99c39e1cb58b29

SHA1
b6ce263ed6c96c4db14bf90ce824222c1850d075

SHA256
74adac2cf0c673d3a8022aa90f376936cf36accd7a9a01b2ef7321bcb3538fb8

SHA512
7c9e48a8ab6366ce214d230c7d092c2c32c4aff3637a7b54a61c7fd214400479bef5df0d3685bb8e04bb55e85b2fae454c00d127950dbbd22ef4963de2df12d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MQa1PIx8rY.bat

Filesize
224B

MD5
5f55b9b6495d6f96ba3d23a90df9604d

SHA1
48763628f290a4626b695f8cfec2a30e16286198

SHA256
1cde5404ccc8147be616d13b747ca89537fcaaa7a8bde8765a879a979d30e204

SHA512
669380ee7fa4c067bc37d00c33e714c7807d1e8179bf41ba67ecbb4308b04337633bc652ce557bffabfd96b0637eec645622154dab8b92dcd5105dec74f6fa0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0pmqe4fp.5mv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c38FLB8gIG.bat

Filesize
224B

MD5
a9babcb507eed4487782c5646d3b0380

SHA1
6d8b3327df6cf623a91d764917b86da550edc2b7

SHA256
1c3dfd2024f6bdf11ce35511456f600a6b81cd6ccf9cec92c78e1e143c152c3f

SHA512
8dd27e908502be000d3290db456145e72fe20e8b8a7726919a03e581fbc54d1ea052acea00763344c5d1583e564b098b72ab22e82a4cbef78b311989e28a2f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\eKnLpNzAx9.bat

Filesize
224B

MD5
86e060bf434f54988b81d938b91973ab

SHA1
5ca86ce6b0c132cf92d248604cba980e454283e3

SHA256
8b2a77732d2635b34bbce937f5301130a4937aff15fe78ec69d8b609760525b3

SHA512
f2da5aa16085dbf72b0c4309c6715330a9cd010984f25f29e3a8497f19ad8bf3535a5af047605a4758fcff75107aeddae0d935efc3e7543b309de559f160f01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gMBHdlpNUB.bat

Filesize
224B

MD5
55bf4e24a22b2c7d6d696f66f653debd

SHA1
e0ebe1074c0c22de079cc2fcbc29ad7479b258b6

SHA256
031fb034d6f2dc0ee89cda22e9397455576678b1989c98a72c1a156f8a9b882c

SHA512
201d76537fc10e011d26c690feb04a751a7f22e5df424894fb7cb2aaa3655eb02d799e09eb97735e59a6b1aa02f866fd9c124c7aa9bbf099b559a0074b205aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwGsKj7cdV.bat

Filesize
224B

MD5
63c269bb3784eb399af9a00ff5fc4269

SHA1
5d157ec6a7b7434df0d3b1b09ec3ba73c1f2b350

SHA256
b523cb5ac2bd60807185d713583acca63cacfc45e59208713cff50b3ddf13e77

SHA512
53895e0ce77ff1b3ddcd0f67d68db9e56fcd32b3ee202fb65ef326ab9102c9c54903c3fb05b9b8906e38acd34cb8d751d518ae364f160133f4fabfdafc19d1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\mylROGge0S.bat

Filesize
224B

MD5
27c6a15f3b2da740513a1c891d7292cd

SHA1
dc11529e876657a50fc77a71f4be805349f0f50d

SHA256
44ecf9db067af35988e83357c58a8d8c3e3f27d061a79140d3de503841e40a5d

SHA512
a124ae9cb902ef6588b11e35014ad58087aaa703b4d26164b04fd0955a356a883c4014d3925dd119a0f785ffd8a77c7b3c9976e7604340b768a9bc0ce78e3250

Download Submit
C:\Users\Admin\AppData\Local\Temp\o09MCfWrWU.bat

Filesize
224B

MD5
64dd3fec699a866a9f9ade05b40241c9

SHA1
d1d2750cdf6dcaeabddbdac9289d98de92f9acdc

SHA256
a551f7735a23f7f178f725b2b3c8a050604d319eebd8a5ffbcfd861cf5c51c77

SHA512
cbf5fce805903f52f45b3913e41605340f7683e665e73a47d083ffbbe5b9e706171e961d2ba6dbfbe94ceed7085aaec14a0705da2e2e93de7304a36775a10d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat

Filesize
224B

MD5
21298427a98bfeba8394fe935895a4b7

SHA1
e92d72d425948673996be0fe7de44e87eaccd0e4

SHA256
5c88173dcfcda85c27b8c51edc3b47b786cf835b33f7ad420bd887c8965e4749

SHA512
a7358f834c7ac07d9ac90097d018bd073bb3e3f5e5ff0f5b57d120c66afbe945eaf92001d343f8ca92b3d3ba3f232f3e109d1f3a3d038c409a9fcce408e1f38c

Download Submit
C:\Users\Admin\AppData\Local\Temp\uxMZkGAiOs.bat

Filesize
224B

MD5
fff8ebe6e197f351b89729646b940dd8

SHA1
3959e973a44db79e5d94f13bb5e3d8592f28defa

SHA256
19c720056e872384f55337f1768f0904935670a3ed7342740b09d9044a3594d0

SHA512
3ae8f8078bc86dd5ef93e3c9ced805343edb57c1959ec5994637302f6e00e2635c68c7dd7fd612d250d3c0eabd8f3c568596214e08ca2f9419aa72a99542892c

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4tck5X09i.bat

Filesize
224B

MD5
1ba25442b1f0f1a1b2d337cd940c72ab

SHA1
84f06d062b0b0b51452dfb7dae9bd43f7976c898

SHA256
68d2051c9aafe20c3bf984256aa858e509e8c9ace5cdcbd4276901b12ff572aa

SHA512
b161f568dd5b751699a3f14d49919819a8a6fc53bb2af0958d2a66df5b40d406b0855d3e95a2e25e30eaa80eb51f7e08c1400f587adc1477bf04c05e4732d237

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/1248-265-0x00000000030B0000-0x00000000030C2000-memory.dmp

Filesize
72KB

Download
memory/2572-54-0x000001C540190000-0x000001C5401B2000-memory.dmp

Filesize
136KB

Download
memory/3436-246-0x0000000002D50000-0x0000000002D62000-memory.dmp

Filesize
72KB

Download
memory/4228-197-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/4368-13-0x0000000000DB0000-0x0000000000EC0000-memory.dmp

Filesize
1.1MB

Download
memory/4368-16-0x00000000017D0000-0x00000000017DC000-memory.dmp

Filesize
48KB

Download
memory/4368-17-0x00000000017E0000-0x00000000017EC000-memory.dmp

Filesize
48KB

Download
memory/4368-15-0x00000000017A0000-0x00000000017AC000-memory.dmp

Filesize
48KB

Download
memory/4368-14-0x0000000001790000-0x00000000017A2000-memory.dmp

Filesize
72KB

Download
memory/4368-12-0x00007FF819FB3000-0x00007FF819FB5000-memory.dmp

Filesize
8KB

Download