dcrat | d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe
Size

1.3MB
MD5

13ea626d2883cbda1309e7cebdb11418
SHA1

cf461b5338661a1a43a422dc1389d08177ab1c79
SHA256

d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad
SHA512

889a0d246d0f8b65568868da5d510b3155f5e3352611700cc96c557cc647181adf5e3f2a6c9e4568fe7218ca4847dcd2acf9d0bbc70455d43762280f95ef981f
SSDEEP

24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Score

10^/10

dcrat discovery execution infostealer rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5108	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4052	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5004	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4644	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4200	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	220	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4996	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4928	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3548	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3580	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	828	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5028	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4840	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2980	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	1660	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1332	1660	schtasks.exe	88

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/files/0x000a000000023b72-10.dat	dcrat
behavioral2/memory/3028-13-0x0000000000190000-0x00000000002A0000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3996	powershell.exe
884	powershell.exe
4324	powershell.exe
1816	powershell.exe
1956	powershell.exe
3172	powershell.exe
1116	powershell.exe
1160	powershell.exe
2256	powershell.exe
3472	powershell.exe
1580	powershell.exe
1404	powershell.exe
3432	powershell.exe
4116	powershell.exe

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	DllCommonsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Idle.exe

Executes dropped EXE 15 IoCs

pid	Process
3028	DllCommonsvc.exe
312	Idle.exe
2416	Idle.exe
3116	Idle.exe
3036	Idle.exe
2468	Idle.exe
4628	Idle.exe
5080	Idle.exe
4644	Idle.exe
3012	Idle.exe
4016	Idle.exe
5012	Idle.exe
4008	Idle.exe
4720	Idle.exe
4236	Idle.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs

Web Service

T1102

flow	ioc
41	raw.githubusercontent.com
43	raw.githubusercontent.com
56	raw.githubusercontent.com
17	raw.githubusercontent.com
46	raw.githubusercontent.com
45	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com
53	raw.githubusercontent.com
25	raw.githubusercontent.com
28	raw.githubusercontent.com
40	raw.githubusercontent.com
57	raw.githubusercontent.com
18	raw.githubusercontent.com

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\e6c9b481da804f	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\upfc.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\ea1d8f6d871115	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\SppExtComObj.exe	DllCommonsvc.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\e1ef82546f0b02	DllCommonsvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\Idle.exe	DllCommonsvc.exe
File created	C:\Windows\Downloaded Program Files\6ccacd8608530f	DllCommonsvc.exe
File created	C:\Windows\Logs\WindowsUpdate\spoolsv.exe	DllCommonsvc.exe
File created	C:\Windows\Logs\WindowsUpdate\f3b6ecef712a24	DllCommonsvc.exe
File created	C:\Windows\LanguageOverlayCache\upfc.exe	DllCommonsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings	Idle.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4536	schtasks.exe
1220	schtasks.exe
4660	schtasks.exe
2668	schtasks.exe
116	schtasks.exe
828	schtasks.exe
2488	schtasks.exe
4840	schtasks.exe
2020	schtasks.exe
1332	schtasks.exe
4628	schtasks.exe
1624	schtasks.exe
4928	schtasks.exe
1724	schtasks.exe
2872	schtasks.exe
1952	schtasks.exe
4644	schtasks.exe
372	schtasks.exe
2980	schtasks.exe
4200	schtasks.exe
5080	schtasks.exe
4996	schtasks.exe
4248	schtasks.exe
3548	schtasks.exe
3580	schtasks.exe
5108	schtasks.exe
1380	schtasks.exe
4052	schtasks.exe
3584	schtasks.exe
4860	schtasks.exe
3268	schtasks.exe
5052	schtasks.exe
5004	schtasks.exe
808	schtasks.exe
1932	schtasks.exe
4140	schtasks.exe
220	schtasks.exe
1616	schtasks.exe
5028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3028	DllCommonsvc.exe
3432	powershell.exe
3432	powershell.exe
1956	powershell.exe
1956	powershell.exe
4324	powershell.exe
4324	powershell.exe
1580	powershell.exe
1580	powershell.exe
1160	powershell.exe
1160	powershell.exe
1404	powershell.exe
1404	powershell.exe
3172	powershell.exe
3172	powershell.exe
3472	powershell.exe
3472	powershell.exe
4116	powershell.exe
4116	powershell.exe
2256	powershell.exe
2256	powershell.exe
4324	powershell.exe
884	powershell.exe
884	powershell.exe
884	powershell.exe
1816	powershell.exe
1816	powershell.exe
3996	powershell.exe
3996	powershell.exe
1116	powershell.exe
1116	powershell.exe
312	Idle.exe
312	Idle.exe
3432	powershell.exe
1580	powershell.exe
1160	powershell.exe
1956	powershell.exe
1116	powershell.exe
1816	powershell.exe
1404	powershell.exe
3172	powershell.exe
4116	powershell.exe
3472	powershell.exe
2256	powershell.exe
3996	powershell.exe
2416	Idle.exe
3116	Idle.exe
3036	Idle.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	DllCommonsvc.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	1956	powershell.exe
Token: SeDebugPrivilege	1580	powershell.exe
Token: SeDebugPrivilege	884	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	1816	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe
Token: SeDebugPrivilege	312	Idle.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	3996	powershell.exe
Token: SeDebugPrivilege	2416	Idle.exe
Token: SeDebugPrivilege	3116	Idle.exe
Token: SeDebugPrivilege	3036	Idle.exe
Token: SeDebugPrivilege	2468	Idle.exe
Token: SeDebugPrivilege	4628	Idle.exe
Token: SeDebugPrivilege	5080	Idle.exe
Token: SeDebugPrivilege	4644	Idle.exe
Token: SeDebugPrivilege	3012	Idle.exe
Token: SeDebugPrivilege	4016	Idle.exe
Token: SeDebugPrivilege	5012	Idle.exe
Token: SeDebugPrivilege	4008	Idle.exe
Token: SeDebugPrivilege	4720	Idle.exe
Token: SeDebugPrivilege	4236	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2064	4784	JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe	83
PID 4784 wrote to memory of 2064	4784	JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe	83
PID 4784 wrote to memory of 2064	4784	JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe	83
PID 2064 wrote to memory of 1640	2064	WScript.exe	85
PID 2064 wrote to memory of 1640	2064	WScript.exe	85
PID 2064 wrote to memory of 1640	2064	WScript.exe	85
PID 1640 wrote to memory of 3028	1640	cmd.exe	87
PID 1640 wrote to memory of 3028	1640	cmd.exe	87
PID 3028 wrote to memory of 3996	3028	DllCommonsvc.exe	129
PID 3028 wrote to memory of 3996	3028	DllCommonsvc.exe	129
PID 3028 wrote to memory of 1580	3028	DllCommonsvc.exe	130
PID 3028 wrote to memory of 1580	3028	DllCommonsvc.exe	130
PID 3028 wrote to memory of 1956	3028	DllCommonsvc.exe	131
PID 3028 wrote to memory of 1956	3028	DllCommonsvc.exe	131
PID 3028 wrote to memory of 3172	3028	DllCommonsvc.exe	132
PID 3028 wrote to memory of 3172	3028	DllCommonsvc.exe	132
PID 3028 wrote to memory of 1160	3028	DllCommonsvc.exe	133
PID 3028 wrote to memory of 1160	3028	DllCommonsvc.exe	133
PID 3028 wrote to memory of 2256	3028	DllCommonsvc.exe	134
PID 3028 wrote to memory of 2256	3028	DllCommonsvc.exe	134
PID 3028 wrote to memory of 884	3028	DllCommonsvc.exe	135
PID 3028 wrote to memory of 884	3028	DllCommonsvc.exe	135
PID 3028 wrote to memory of 1404	3028	DllCommonsvc.exe	136
PID 3028 wrote to memory of 1404	3028	DllCommonsvc.exe	136
PID 3028 wrote to memory of 3432	3028	DllCommonsvc.exe	137
PID 3028 wrote to memory of 3432	3028	DllCommonsvc.exe	137
PID 3028 wrote to memory of 1116	3028	DllCommonsvc.exe	138
PID 3028 wrote to memory of 1116	3028	DllCommonsvc.exe	138
PID 3028 wrote to memory of 4324	3028	DllCommonsvc.exe	139
PID 3028 wrote to memory of 4324	3028	DllCommonsvc.exe	139
PID 3028 wrote to memory of 4116	3028	DllCommonsvc.exe	140
PID 3028 wrote to memory of 4116	3028	DllCommonsvc.exe	140
PID 3028 wrote to memory of 3472	3028	DllCommonsvc.exe	141
PID 3028 wrote to memory of 3472	3028	DllCommonsvc.exe	141
PID 3028 wrote to memory of 1816	3028	DllCommonsvc.exe	142
PID 3028 wrote to memory of 1816	3028	DllCommonsvc.exe	142
PID 3028 wrote to memory of 312	3028	DllCommonsvc.exe	156
PID 3028 wrote to memory of 312	3028	DllCommonsvc.exe	156
PID 312 wrote to memory of 2672	312	Idle.exe	162
PID 312 wrote to memory of 2672	312	Idle.exe	162
PID 2672 wrote to memory of 3184	2672	cmd.exe	164
PID 2672 wrote to memory of 3184	2672	cmd.exe	164
PID 2672 wrote to memory of 2416	2672	cmd.exe	168
PID 2672 wrote to memory of 2416	2672	cmd.exe	168
PID 2416 wrote to memory of 1480	2416	Idle.exe	174
PID 2416 wrote to memory of 1480	2416	Idle.exe	174
PID 1480 wrote to memory of 2348	1480	cmd.exe	176
PID 1480 wrote to memory of 2348	1480	cmd.exe	176
PID 1480 wrote to memory of 3116	1480	cmd.exe	178
PID 1480 wrote to memory of 3116	1480	cmd.exe	178
PID 3116 wrote to memory of 4500	3116	Idle.exe	182
PID 3116 wrote to memory of 4500	3116	Idle.exe	182
PID 4500 wrote to memory of 4828	4500	cmd.exe	184
PID 4500 wrote to memory of 4828	4500	cmd.exe	184
PID 4500 wrote to memory of 3036	4500	cmd.exe	187
PID 4500 wrote to memory of 3036	4500	cmd.exe	187
PID 3036 wrote to memory of 912	3036	Idle.exe	189
PID 3036 wrote to memory of 912	3036	Idle.exe	189
PID 912 wrote to memory of 1092	912	cmd.exe	191
PID 912 wrote to memory of 1092	912	cmd.exe	191
PID 912 wrote to memory of 2468	912	cmd.exe	193
PID 912 wrote to memory of 2468	912	cmd.exe	193
PID 2468 wrote to memory of 2716	2468	Idle.exe	195
PID 2468 wrote to memory of 2716	2468	Idle.exe	195

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d981902835b82db6148a861088607f5025b17f685d96d3024bb2a9bfa139e8ad.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\providercommon\DllCommonsvc.exe
      "C:\providercommon\DllCommonsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3996
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\Idle.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\RuntimeBroker.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:884
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\upfc.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\WindowsUpdate\spoolsv.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\dwm.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
    - - C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:312
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LdN2yJpTNi.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3184
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CZdmQsnKkU.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:2348
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        11⤵
        
        PID:4828
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:1092
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat"
        14⤵
        
        PID:2716
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:3832
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4628
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MUFyTxLHSg.bat"
        16⤵
        
        PID:2492
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        17⤵
        
        PID:3704
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat"
        18⤵
        
        PID:3324
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        19⤵
        
        PID:4808
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4644
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UMVEid32eq.bat"
        20⤵
        
        PID:4948
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        21⤵
        
        PID:4624
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat"
        22⤵
        
        PID:752
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        23⤵
        
        PID:3472
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4016
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat"
        24⤵
        
        PID:376
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        25⤵
        
        PID:1800
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5012
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat"
        26⤵
        
        PID:1416
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        27⤵
        
        PID:1424
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7kLsQlNPpi.bat"
        28⤵
        
        PID:3988
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        29⤵
        
        PID:1268
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat"
        30⤵
        
        PID:4420
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        31⤵
        
        PID:1408
        
        C:\Windows\Downloaded Program Files\Idle.exe
        
        "C:\Windows\Downloaded Program Files\Idle.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\providercommon\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\providercommon\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\Downloaded Program Files\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Windows\Downloaded Program Files\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Default\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\providercommon\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\providercommon\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\Logs\WindowsUpdate\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Logs\WindowsUpdate\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\WindowsUpdate\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\Public\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Idle.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9c172d22fbbdafe12dfc5c909edea107

SHA1
9961cfc5a51f1d375186fc64bf98214bdc0cf2df

SHA256
315439a1131019ecb316a0344395624965a961baff563be19221620e6e3dc18d

SHA512
d459ca5a3abd05b5bff39056065e786eec0260cb83b03c774ab0b98f07dfc8ef7dd5db5f37c569ac0d531ebd640c6dc0aaefc407d357280e07b011e982b91e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
bd5940f08d0be56e65e5f2aaf47c538e

SHA1
d7e31b87866e5e383ab5499da64aba50f03e8443

SHA256
2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

SHA512
c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cadef9abd087803c630df65264a6c81c

SHA1
babbf3636c347c8727c35f3eef2ee643dbcc4bd2

SHA256
cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

SHA512
7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\0xFiNVDkrN.bat

Filesize
209B

MD5
2ea28337708238d5568814c061c5cbaf

SHA1
28cc66b2b265868b8832a3e7f9095c41ca7f2c83

SHA256
56a4e812cc15317d3a4bb0a8995c99ae213cd53523d2bc426c98f534b8758ae9

SHA512
9ff4f55bcdc53216a5becde98910e4fa09c0a9c3a39a3158bcfe4d705bcfa86b7771f8e97c0af0110146bc6a06e969e6d4f7bf56dd5b1dc0fd79c702960f812f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7kLsQlNPpi.bat

Filesize
209B

MD5
8f9258d91871f5e798343299609a498a

SHA1
a08315626888f16990179988f680159f903e42fd

SHA256
01d25a55b1f844b9bebaf1063c0a3ca9a96a34418be83e8caf1a35ce3b0ed9b4

SHA512
c826e45de5ca251847e4a442a303694e8ab19452c49257584d2b631d36f5563c8c0672be586ee4a9df9c8a16e1c450e729dce62acc3b979478e4d94d2e0966dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CZdmQsnKkU.bat

Filesize
209B

MD5
5854aafc6561f82197ccb9af8e76a9d0

SHA1
507fa9d3d1dcb11a9391ece9601f73a377d1f6ec

SHA256
6f211e4b45824ae7ee403c04056a795cfb675d49592bf65945ba80e62534cb92

SHA512
a90945f329ae7251ffaa6db50880b86c114dc048b19f65b999a533b7b7b76291e4c0c2d2b78f9c36d37c689a1043db6d320d06705de419f8a395514f2c32b625

Download Submit
C:\Users\Admin\AppData\Local\Temp\EVfp7xrD4G.bat

Filesize
209B

MD5
760dd9d21030a7702a5b82998afb02d6

SHA1
98335de1400f4e53e3863397d628e1beb188b301

SHA256
5532762bb6751f207d812337a6b3c8546e74d0b305c6c933907f87a2ebc64a9e

SHA512
636e9ffadcc4f2f80545cbe4695313130873c3dcf39889ce9c5d5918fd00be0b843293f7d1950c7525a152bd6dbea850111340f7b14fdd59e4de5c3dc65a707f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GRgsn2v6O3.bat

Filesize
209B

MD5
1a5125de919279b52f728751a80a9c4e

SHA1
8d9ff1eaa092dba07ac26e67cf3daf12d3b8fca9

SHA256
895a5b858813d0721e0f7d8cf8d4ff98fec713024b0c561a7c793a77e9521ac3

SHA512
e730d2f1bf1511fa08232fa103580bd68f553085a3ab60d13256efc893a8402565c3944f130e3c3c5ed66e83dfb199ded1dc4a5cfcd73fda996714a3781d873c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LdN2yJpTNi.bat

Filesize
209B

MD5
d6c6f0c76453c4e1d2372d8cb2c8229d

SHA1
c8b7a3158d3027aad11a21bb4023441de861ce5f

SHA256
fecb204f0c891a5155e40eb216876fbf1aded78ce4771fb3a84ce8abeb581d0b

SHA512
a4112132938895c370cff951ffbd0cad18d39ff9eeb9da2f04587913568b59bc1bf8583f25219f367ccd2b3c56dd86749197176dfa0a1808a1a9f8d2ee43deb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MUFyTxLHSg.bat

Filesize
209B

MD5
3bf313f0105e7a3118417011b5f2cac7

SHA1
bcb612a7ed8c3183bd98df1326f0c062d26ee876

SHA256
8807d5046c92dc29fcdff3ff4573874c0080a7be1899c2bf9613dbe2981a2d9f

SHA512
de68bbd899c968a52f041c228a41cf8694b560cdc9ccd93d0ed6987159d37c5da48bad8a2001f79bb1e4176a5d074a2f081093b04f79bec886d7d76fba85487f

Download Submit
C:\Users\Admin\AppData\Local\Temp\UMVEid32eq.bat

Filesize
209B

MD5
9b29b65990f719338136334b017104d6

SHA1
02023edbf5f2cb77cbf695eda8ef6fdd7cc2e1f0

SHA256
55b4c10d6d02cfc57c73e61eaf65389a56ddb60d76692231da43c39351689148

SHA512
79c304e8a2c3e3c0ad6767ba10d57138eeac4582ae77c51b8a8a1b09297d0a0ffe4d59e75734c4070de92ec11c1421e67e2c832a17dabe8d47c73e5e5694824c

Download Submit
C:\Users\Admin\AppData\Local\Temp\YKuCD7w8Ue.bat

Filesize
209B

MD5
f922c6744143fa8e2e9b05095706a929

SHA1
ec9465e28f442c08253e9ad8d10d2a4a6dbe08d6

SHA256
07469161b53cbf980cb90a7ccde4c1622f4249befb3bac6510e9d711c260b854

SHA512
dad30f6e3ce5cfdeda3f6c3617c1dbdf7246efa067bdf21759778b8d10907c4b389b591caa71f1689e52344ab342a4c906b00c3f3287788f532c7942de5f300a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2tv1uixs.0bn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\kz4ReWEb5Y.bat

Filesize
209B

MD5
d9f5ef34c799127144c723c0199ab5b0

SHA1
c33ee77943c3e7e1a28efb7e107612c01a4eb996

SHA256
6bd8c3ad6edfd5dff14bd2bd819b33124db9fdfcdc5c88be6615ea2c57b87428

SHA512
152ed6bf90c271c85805a22910ffec152ff210e16bad5798a6be3fc698033fe1ee15599a24efd56403472a73f51ed4373e5c122312e20d69d7e3536ccd236bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\qtVTp5BaF9.bat

Filesize
209B

MD5
1e5c5508069ba6bc085666ca3a06b7d7

SHA1
da0660c62c47065a58336fd5782ce20c31f761a0

SHA256
9e47eb789fd97d6a3246eb6fd53f247db6c474345861efbbf6c52b5735dc8fa8

SHA512
58100402cb6c2448265898b5db34f7ebfcea52a4fdb34391c4b1d91c9e1b2034a324d32df30ec5dde22cb2833800f90be4a7fdb38cddbc1d4e3efda9345b47a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\syea0WjfTx.bat

Filesize
209B

MD5
5acc26bdd8232adc133bbb101cc512a3

SHA1
cd56ee4489475773e2aef29b1409df9e5e4cb7b8

SHA256
73f25e8381971f32fbc2c9dab970a73b03900221b9e5202f285178ce249f2533

SHA512
0df89bbce91c43ee62682c9cdb53c163c3ea4626deadacecb1a7ea73905708e2010e355f5933729ff0dd26e2a4f9231c45d9bf089e5d83cc944e9d88697b5aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\vlZZCFJNsh.bat

Filesize
209B

MD5
d921cdba4e31cc58e8d3a3137309270b

SHA1
e5a2be9b5f54b1bcbb2fc16d19be93dfdd936043

SHA256
1f3b29e8f64d8d0e0d77c147ada09e4ea124ca6dcfcd68c062696f6c368acc73

SHA512
a2ce461750d93f3c97cfcb09974490fb79e5cbb32d71afaf37dcb7e60f807c4b19cfa96f53b29c09326606f048fb173bc187020f181950720e7be282d7c4ecb3

Download Submit
C:\providercommon\1zu9dW.bat

Filesize
36B

MD5
6783c3ee07c7d151ceac57f1f9c8bed7

SHA1
17468f98f95bf504cc1f83c49e49a78526b3ea03

SHA256
8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

SHA512
c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

Download Submit
C:\providercommon\DllCommonsvc.exe

Filesize
1.0MB

MD5
bd31e94b4143c4ce49c17d3af46bcad0

SHA1
f8c51ff3ff909531d9469d4ba1bbabae101853ff

SHA256
b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

SHA512
f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

Download Submit
C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

Filesize
197B

MD5
8088241160261560a02c84025d107592

SHA1
083121f7027557570994c9fc211df61730455bb5

SHA256
2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

SHA512
20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

Download Submit
memory/312-124-0x0000000000DC0000-0x0000000000DD2000-memory.dmp

Filesize
72KB

Download
memory/2416-224-0x000000001C590000-0x000000001C6FA000-memory.dmp

Filesize
1.4MB

Download
memory/2468-245-0x000000001C7A0000-0x000000001C949000-memory.dmp

Filesize
1.7MB

Download
memory/3028-14-0x0000000000A70000-0x0000000000A82000-memory.dmp

Filesize
72KB

Download
memory/3028-16-0x0000000002380000-0x000000000238C000-memory.dmp

Filesize
48KB

Download
memory/3028-15-0x0000000002390000-0x000000000239C000-memory.dmp

Filesize
48KB

Download
memory/3028-17-0x00000000023B0000-0x00000000023BC000-memory.dmp

Filesize
48KB

Download
memory/3028-13-0x0000000000190000-0x00000000002A0000-memory.dmp

Filesize
1.1MB

Download
memory/3028-12-0x00007FF8A7DC3000-0x00007FF8A7DC5000-memory.dmp

Filesize
8KB

Download
memory/3036-238-0x000000001BD30000-0x000000001BED9000-memory.dmp

Filesize
1.7MB

Download
memory/3116-231-0x000000001BC50000-0x000000001BDBA000-memory.dmp

Filesize
1.4MB

Download
memory/3432-73-0x0000015312620000-0x0000015312642000-memory.dmp

Filesize
136KB

Download
memory/4628-253-0x000000001C6D0000-0x000000001C879000-memory.dmp

Filesize
1.7MB

Download
memory/4628-248-0x00000000012E0000-0x00000000012F2000-memory.dmp

Filesize
72KB

Download
memory/4720-294-0x0000000000AF0000-0x0000000000B02000-memory.dmp

Filesize
72KB

Download
memory/5012-281-0x0000000002F10000-0x0000000002F22000-memory.dmp

Filesize
72KB

Download
memory/5080-260-0x000000001C0B0000-0x000000001C259000-memory.dmp

Filesize
1.7MB

Download