Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 09:20
Behavioral task
behavioral1
Sample
JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe
-
Size
1.3MB
-
MD5
7b1665d6e5a4ce946c41b3d25755528a
-
SHA1
b97cc550f41a8362944374b980ea9681bc7770e8
-
SHA256
621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8
-
SHA512
091c978eb2e2bfc43550e0a3c79c9959055c88dae92b0e05fdf01efc7449292ed8e54ee565065dc34257fa429b7b448f2ba2b795f3ff32c43443c994c0d69fc7
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2988 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3440 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4640 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3148 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3432 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1500 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 508 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2072 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4652 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2564 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3400 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3080 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3752 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2068 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1860 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4532 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3268 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 884 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3116 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4404 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1148 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2312 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2552 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2604 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2568 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3420 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 32 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 1796 schtasks.exe 86 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1504 1796 schtasks.exe 86 -
resource yara_rule behavioral2/files/0x0007000000023cb6-10.dat dcrat behavioral2/memory/4812-13-0x0000000000160000-0x0000000000270000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 368 powershell.exe 1620 powershell.exe 3836 powershell.exe 2732 powershell.exe 4248 powershell.exe 3960 powershell.exe 3100 powershell.exe 224 powershell.exe 1848 powershell.exe 2744 powershell.exe 1268 powershell.exe 1556 powershell.exe -
Checks computer location settings 2 TTPs 17 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation taskhostw.exe -
Executes dropped EXE 15 IoCs
pid Process 4812 DllCommonsvc.exe 3368 taskhostw.exe 1636 taskhostw.exe 1720 taskhostw.exe 208 taskhostw.exe 4112 taskhostw.exe 2564 taskhostw.exe 3080 taskhostw.exe 3384 taskhostw.exe 2776 taskhostw.exe 3376 taskhostw.exe 4072 taskhostw.exe 3056 taskhostw.exe 1516 taskhostw.exe 1788 taskhostw.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 17 raw.githubusercontent.com 26 raw.githubusercontent.com 41 raw.githubusercontent.com 45 raw.githubusercontent.com 55 raw.githubusercontent.com 16 raw.githubusercontent.com 35 raw.githubusercontent.com 46 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 57 raw.githubusercontent.com 56 raw.githubusercontent.com 40 raw.githubusercontent.com 47 raw.githubusercontent.com 58 raw.githubusercontent.com -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Reference Assemblies\Microsoft\ee2ad38f3d4382 DllCommonsvc.exe File created C:\Program Files\Crashpad\attachments\unsecapp.exe DllCommonsvc.exe File created C:\Program Files\Crashpad\attachments\29c1c3cc0f7685 DllCommonsvc.exe File created C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe DllCommonsvc.exe File created C:\Program Files\Microsoft Office 15\ClientX64\66fc9ff0ee96c2 DllCommonsvc.exe File created C:\Program Files\Reference Assemblies\Microsoft\Registry.exe DllCommonsvc.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Installer\spoolsv.exe DllCommonsvc.exe File opened for modification C:\Windows\Installer\spoolsv.exe DllCommonsvc.exe File created C:\Windows\Installer\f3b6ecef712a24 DllCommonsvc.exe File created C:\Windows\System\Speech\Idle.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskhostw.exe Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings DllCommonsvc.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3080 schtasks.exe 2604 schtasks.exe 2568 schtasks.exe 32 schtasks.exe 1504 schtasks.exe 2412 schtasks.exe 3268 schtasks.exe 4404 schtasks.exe 2312 schtasks.exe 1860 schtasks.exe 2552 schtasks.exe 3420 schtasks.exe 3432 schtasks.exe 508 schtasks.exe 3400 schtasks.exe 2692 schtasks.exe 3440 schtasks.exe 4652 schtasks.exe 2564 schtasks.exe 2072 schtasks.exe 1148 schtasks.exe 2320 schtasks.exe 3752 schtasks.exe 4532 schtasks.exe 2676 schtasks.exe 884 schtasks.exe 1500 schtasks.exe 2068 schtasks.exe 4656 schtasks.exe 2988 schtasks.exe 4640 schtasks.exe 3148 schtasks.exe 3116 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 4812 DllCommonsvc.exe 1848 powershell.exe 1848 powershell.exe 3960 powershell.exe 3960 powershell.exe 368 powershell.exe 368 powershell.exe 1620 powershell.exe 1620 powershell.exe 1556 powershell.exe 1556 powershell.exe 2732 powershell.exe 2732 powershell.exe 224 powershell.exe 224 powershell.exe 1268 powershell.exe 1268 powershell.exe 3100 powershell.exe 3100 powershell.exe 4248 powershell.exe 4248 powershell.exe 2744 powershell.exe 2744 powershell.exe 3836 powershell.exe 3836 powershell.exe 2732 powershell.exe 3960 powershell.exe 1620 powershell.exe 1848 powershell.exe 224 powershell.exe 1556 powershell.exe 368 powershell.exe 3100 powershell.exe 3836 powershell.exe 1268 powershell.exe 4248 powershell.exe 2744 powershell.exe 3368 taskhostw.exe 1636 taskhostw.exe 1720 taskhostw.exe 208 taskhostw.exe 4112 taskhostw.exe 2564 taskhostw.exe 3080 taskhostw.exe 3384 taskhostw.exe 2776 taskhostw.exe 3376 taskhostw.exe 4072 taskhostw.exe 3056 taskhostw.exe 1516 taskhostw.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 4812 DllCommonsvc.exe Token: SeDebugPrivilege 1848 powershell.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 368 powershell.exe Token: SeDebugPrivilege 1620 powershell.exe Token: SeDebugPrivilege 224 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 1556 powershell.exe Token: SeDebugPrivilege 1268 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 4248 powershell.exe Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 3836 powershell.exe Token: SeDebugPrivilege 3368 taskhostw.exe Token: SeDebugPrivilege 1636 taskhostw.exe Token: SeDebugPrivilege 1720 taskhostw.exe Token: SeDebugPrivilege 208 taskhostw.exe Token: SeDebugPrivilege 4112 taskhostw.exe Token: SeDebugPrivilege 2564 taskhostw.exe Token: SeDebugPrivilege 3080 taskhostw.exe Token: SeDebugPrivilege 3384 taskhostw.exe Token: SeDebugPrivilege 2776 taskhostw.exe Token: SeDebugPrivilege 3376 taskhostw.exe Token: SeDebugPrivilege 4072 taskhostw.exe Token: SeDebugPrivilege 3056 taskhostw.exe Token: SeDebugPrivilege 1516 taskhostw.exe Token: SeDebugPrivilege 1788 taskhostw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 5092 816 JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe 82 PID 816 wrote to memory of 5092 816 JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe 82 PID 816 wrote to memory of 5092 816 JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe 82 PID 5092 wrote to memory of 4916 5092 WScript.exe 83 PID 5092 wrote to memory of 4916 5092 WScript.exe 83 PID 5092 wrote to memory of 4916 5092 WScript.exe 83 PID 4916 wrote to memory of 4812 4916 cmd.exe 85 PID 4916 wrote to memory of 4812 4916 cmd.exe 85 PID 4812 wrote to memory of 368 4812 DllCommonsvc.exe 120 PID 4812 wrote to memory of 368 4812 DllCommonsvc.exe 120 PID 4812 wrote to memory of 3100 4812 DllCommonsvc.exe 121 PID 4812 wrote to memory of 3100 4812 DllCommonsvc.exe 121 PID 4812 wrote to memory of 1620 4812 DllCommonsvc.exe 122 PID 4812 wrote to memory of 1620 4812 DllCommonsvc.exe 122 PID 4812 wrote to memory of 224 4812 DllCommonsvc.exe 123 PID 4812 wrote to memory of 224 4812 DllCommonsvc.exe 123 PID 4812 wrote to memory of 1848 4812 DllCommonsvc.exe 124 PID 4812 wrote to memory of 1848 4812 DllCommonsvc.exe 124 PID 4812 wrote to memory of 2744 4812 DllCommonsvc.exe 125 PID 4812 wrote to memory of 2744 4812 DllCommonsvc.exe 125 PID 4812 wrote to memory of 3836 4812 DllCommonsvc.exe 126 PID 4812 wrote to memory of 3836 4812 DllCommonsvc.exe 126 PID 4812 wrote to memory of 2732 4812 DllCommonsvc.exe 127 PID 4812 wrote to memory of 2732 4812 DllCommonsvc.exe 127 PID 4812 wrote to memory of 4248 4812 DllCommonsvc.exe 128 PID 4812 wrote to memory of 4248 4812 DllCommonsvc.exe 128 PID 4812 wrote to memory of 3960 4812 DllCommonsvc.exe 129 PID 4812 wrote to memory of 3960 4812 DllCommonsvc.exe 129 PID 4812 wrote to memory of 1268 4812 DllCommonsvc.exe 130 PID 4812 wrote to memory of 1268 4812 DllCommonsvc.exe 130 PID 4812 wrote to memory of 1556 4812 DllCommonsvc.exe 131 PID 4812 wrote to memory of 1556 4812 DllCommonsvc.exe 131 PID 4812 wrote to memory of 4724 4812 DllCommonsvc.exe 144 PID 4812 wrote to memory of 4724 4812 DllCommonsvc.exe 144 PID 4724 wrote to memory of 4796 4724 cmd.exe 146 PID 4724 wrote to memory of 4796 4724 cmd.exe 146 PID 4724 wrote to memory of 3368 4724 cmd.exe 150 PID 4724 wrote to memory of 3368 4724 cmd.exe 150 PID 3368 wrote to memory of 2464 3368 taskhostw.exe 154 PID 3368 wrote to memory of 2464 3368 taskhostw.exe 154 PID 2464 wrote to memory of 2936 2464 cmd.exe 156 PID 2464 wrote to memory of 2936 2464 cmd.exe 156 PID 2464 wrote to memory of 1636 2464 cmd.exe 157 PID 2464 wrote to memory of 1636 2464 cmd.exe 157 PID 1636 wrote to memory of 3360 1636 taskhostw.exe 158 PID 1636 wrote to memory of 3360 1636 taskhostw.exe 158 PID 3360 wrote to memory of 548 3360 cmd.exe 160 PID 3360 wrote to memory of 548 3360 cmd.exe 160 PID 3360 wrote to memory of 1720 3360 cmd.exe 162 PID 3360 wrote to memory of 1720 3360 cmd.exe 162 PID 1720 wrote to memory of 4784 1720 taskhostw.exe 163 PID 1720 wrote to memory of 4784 1720 taskhostw.exe 163 PID 4784 wrote to memory of 3216 4784 cmd.exe 165 PID 4784 wrote to memory of 3216 4784 cmd.exe 165 PID 4784 wrote to memory of 208 4784 cmd.exe 167 PID 4784 wrote to memory of 208 4784 cmd.exe 167 PID 208 wrote to memory of 2364 208 taskhostw.exe 168 PID 208 wrote to memory of 2364 208 taskhostw.exe 168 PID 2364 wrote to memory of 4284 2364 cmd.exe 170 PID 2364 wrote to memory of 4284 2364 cmd.exe 170 PID 2364 wrote to memory of 4112 2364 cmd.exe 171 PID 2364 wrote to memory of 4112 2364 cmd.exe 171 PID 4112 wrote to memory of 4712 4112 taskhostw.exe 172 PID 4112 wrote to memory of 4712 4112 taskhostw.exe 172 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_621df625130e5405ff9a9b7683990eafc1bfed600cc4c01bda245c41273191a8.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft OneDrive\setup\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\taskhostw.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\upfc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Crashpad\attachments\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\alOmPXK1gw.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4796
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mWzz7cjAeP.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:2936
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NjKeWzk8OD.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:548
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hYa1c8p3ob.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:3216
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NjKeWzk8OD.bat"13⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:4284
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xHU7fKnwSZ.bat"15⤵PID:4712
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:4036
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7C7JiPLtAl.bat"17⤵PID:4796
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:4388
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\19YD2Vui68.bat"19⤵PID:920
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:1140
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3384 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\xB9FX11cFJ.bat"21⤵PID:1576
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:3040
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\I0OceA6Xfh.bat"23⤵PID:4456
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:3496
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TdlfhXh7Yo.bat"25⤵PID:3416
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:936
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\76lQa6YaxV.bat"27⤵PID:1784
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:1268
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\NpgWdIWSbT.bat"29⤵PID:2256
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:2932
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D9KWG0zl28.bat"31⤵PID:2852
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:3084
-
-
C:\providercommon\taskhostw.exe"C:\providercommon\taskhostw.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1788 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZgKlNS7JdR.bat"33⤵PID:3548
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:234⤵PID:4508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\Installer\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1500
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4652
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\Default\My Documents\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\My Documents\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1860
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Default\My Documents\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\setup\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\providercommon\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3116
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\providercommon\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1148
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2312
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Favorites\Links\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\upfc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2568
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3420
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 6 /tr "'C:\Program Files\Crashpad\attachments\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:32
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Crashpad\attachments\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
196B
MD574213ec173c5408009853fac82edf921
SHA1205beee498885ea8fa27ba00600f00b11c04a7b5
SHA25625e967a420e6e4d40d1651e32b5750821dfd126b23747869d9e0d207c3a7753e
SHA5121e7d36d400713a0f7d54f8b4458f41c34182fd688d12d8b80b815ced21c59c27b945889747974389a2d56219234fdc0a481f8730427a34f921fd8bb344adf715
-
Filesize
196B
MD5a4201e8b1f6ac32c483833372ec62bd0
SHA1f4ea74a35ce5432affe946ecf15d68247fd38d1a
SHA2562847a653f84f9099d4f45c5a7f7746bd36bf5cfb5e89aa2aa52be802795f1290
SHA512610f3dc5f3969873d18cc6ce5a3982e3f3b7f3cb45128b8c6ac31bc79859f1a19d3272d1070e8fcc0207bce71d8953618183d972adaa655e4b00f6a74f145a56
-
Filesize
196B
MD5d0695fcf1d3bbe72d251c3eb08156a4c
SHA18aa9b5862e2e18c64c94ca9363f9bc4fc75ea3b0
SHA2567e65bfaae60cb044c3a1cc8269f5c0efd95bf6baeb284b9e1412165d505ff1ab
SHA5126358a48c4ec2851d1a4f7e6154425adece741b31b044c6fce5270c92e610191536aca98048f72d964ed9a293d89db6ad934febe8a48623e122784e3e48b70090
-
Filesize
196B
MD52b1cbefb5f057b29f86de1534e7a9b67
SHA14335f959b77c332b1b39bfccbf68621258b3e0cf
SHA2564c690f91b10ccdaace96956093abc4b7ec43c1aca4c11ed166922f16eb54380d
SHA512c216f529b1fca6730d556c130cd9e712863841a78023359bddea11f2707579f5411ea6a34727f481391b2d96cf72e02854f66d1e4b66eae35ca6c09f54d79b0d
-
Filesize
196B
MD55f72b19ce264eb9430509dc66d38ebf0
SHA132045c970177c7627f74c1408b63046aefaa8c2d
SHA2565c8d5a0eb0117bf983ddab1965171790f36d945ffbceb190470efdfbdc8355cb
SHA512838d4de54168e7072938cd82b3fe2e6d259696e8d4724bc3e8d3cc0ec5e46d452cc47bbb087d1a17e895a20f689ce8628ea10e7a1181bd5a05b06dcdd8e32621
-
Filesize
196B
MD55df5f5814df694b9c90a98d49060ffdb
SHA11aef2015dc302ab46a2fc1b4d3cec5c437e094b8
SHA256cb530b16714a1b4392ac3900438bf67ac48ec35bffd30033755cf1b502442181
SHA512b7fa0aca7a6c8e468ffa9914d61a98d06c1dc88b06513336bb8b298e489f93948821eb00975ab11e5ef05ea04c0aed6e7e03bb9a991ccc85b7a8bd38279a494f
-
Filesize
196B
MD50f7c48db36c0ff59636b946c9868c3d2
SHA1c3730b5e6f247276528818f8d546cbf02aed2aae
SHA25639bfe9e3d1fb1d232ae8af2301aaba48b6f75e48c05b260942a0b5168066b9e0
SHA5122d7fee18a74547b074b1a26146292fd3668bcda47148decb1d8987413cfd29e98eb71ff1680b9f2ec12bf17fc1aec57dfa5bd4c78affe4c36bb145d7163ce43b
-
Filesize
196B
MD5e7f55fe4a5eddfca389ad0c8a2538cba
SHA19440979b379fdad4fd0595252cc6789e9ae3f19b
SHA2566184adcf50bcb1b51abf16950785a1e9efc1d767a62a9ee970feb40c5cc13d76
SHA51241630fd24711ed05057d25d0324c623a962d2f1553cde5ebc7c7a790a06be3b50808566583ec3f020e04246ebba182f26a13a554f975a83906c7828adea045cf
-
Filesize
196B
MD589936567e32bdcebad5f51bbd6303366
SHA1c24d90d3873dd032a841046e68a9dbc0223edf19
SHA2566531a2b4c2ecb740a2492e5f7994890d1558ce09eec9b56d43abb343529052f8
SHA512d17d8053a1fcc8aa2540a68814c0417c4c825cf9b398240851ab1ebdcc59452c81a21cfe64047551a50345bde1ca886432ebb83e52ac26dda68f1c64f08a8bc7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
196B
MD5ada8ab09558da3665e157377c2e92d5e
SHA11dd2cb4d04a2bc600790ac7b22dc7e7ab35aa145
SHA256e8f6a24dbf5b8172b20b2f83edbd89242b53575531fd09a20217f5eedf768ebb
SHA512982258725e281158e671c630476fbe300c87a3d3f88324b28bb0b47bdf1718277bad0e5b92d0cd4d22b561a8f92769e60290a8396ccea33c84c1bbdde4b371af
-
Filesize
196B
MD54e840f4421f7897ecdf36e350f777cfc
SHA185ed7b295ae8abea53ab3555cd762124f3d5f0ec
SHA25694e591e13a4342a94f7b748c89124a4eeeea3ca7ee9c4cb07bc52ffbef36237c
SHA5127db692902083ca77305cf4300c58ee77778f6e850b425c3cc12ec339ae1a160f6ec62799e1be901460dfe332250abd446ac5d5e942e4b499cc01e6f0621b5f0d
-
Filesize
196B
MD55d456a33d7704b516292ad7d13cd6554
SHA1f305d090a455eec36386012f594d2e6b07c35a29
SHA256d097d9d1c0e4cd47297ffe3be097020cab6dfa454dd0cb930b6309cf4f2d62b7
SHA5128e3e45381e43ec5ecb7f00370d0255ed194a253645b350fec3bb7f67961e38ad3df662c3b5286e910b0508f26714eb8c4c5a538e47896e871dbdafc4929cfa04
-
Filesize
196B
MD5f891fc2db1d39198c970413a221e4628
SHA1dcfc3e1c538efdbb36bafcb641e06dc2cc250302
SHA256804f8471dec032b9fec9ecb82338fea3c045c2ca0f88e5f50c3ff2dc7399b07c
SHA51267910cf108ac2edd6727b5e6ca214f2ceb6ed1fee9cac1537d8c360a606b6b55c3f9e176afbc4e97b72888a5e15e912d96772442f97247594f39ec0e58861975
-
Filesize
196B
MD521b63135f51c3845d19319a0a08b3851
SHA1addc7d38ef5ac0b0ec98d71fdc31914e22b11268
SHA2561bc8b1da29cfcd67a54db54ccdfcc22c2d09abc1fa788673288b292f84eb42ec
SHA512502576a1d87737bbf20955cccb3826ff206206ebd918aba0dce90d96654a13c61b25e7195ee5dcd88eabab7e256cb54ce44bd21ddd6305ce70b593c2c9bf2494
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478