Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 09:28
Behavioral task
behavioral1
Sample
JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe
-
Size
1.3MB
-
MD5
8241afb589889b622ac576fd8ad1f303
-
SHA1
6fa2f421f79de1ec100516dd85142313903acaaf
-
SHA256
d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a
-
SHA512
7d43c9a5eaa1d3ebde9cfac789cee4f10e21f8e12bd4b13ba8284caee7bef66c97d5349e26e894caca84f50b210df329374d536a562e0a702126efabb3bbf20f
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 45 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3956 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4264 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3332 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2992 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1368 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1044 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4820 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3656 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 728 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4272 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 772 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4236 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 916 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4920 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3660 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2648 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3580 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2352 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1588 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1468 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4820 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3656 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2032 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4372 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2512 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4836 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1720 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2424 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4960 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 224 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4304 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4080 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 640 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4936 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4048 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4816 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 680 3284 schtasks.exe 90 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3452 3284 schtasks.exe 90 -
resource yara_rule behavioral2/files/0x000a000000023b84-10.dat dcrat behavioral2/memory/2644-13-0x0000000000620000-0x0000000000730000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3460 powershell.exe 3676 powershell.exe 4356 powershell.exe 2380 powershell.exe 4072 powershell.exe 3412 powershell.exe 756 powershell.exe 1612 powershell.exe 5044 powershell.exe 1172 powershell.exe 4620 powershell.exe 2792 powershell.exe 4384 powershell.exe 2268 powershell.exe 3620 powershell.exe 3100 powershell.exe 3908 powershell.exe -
Checks computer location settings 2 TTPs 18 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation powershell.exe -
Executes dropped EXE 17 IoCs
pid Process 2644 DllCommonsvc.exe 4688 DllCommonsvc.exe 1368 powershell.exe 4384 powershell.exe 872 powershell.exe 2940 powershell.exe 1652 powershell.exe 4424 powershell.exe 4536 powershell.exe 872 powershell.exe 4220 powershell.exe 2740 powershell.exe 2992 powershell.exe 1840 powershell.exe 2300 powershell.exe 1324 powershell.exe 1580 powershell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 15 IoCs
flow ioc 19 raw.githubusercontent.com 45 raw.githubusercontent.com 56 raw.githubusercontent.com 18 raw.githubusercontent.com 24 raw.githubusercontent.com 40 raw.githubusercontent.com 57 raw.githubusercontent.com 31 raw.githubusercontent.com 41 raw.githubusercontent.com 54 raw.githubusercontent.com 55 raw.githubusercontent.com 39 raw.githubusercontent.com 46 raw.githubusercontent.com 47 raw.githubusercontent.com 58 raw.githubusercontent.com -
Drops file in Program Files directory 9 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\f3b6ecef712a24 DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\e978f868350d50 DllCommonsvc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\OfficeClickToRun.exe DllCommonsvc.exe File created C:\Program Files (x86)\Google\e6c9b481da804f DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe DllCommonsvc.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\0a1fd5f707cd16 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2648 schtasks.exe 1468 schtasks.exe 3656 schtasks.exe 2992 schtasks.exe 1588 schtasks.exe 1044 schtasks.exe 772 schtasks.exe 916 schtasks.exe 2032 schtasks.exe 2512 schtasks.exe 4820 schtasks.exe 1720 schtasks.exe 4920 schtasks.exe 4936 schtasks.exe 3580 schtasks.exe 2108 schtasks.exe 3956 schtasks.exe 4264 schtasks.exe 3332 schtasks.exe 4988 schtasks.exe 3660 schtasks.exe 4048 schtasks.exe 680 schtasks.exe 2536 schtasks.exe 4820 schtasks.exe 4960 schtasks.exe 224 schtasks.exe 4304 schtasks.exe 1720 schtasks.exe 2424 schtasks.exe 3656 schtasks.exe 728 schtasks.exe 4272 schtasks.exe 1588 schtasks.exe 4836 schtasks.exe 4372 schtasks.exe 2352 schtasks.exe 4372 schtasks.exe 640 schtasks.exe 3452 schtasks.exe 1368 schtasks.exe 4236 schtasks.exe 2276 schtasks.exe 4080 schtasks.exe 4816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2644 DllCommonsvc.exe 1172 powershell.exe 1172 powershell.exe 1172 powershell.exe 2380 powershell.exe 2380 powershell.exe 3460 powershell.exe 3460 powershell.exe 3620 powershell.exe 3620 powershell.exe 2268 powershell.exe 2268 powershell.exe 4072 powershell.exe 4072 powershell.exe 5044 powershell.exe 5044 powershell.exe 4688 DllCommonsvc.exe 4688 DllCommonsvc.exe 2380 powershell.exe 3460 powershell.exe 3620 powershell.exe 2268 powershell.exe 4072 powershell.exe 5044 powershell.exe 3676 powershell.exe 3676 powershell.exe 4620 powershell.exe 4620 powershell.exe 1612 powershell.exe 1612 powershell.exe 756 powershell.exe 756 powershell.exe 2792 powershell.exe 2792 powershell.exe 3908 powershell.exe 3908 powershell.exe 3412 powershell.exe 3412 powershell.exe 4356 powershell.exe 4356 powershell.exe 3100 powershell.exe 3100 powershell.exe 3412 powershell.exe 1368 powershell.exe 1368 powershell.exe 3676 powershell.exe 2792 powershell.exe 4620 powershell.exe 1612 powershell.exe 756 powershell.exe 3908 powershell.exe 3100 powershell.exe 4356 powershell.exe 872 powershell.exe 2940 powershell.exe 1652 powershell.exe 4424 powershell.exe 4536 powershell.exe 872 powershell.exe 4220 powershell.exe 2740 powershell.exe 2992 powershell.exe 1840 powershell.exe 2300 powershell.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 2644 DllCommonsvc.exe Token: SeDebugPrivilege 1172 powershell.exe Token: SeDebugPrivilege 2380 powershell.exe Token: SeDebugPrivilege 3460 powershell.exe Token: SeDebugPrivilege 3620 powershell.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 4072 powershell.exe Token: SeDebugPrivilege 5044 powershell.exe Token: SeDebugPrivilege 4688 DllCommonsvc.exe Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 4620 powershell.exe Token: SeDebugPrivilege 1612 powershell.exe Token: SeDebugPrivilege 756 powershell.exe Token: SeDebugPrivilege 2792 powershell.exe Token: SeDebugPrivilege 3908 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 3412 powershell.exe Token: SeDebugPrivilege 4356 powershell.exe Token: SeDebugPrivilege 1368 powershell.exe Token: SeDebugPrivilege 872 powershell.exe Token: SeDebugPrivilege 2940 powershell.exe Token: SeDebugPrivilege 1652 powershell.exe Token: SeDebugPrivilege 4424 powershell.exe Token: SeDebugPrivilege 4536 powershell.exe Token: SeDebugPrivilege 872 powershell.exe Token: SeDebugPrivilege 4220 powershell.exe Token: SeDebugPrivilege 2740 powershell.exe Token: SeDebugPrivilege 2992 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeDebugPrivilege 2300 powershell.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeDebugPrivilege 1580 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 4540 1640 JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe 83 PID 1640 wrote to memory of 4540 1640 JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe 83 PID 1640 wrote to memory of 4540 1640 JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe 83 PID 4540 wrote to memory of 3012 4540 WScript.exe 87 PID 4540 wrote to memory of 3012 4540 WScript.exe 87 PID 4540 wrote to memory of 3012 4540 WScript.exe 87 PID 3012 wrote to memory of 2644 3012 cmd.exe 89 PID 3012 wrote to memory of 2644 3012 cmd.exe 89 PID 2644 wrote to memory of 2268 2644 DllCommonsvc.exe 111 PID 2644 wrote to memory of 2268 2644 DllCommonsvc.exe 111 PID 2644 wrote to memory of 5044 2644 DllCommonsvc.exe 112 PID 2644 wrote to memory of 5044 2644 DllCommonsvc.exe 112 PID 2644 wrote to memory of 3620 2644 DllCommonsvc.exe 113 PID 2644 wrote to memory of 3620 2644 DllCommonsvc.exe 113 PID 2644 wrote to memory of 1172 2644 DllCommonsvc.exe 114 PID 2644 wrote to memory of 1172 2644 DllCommonsvc.exe 114 PID 2644 wrote to memory of 3460 2644 DllCommonsvc.exe 115 PID 2644 wrote to memory of 3460 2644 DllCommonsvc.exe 115 PID 2644 wrote to memory of 2380 2644 DllCommonsvc.exe 116 PID 2644 wrote to memory of 2380 2644 DllCommonsvc.exe 116 PID 2644 wrote to memory of 4072 2644 DllCommonsvc.exe 117 PID 2644 wrote to memory of 4072 2644 DllCommonsvc.exe 117 PID 2644 wrote to memory of 4688 2644 DllCommonsvc.exe 125 PID 2644 wrote to memory of 4688 2644 DllCommonsvc.exe 125 PID 4688 wrote to memory of 3676 4688 DllCommonsvc.exe 153 PID 4688 wrote to memory of 3676 4688 DllCommonsvc.exe 153 PID 4688 wrote to memory of 4620 4688 DllCommonsvc.exe 154 PID 4688 wrote to memory of 4620 4688 DllCommonsvc.exe 154 PID 4688 wrote to memory of 1612 4688 DllCommonsvc.exe 155 PID 4688 wrote to memory of 1612 4688 DllCommonsvc.exe 155 PID 4688 wrote to memory of 4356 4688 DllCommonsvc.exe 156 PID 4688 wrote to memory of 4356 4688 DllCommonsvc.exe 156 PID 4688 wrote to memory of 3412 4688 DllCommonsvc.exe 157 PID 4688 wrote to memory of 3412 4688 DllCommonsvc.exe 157 PID 4688 wrote to memory of 4384 4688 DllCommonsvc.exe 158 PID 4688 wrote to memory of 4384 4688 DllCommonsvc.exe 158 PID 4688 wrote to memory of 3908 4688 DllCommonsvc.exe 159 PID 4688 wrote to memory of 3908 4688 DllCommonsvc.exe 159 PID 4688 wrote to memory of 2792 4688 DllCommonsvc.exe 160 PID 4688 wrote to memory of 2792 4688 DllCommonsvc.exe 160 PID 4688 wrote to memory of 756 4688 DllCommonsvc.exe 161 PID 4688 wrote to memory of 756 4688 DllCommonsvc.exe 161 PID 4688 wrote to memory of 3100 4688 DllCommonsvc.exe 163 PID 4688 wrote to memory of 3100 4688 DllCommonsvc.exe 163 PID 4688 wrote to memory of 1368 4688 DllCommonsvc.exe 173 PID 4688 wrote to memory of 1368 4688 DllCommonsvc.exe 173 PID 1368 wrote to memory of 1872 1368 powershell.exe 181 PID 1368 wrote to memory of 1872 1368 powershell.exe 181 PID 1872 wrote to memory of 4272 1872 cmd.exe 183 PID 1872 wrote to memory of 4272 1872 cmd.exe 183 PID 1872 wrote to memory of 4384 1872 cmd.exe 185 PID 1872 wrote to memory of 4384 1872 cmd.exe 185 PID 2524 wrote to memory of 1928 2524 cmd.exe 189 PID 2524 wrote to memory of 1928 2524 cmd.exe 189 PID 2524 wrote to memory of 872 2524 cmd.exe 193 PID 2524 wrote to memory of 872 2524 cmd.exe 193 PID 872 wrote to memory of 464 872 powershell.exe 195 PID 872 wrote to memory of 464 872 powershell.exe 195 PID 464 wrote to memory of 4920 464 cmd.exe 197 PID 464 wrote to memory of 4920 464 cmd.exe 197 PID 464 wrote to memory of 2940 464 cmd.exe 200 PID 464 wrote to memory of 2940 464 cmd.exe 200 PID 2940 wrote to memory of 700 2940 powershell.exe 202 PID 2940 wrote to memory of 700 2940 powershell.exe 202 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0bda9be8c80ec78448b5c45401c588d6ea03d1ce809d6ff442e0b1744e9085a.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\OfficeClickToRun.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WaaSMedicAgent.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Application Data\TextInputHost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\DllCommonsvc.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3412
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\winlogon.exe'6⤵
- Command and Scripting Interpreter: PowerShell
PID:4384
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\SendTo\conhost.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\powershell.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Local Settings\Idle.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"7⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:4272
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
PID:4384 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0Sh6ipYOoX.bat"9⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:1928
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nlAvT1Qihc.bat"11⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:4920
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L8pPJcA7Kt.bat"13⤵PID:700
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:3972
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KxKP0srito.bat"15⤵PID:3980
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:1468
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HGlJwS3LgK.bat"17⤵PID:2884
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:4696
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yNYzWO1Iaj.bat"19⤵PID:3616
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:1000
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\F5GJdikwFG.bat"21⤵PID:2072
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:5032
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\K3fI8Bd254.bat"23⤵PID:1620
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:376
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kUVpzpaF2i.bat"25⤵PID:1088
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:4836
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\CIMKRyAEqW.bat"27⤵PID:3824
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:228⤵PID:2524
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tebxeZNirC.bat"29⤵PID:3544
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:230⤵PID:1852
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dhQfvaPZ4N.bat"31⤵PID:4936
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:232⤵PID:624
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6VGBOjzZtA.bat"33⤵PID:3788
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:234⤵PID:4468
-
-
C:\Recovery\WindowsRE\powershell.exe"C:\Recovery\WindowsRE\powershell.exe"34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3956
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1044
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WaaSMedicAgent.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\providercommon\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4236
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\providercommon\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\TextInputHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1588
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1468
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\providercommon\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\providercommon\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\Default\SendTo\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\SendTo\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:224
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4304
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\powershell.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4080
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Local Settings\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4816
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f3c0ae41f0d9ae10a8985a2c327b8fb
SHA1d58622bf6b5071beacf3b35bb505bde2000983e3
SHA256519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900
SHA5128a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125
-
Filesize
2KB
MD5a43e653ffb5ab07940f4bdd9cc8fade4
SHA1af43d04e3427f111b22dc891c5c7ee8a10ac4123
SHA256c4c53abb13e99475aebfbe9fec7a8fead81c14c80d9dcc2b81375304f3a683fe
SHA51262a97e95e1f19a8d4302847110dae44f469877eed6aa8ea22345c6eb25ee220e7d310fa0b7ec5df42356815421c0af7c46a0f1fee8933cc446641800eda6cd1b
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
944B
MD56c47b3f4e68eebd47e9332eebfd2dd4e
SHA167f0b143336d7db7b281ed3de5e877fa87261834
SHA2568c48b1f2338e5b24094821f41121d2221f1cb3200338f46df49f64d1c4bc3e0c
SHA5120acf302a9fc971ef9df65ed42c47ea17828e54dff685f4434f360556fd27cdc26a75069f00dcdc14ba174893c6fd7a2cfd8c6c07be3ce35dafee0a006914eaca
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD59bc110200117a3752313ca2acaf8a9e1
SHA1fda6b7da2e7b0175b391475ca78d1b4cf2147cd3
SHA256c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
SHA5121f1af32aa18a8cbfcc65b0d4fb7e6ca2705f125eaa85789e981ee68b90c64522e954825abf460d4b4f97567715dfae8d9b0a25a4d54d10bc4c257c472f2e80fb
-
Filesize
944B
MD54165c906a376e655973cef247b5128f1
SHA1c6299b6ab8b2db841900de376e9c4d676d61131e
SHA256fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4
SHA51215783f2d3687388339c06423bd18c17a5704cd367bf1a1d08e436088984c0b5c52dc88d3b8455495a8051ba9f977aae34b69453e5ee252d928e74dcdebd4a11a
-
Filesize
944B
MD550d3033f2bc3a3774c469d03e71a79a9
SHA122027b1d52085de99b3bffa276530fea5d961471
SHA2562987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147
SHA512ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8
-
Filesize
944B
MD5b801d886e417a9bf405b2f0092e04fe1
SHA1fa99fefa2f49af240141692f78c8c28f04205389
SHA25657b1c29eef54567fcfdaa28d2923485cb6f77bb76dc54235965fb34f02a42636
SHA512b2c8bf95b4c25d7fff388b5f3e04212c43af9588f7aed8a7cb251330ee18c89789eb1d294b8449ec2afeb9b5373d7a6dce8f4369b84cbfb6a7c7813341fa07ff
-
Filesize
944B
MD5d3e8199b4634731cf0a0c26c1f14f588
SHA17f8fae27eb80055a436a6b5457978f32673d9ad4
SHA256ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a
SHA512806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2
-
Filesize
201B
MD5b6fdb28dd03877ab7f3a023e109b33fa
SHA128628b549aeef223479ad8199ad4bfcdce975d03
SHA256542e21b4b13734ff6cc31807e86bbdf4346be4168d23ce70d3780ee1e95af645
SHA5122be65436a65de3e23e0e236cbb1269db1a476f6a2f4b83db3672cb99433abd825fb5a1725cd75e59e4a593cc11a9bc3e19a9d601b33d330494962330e55fff40
-
Filesize
201B
MD5722e2ad3b3c8be9b49312bce765002a9
SHA1d4610e10664ac21134cc2bae18defad2aff4c2a0
SHA2566f73ad87465a0e377e9d51d0ffe72938f4779076c4147314f8a19f4e1b1cad89
SHA5123c239a7c356b4b02d78e44edf51d4a75be04d1fc64d6041032bcf9a7b4640048df5ea9d4dcf6e8be32c3b9b701a74d2628619efb41469b1c3385dcd3d28df23a
-
Filesize
201B
MD54c9429927eeb21b2f5f7fa5765c6498c
SHA15e21f007ea5754d9f54cca37ccb2710a1c7a28f9
SHA25626582e31ec96cab7227012be4bb71db39be7897659e92757c2c2f8f02d258ad9
SHA5126f47a4a67678cf7520b4256cac3987ed027d552da1f16cb7a1c2c48baea4e58b9c4223f86b19a4103201f20bbcd199df23971af6eb02bfe0df3d311eecf881df
-
Filesize
201B
MD551ea86878b834cae28289f94104e4173
SHA15949b7571d31db84f55f0a7eb904a1a14fa6ffdf
SHA2566cf0dd8832252bf215438f72b226ce87ed27381ef1e8769b0331cee36dbc0b31
SHA51212fdc56d1b4584d36909887e41179eae7c07c7bb2d4468debbf7b54dc567047edf798e4b75f0fb53ab561031ad43c2762a85e585a616d9efb8824626e6fcf4e1
-
Filesize
201B
MD5ae6845f48f2342a78dc435e09d574e5e
SHA1f75b8acf1a5fc0389304a8bcfa69dffae719cf9b
SHA25625e2ae88f81cf0d0941d348d75adbb3a075c285855f903c0eca649bd8945fb8d
SHA51265ab4575b34c32ff25fc9b3dac8b3a45158d0b6fd558978d3d251ec4504f0e093ad8d376c6055c24320529c4cf48c4688e0c5a59e6866f679becff2e0ee200fb
-
Filesize
201B
MD57fe1a4462fd163f40faa46a7b1d414e9
SHA1e3f811c374efda0e8c09d7f56589b9a7fb5bab67
SHA25624957d8dd0f16f4ae7f0e614105f480eaa0fa6755be0276359feb363ff85c92e
SHA5123561a883530fc8685bfe52970c3505224f25af724c91e962e16e0ee99376d33055da46aeeaadcaa55b2db34dc80ba6795910907f7cebf5657ba6ee80aa3d9d0b
-
Filesize
201B
MD58c41cefcf0e2dedfdaec92f0c9e3759b
SHA188ee148cb4b4b6926c2428e9163441a2d15e16fa
SHA25607abb1bb3ebf6cfdd183d8bfa51883e11060ac5432e4e8ee3bdaa37074f89a27
SHA512daf581b1e55b4ddf1f92dbe2cb221d8de2ac467c80ac64986e8cb5a97660bce188e35d8e4645aeafdc422c4a1feb745a21d8eba3a480bc3c49107b1a90a036ff
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
201B
MD59744ef65941e74368499e21c42556639
SHA1b66ca2ab31647e7fbcb7ebbb3c1b8a13d0e64465
SHA2562a2e0391d74e496cd9c474dacb951e27514ce8fcc963cbdc414bbbe06dff958c
SHA51296ee3c815c01817fd9bdd3ee030d84a0dd0768966315a4d9443894cc847185f5eedc8cbd3d1c30befaeea06862db783799647e42e0835c8ab55d932af229fb10
-
Filesize
201B
MD5e1fe4bbb6d51933c49c1b4039d05349a
SHA1e6062435ef93a513ec7465ca4de3ddac1cf890ff
SHA256071420b4e3658c1aca04ee314663c7289ad9e5c80621379e21cd52197eb1cbe6
SHA51295ce496a28b80f53102da298e1b4112628ea8e86edafcac9a118dfe93eac197dce18efa6a588728910e62ee5a4aff755a34950dba1b18c5cd54f841342e5e06c
-
Filesize
201B
MD55da31515d6e3094084df06814ccebcb8
SHA1d7cf8e8570d420d06daf7c8f9192a6a357b61a98
SHA2565ae92d6207c54e769a0c540beb7695c56931e5b431b9d86d5a9c310767457a65
SHA5121795fde3a97a7be9f56693d3b3b8dbfc379784e6c81c56d67922a4b88b92775cec02620761e86ddcf0d85ab287b844ab85fb15ce6e642132cffd1fff40a88f70
-
Filesize
201B
MD57b26cac5d2ea23eb44ac02aa16f0a742
SHA1d6d1ddd95331120237f3511a69c07c7f2154cfa6
SHA256f0a9a5d72026ea220cf5b7190852087a8a41871e4e964a1969499f9225619be3
SHA5122661c614682e8be6fe4ada315f4652846ad49389b099ea9145668b1f3c78dfe88554fa0bf2945f52eca4a51d498dd18932b4a34f47c9c5dbeb278d5d4d541d77
-
Filesize
201B
MD5fc333e47d4e7bf7e14709e512d6adc3b
SHA1f608f29f012c1edd7d9f5ad06c514a0612b52045
SHA2560d2e40fcca1a45fa0f5f518443cb233965338f83948321650eff2e3bd329fb34
SHA51247065de7c0feab10381a8285f4fb2a867d405b88c9dc67249b6c0cc3e0febcfd5032d20108b9417d7cb2ec368197cf36cadf270659807e3c066ede8f6c0597ab
-
Filesize
201B
MD5b5d212387cce6123b8f96fcbe246662b
SHA1aeeca7f9d5a312784f2e5b35684a90c0d6ea123e
SHA256b4d2d6eac23b7101af4ebc69a4c5212aef9454ee5298410d127b1b9b7fafbf01
SHA51253c2a95a72a609cc8cae9b1c1bc2280517444497881cb7cca76fd9d5fddbeebf6f7ba1225bc91587f96345799bcc1a80febaa9550e95bea80498c58eeb27bea9
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478