Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 10:29

General

  • Target

    JaffaCakes118_666afb8cc4ee6496e5744c377bee9c4cbca30f21eb876440098c7bc4da11aa32.exe

  • Size

    1.3MB

  • MD5

    6c0d043282efdf6d9b62f728609dda3e

  • SHA1

    39a28a3e3eab844b85d4a65173bc6951a8ef2195

  • SHA256

    666afb8cc4ee6496e5744c377bee9c4cbca30f21eb876440098c7bc4da11aa32

  • SHA512

    c4bb14c6f3202763681ebebd65d7805a14576454525010d599194d9a9f72aa14b5a70db22dc974d5c7b5fee739984ad4da160607ca89332e83dd2e8606e3b797

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 16 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 14 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 15 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_666afb8cc4ee6496e5744c377bee9c4cbca30f21eb876440098c7bc4da11aa32.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_666afb8cc4ee6496e5744c377bee9c4cbca30f21eb876440098c7bc4da11aa32.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3080
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4664
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\upfc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4424
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Services\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4992
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4152
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PePUnGXwPp.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1448
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:4508
              • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1644
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1616
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:4892
                    • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                      "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3116
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4268
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:960
                          • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                            "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:748
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6SU00hIhBO.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:428
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:4104
                                • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                  "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3916
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2204
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:2492
                                      • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                        "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:4524
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fq9TqI16of.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1748
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:4500
                                            • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                              "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                              16⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:232
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat"
                                                17⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:1536
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  18⤵
                                                    PID:2380
                                                  • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                                    "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                                    18⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3512
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat"
                                                      19⤵
                                                        PID:2504
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          20⤵
                                                            PID:2728
                                                          • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                                            "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                                            20⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3280
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat"
                                                              21⤵
                                                                PID:1856
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  22⤵
                                                                    PID:1976
                                                                  • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                                                    "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                                                    22⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4424
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat"
                                                                      23⤵
                                                                        PID:1484
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          24⤵
                                                                            PID:1932
                                                                          • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                                                            "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                                                            24⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2688
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat"
                                                                              25⤵
                                                                                PID:2880
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  26⤵
                                                                                    PID:4476
                                                                                  • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                                                                    "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                                                                    26⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:736
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat"
                                                                                      27⤵
                                                                                        PID:3636
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          28⤵
                                                                                            PID:976
                                                                                          • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                                                                            "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                                                                            28⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Modifies registry class
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:3836
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat"
                                                                                              29⤵
                                                                                                PID:2008
                                                                                                • C:\Windows\system32\w32tm.exe
                                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                  30⤵
                                                                                                    PID:1648
                                                                                                  • C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe
                                                                                                    "C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe"
                                                                                                    30⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4860
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat"
                                                                                                      31⤵
                                                                                                        PID:4024
                                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                                          32⤵
                                                                                                            PID:4504
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Windows\Tasks\upfc.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1792
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Tasks\upfc.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3784
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\upfc.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1780
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Services\unsecapp.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5092
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\unsecapp.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3540
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Services\unsecapp.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1628
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1748
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2388
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:2844
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4216
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:3396
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Windows\ServiceProfiles\LocalService\Favorites\SearchApp.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:4656
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:856
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:5096
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
                                              1⤵
                                              • Process spawned unexpected child process
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1832

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SearchApp.exe.log

                                              Filesize

                                              1KB

                                              MD5

                                              baf55b95da4a601229647f25dad12878

                                              SHA1

                                              abc16954ebfd213733c4493fc1910164d825cac8

                                              SHA256

                                              ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                              SHA512

                                              24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                              Filesize

                                              2KB

                                              MD5

                                              d85ba6ff808d9e5444a4b369f5bc2730

                                              SHA1

                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                              SHA256

                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                              SHA512

                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              62623d22bd9e037191765d5083ce16a3

                                              SHA1

                                              4a07da6872672f715a4780513d95ed8ddeefd259

                                              SHA256

                                              95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                              SHA512

                                              9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              6d3e9c29fe44e90aae6ed30ccf799ca8

                                              SHA1

                                              c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                              SHA256

                                              2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                              SHA512

                                              60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                              Filesize

                                              944B

                                              MD5

                                              6d42b6da621e8df5674e26b799c8e2aa

                                              SHA1

                                              ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                              SHA256

                                              5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                              SHA512

                                              53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                            • C:\Users\Admin\AppData\Local\Temp\3Lxx1rvPQX.bat

                                              Filesize

                                              228B

                                              MD5

                                              7b62c1ffc79a536f26659811dcf7b05a

                                              SHA1

                                              1abe2f9968d1f23336c934b009009a6e2c7e5e07

                                              SHA256

                                              ddf08116678a1a5ce3db97775b698ff9c8dae398934ab98fb17b2d0793d99af8

                                              SHA512

                                              90a16ef028fd6b519c85a38c20a150aec5eca37c07ab53089e773230ab6e3d5f60024eece0803d31163784b41d1ee1396c18fe339376e1cfb6acf9b50970930e

                                            • C:\Users\Admin\AppData\Local\Temp\3fa1oyizme.bat

                                              Filesize

                                              228B

                                              MD5

                                              18b667204b80d9ae06ee48f67da57284

                                              SHA1

                                              38528be74264b818b0de388b7ade25966eff999e

                                              SHA256

                                              14751371a3ab20212653f5bfcace51231f48f5479719db7d0d7a53921c8ed3f5

                                              SHA512

                                              6efb7441ad5354b48c213ab52d274454c6870e065eff194f0ae032dad0a3390f4b4cafb501cf72b173a8b59341ad3a2719638b1e325d7dfcfccd55ad9f67a772

                                            • C:\Users\Admin\AppData\Local\Temp\6SU00hIhBO.bat

                                              Filesize

                                              228B

                                              MD5

                                              1460e9d656283a4237742295f61e2d07

                                              SHA1

                                              20b1f80ebd69c70e47fbd2e793484e08a5e2644b

                                              SHA256

                                              fa7d2ead54ebb94e6827a3a8ccf45fa21c4f6433e56418e07eeb2c2e548b112f

                                              SHA512

                                              7ab795f309b42eb3fd2830fb332fb4ef0be0d0bb5279e8339854ebee6a5992aaa3725ae3b0e65cf80470c5944b4b526940a2a4abfad6db89be8464d3e94356e6

                                            • C:\Users\Admin\AppData\Local\Temp\8OW3hmLaVA.bat

                                              Filesize

                                              228B

                                              MD5

                                              4f2ee18e221f7b8507b54c60dde919a5

                                              SHA1

                                              76fb5c0acc3c3bf080dfa99ded941d2740bbadca

                                              SHA256

                                              66a2e7fa6734335a8fd508b6ba640cd45015648e55973d4ceb898fd7da84673c

                                              SHA512

                                              cc0cf32b64b094b6a7355e9de1cc37623a2ee474f6d1a082d2bfeb270b47ac6794dbfc151cbba30f557974c9f525ee5992bd4f545651c7ad241fcc1dc82a4093

                                            • C:\Users\Admin\AppData\Local\Temp\GN7B3lpeta.bat

                                              Filesize

                                              228B

                                              MD5

                                              c7cec89d67e86911cd2d9f7c0cc3d05a

                                              SHA1

                                              ab749efbce5f7b421d4d7ef30d23cc5ae2cd1c96

                                              SHA256

                                              31487ae9dfc9c35014c649d4ca59442b130bfd7e795cce4d990bf2490830c030

                                              SHA512

                                              07fedc8a9f4f645826df96a83db93ed7cc68ff8863499305c5774df0b527398c56b585940d8b5fbff217429dd95c9d1d3d99e76b7f31a7e1e92ccde0e4c5bd83

                                            • C:\Users\Admin\AppData\Local\Temp\PePUnGXwPp.bat

                                              Filesize

                                              228B

                                              MD5

                                              9616dfbb90136aa28e9913e8cfcc106a

                                              SHA1

                                              05c2b3ad65c5aee017e3b38704ef96eaf3b04b3f

                                              SHA256

                                              2a39cf76737325609ccbe24763953e9249adc64af173181d97c95a712a8bd97b

                                              SHA512

                                              cdd2b28b329f8380e4840cc6b853fb1809f29bef68e1b1d214e8d7b64f300ba8135f2cbcc44b28d9a0509e17d12202ff65307b742df2ef13f9f062aa5eeaa58d

                                            • C:\Users\Admin\AppData\Local\Temp\QHkN6qNcbm.bat

                                              Filesize

                                              228B

                                              MD5

                                              c232751117cde162f371f802e6fd818e

                                              SHA1

                                              745133bf265d4e06958988101020c2237066baf9

                                              SHA256

                                              aaacfa642e4d90c007a6f2c3311ca01ea2d0bd6d5f99ea4a5fb161a6df58d163

                                              SHA512

                                              674f326e255f44585b69fe9d27651c54c7fcef36e85bf8cd104049f07dec322651254227abe396911086fb5a884fac9c64712c7bc937d56574787b82fa39e301

                                            • C:\Users\Admin\AppData\Local\Temp\R8cJcUuQgj.bat

                                              Filesize

                                              228B

                                              MD5

                                              0baa905e40bdc110be41cef5ff9f0763

                                              SHA1

                                              3473dfe83f954c7f85b52b009f59a9990b0fc2e9

                                              SHA256

                                              1e0ecb007e02ea03de7bff39177618074c7ea4c3e8c7e0f2836d44d9d8c097e3

                                              SHA512

                                              6c991ade9753bb449b8ef907996ff493127f472633edaf07dca47c67029fda33a21ce9f08a1579fab3c5d649c697bb08938241249b06ba90f8ea79343b4e9d5a

                                            • C:\Users\Admin\AppData\Local\Temp\V9nTU0UPEK.bat

                                              Filesize

                                              228B

                                              MD5

                                              b84b532d262766287db91ff80966246f

                                              SHA1

                                              812b21d653aac8ed052027948d859b6debe63e9a

                                              SHA256

                                              3b97f9892d222f26c54ecf552d65a03af87c3b6f5f82cc7e471cb9b40c49cf69

                                              SHA512

                                              897f56cfc40c169669420dc5d2945b14a85ea110da6d014519ffd60ee9a72d709db99c79b7f4daada233fba925e9cbc4aaa18d69727df11b7620d7ceba2e66fd

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5wyjtpg.bb1.ps1

                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Users\Admin\AppData\Local\Temp\fjnbjzFmbP.bat

                                              Filesize

                                              228B

                                              MD5

                                              a8793c965ad5047e6f95791a00216523

                                              SHA1

                                              6c6caad3fd90a9a0d928c44d58d0341c58f27d19

                                              SHA256

                                              880197a31507bf08320f1e8ab706779c98008a8842eeade4aacf13138b4b26e3

                                              SHA512

                                              1f63b75615a7b78dbf2c9db23550df8e743c8b3792eceb2594bfae7221e9e163fa80753ff9018c9eb304ec0dbcf0d4474f718e7d86a2ea6066941de3c4375e90

                                            • C:\Users\Admin\AppData\Local\Temp\fq9TqI16of.bat

                                              Filesize

                                              228B

                                              MD5

                                              98f5f522a4e9fbacbc75194b0fb8ed2b

                                              SHA1

                                              28424af41ab6fd7752ada82fc458de1dd21ccd77

                                              SHA256

                                              41dc9bbd221613c157bebeefb3017c8c278d10434ab90e12df52b14594e0f722

                                              SHA512

                                              b9983043539ef42cda81cfc3a7012e082af0d62b9b5b5ff03862e9de4d6e1372e85a0bfad99d9b17b5078aa47d642c92ca137d367b19aea776be9dbc91cb7165

                                            • C:\Users\Admin\AppData\Local\Temp\hlBWXN5z7R.bat

                                              Filesize

                                              228B

                                              MD5

                                              18842ce4e32842e9931857a8ff4efb01

                                              SHA1

                                              e7b0b34427a41fef45d64921922fa28c7341e1cb

                                              SHA256

                                              067a2e3ca1c1ad8336c93e9f566d51c0de812739c73f063f9ee34f3d61ec90bf

                                              SHA512

                                              692646d65c1b58924dedb5e82eec96732f5d7de6118ee6bcf5c7ca399711793807aa1a6dd21b909257875b56480e139b5c5841840e7f601600a8b0bfadfed9cd

                                            • C:\Users\Admin\AppData\Local\Temp\iqKdioc4MG.bat

                                              Filesize

                                              228B

                                              MD5

                                              28a156c16f0cebb95677bc70dbc0ea17

                                              SHA1

                                              55636ecb32493490172b182899c84e779aa7db3e

                                              SHA256

                                              a755df312b242dd26c8ff1eacd61d49d36a1fd15bb557d9e2809fa6d9f67ab33

                                              SHA512

                                              b451a87b3e581e83f84ec9e06a37004a52d7e12b17bed4cd1b19d6e0d8d5f9642df3dd7baf4402a83a53fee67791c07cb3f92fb34daee2563ad7ebdbc5006cd7

                                            • C:\providercommon\1zu9dW.bat

                                              Filesize

                                              36B

                                              MD5

                                              6783c3ee07c7d151ceac57f1f9c8bed7

                                              SHA1

                                              17468f98f95bf504cc1f83c49e49a78526b3ea03

                                              SHA256

                                              8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                              SHA512

                                              c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                            • C:\providercommon\DllCommonsvc.exe

                                              Filesize

                                              1.0MB

                                              MD5

                                              bd31e94b4143c4ce49c17d3af46bcad0

                                              SHA1

                                              f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                              SHA256

                                              b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                              SHA512

                                              f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                            • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                              Filesize

                                              197B

                                              MD5

                                              8088241160261560a02c84025d107592

                                              SHA1

                                              083121f7027557570994c9fc211df61730455bb5

                                              SHA256

                                              2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                              SHA512

                                              20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                            • memory/232-145-0x000000001C900000-0x000000001CAA9000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/736-181-0x000000001C900000-0x000000001CA6A000-memory.dmp

                                              Filesize

                                              1.4MB

                                            • memory/748-124-0x000000001BDC0000-0x000000001BF69000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/1644-105-0x0000000000A70000-0x0000000000A82000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/2688-175-0x000000001C920000-0x000000001CAC9000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/2804-14-0x0000000000E70000-0x0000000000E82000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/2804-13-0x00000000004A0000-0x00000000005B0000-memory.dmp

                                              Filesize

                                              1.1MB

                                            • memory/2804-12-0x00007FFC274F3000-0x00007FFC274F5000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/2804-17-0x00000000026E0000-0x00000000026EC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2804-16-0x00000000026D0000-0x00000000026DC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/2804-15-0x00000000026C0000-0x00000000026CC000-memory.dmp

                                              Filesize

                                              48KB

                                            • memory/3280-155-0x00000000012D0000-0x00000000012E2000-memory.dmp

                                              Filesize

                                              72KB

                                            • memory/3280-160-0x000000001C530000-0x000000001C6D9000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/3512-152-0x000000001C250000-0x000000001C3F9000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/3836-188-0x000000001C1C0000-0x000000001C369000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/3916-131-0x000000001C6E0000-0x000000001C889000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/4424-167-0x000000001BF30000-0x000000001C0D9000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/4524-138-0x000000001C600000-0x000000001C7A9000-memory.dmp

                                              Filesize

                                              1.7MB

                                            • memory/4992-32-0x0000018EF16E0000-0x0000018EF1702000-memory.dmp

                                              Filesize

                                              136KB