Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 10:42

General

  • Target

    JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe

  • Size

    1.3MB

  • MD5

    42fee122b2024a682587008de944366c

  • SHA1

    4264c7f0e4eb9f5702b97fecb19323612c150e42

  • SHA256

    52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e

  • SHA512

    b2c12ef337008e59cc4dd1310062cab37bca4255472c877c4f5a41960e7f8a0a262d02352f53ad369288d1a5fbb7e02371075616bf1b8337884095173ea5ee0f

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Dcrat family
  • Process spawned unexpected child process 21 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 13 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52466d164fec3304e6521c162a7159c2e79774dcfe7f8e32f9cbc8cff853f05e.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4436
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\providercommon\DllCommonsvc.exe
          "C:\providercommon\DllCommonsvc.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3160
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4696
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Libraries\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:760
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2080
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4476
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\cmd.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4568
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\RuntimeBroker.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4692
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MncLDGv9Hr.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2872
            • C:\Windows\system32\w32tm.exe
              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
              6⤵
                PID:1864
              • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4224
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:644
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:1736
                    • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                      "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                      8⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1952
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7hfvN6zFDa.bat"
                        9⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1016
                        • C:\Windows\system32\w32tm.exe
                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                          10⤵
                            PID:412
                          • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                            "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                            10⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2360
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MTMDnLe0ZL.bat"
                              11⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4888
                              • C:\Windows\system32\w32tm.exe
                                w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                12⤵
                                  PID:3636
                                • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                  12⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:824
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RBIFf9IaIr.bat"
                                    13⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1620
                                    • C:\Windows\system32\w32tm.exe
                                      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                      14⤵
                                        PID:2112
                                      • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                        14⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:3456
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat"
                                          15⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:1360
                                          • C:\Windows\system32\w32tm.exe
                                            w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                            16⤵
                                              PID:1544
                                            • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                              16⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:2936
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7hfvN6zFDa.bat"
                                                17⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:1904
                                                • C:\Windows\system32\w32tm.exe
                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                  18⤵
                                                    PID:4600
                                                  • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                                    18⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4524
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tfVhKC50lX.bat"
                                                      19⤵
                                                        PID:1876
                                                        • C:\Windows\system32\w32tm.exe
                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                          20⤵
                                                            PID:3584
                                                          • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                                            20⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4176
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat"
                                                              21⤵
                                                                PID:4768
                                                                • C:\Windows\system32\w32tm.exe
                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                  22⤵
                                                                    PID:932
                                                                  • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                                                    22⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Modifies registry class
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1376
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GW80Ek08hx.bat"
                                                                      23⤵
                                                                        PID:3044
                                                                        • C:\Windows\system32\w32tm.exe
                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                          24⤵
                                                                            PID:2140
                                                                          • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                                                            24⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3372
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OPOGTQits7.bat"
                                                                              25⤵
                                                                                PID:3624
                                                                                • C:\Windows\system32\w32tm.exe
                                                                                  w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                  26⤵
                                                                                    PID:4036
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                                                                    26⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:2928
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat"
                                                                                      27⤵
                                                                                        PID:4208
                                                                                        • C:\Windows\system32\w32tm.exe
                                                                                          w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                                                                                          28⤵
                                                                                            PID:3100
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe"
                                                                                            28⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2744
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft\unsecapp.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3152
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\unsecapp.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4196
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\unsecapp.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2792
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1748
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4064
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\Edge\DllCommonsvc.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4700
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Libraries\smss.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:348
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Libraries\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:916
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\smss.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3156
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2348
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4424
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\Registry.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1740
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4016
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:816
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\unsecapp.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:1320
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\cmd.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4044
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\cmd.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2664
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\cmd.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3624
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\providercommon\RuntimeBroker.exe'" /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2232
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4448
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\providercommon\RuntimeBroker.exe'" /rl HIGHEST /f
                                      1⤵
                                      • Process spawned unexpected child process
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:4852

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\DllCommonsvc.exe.log

                                      Filesize

                                      1KB

                                      MD5

                                      7f3c0ae41f0d9ae10a8985a2c327b8fb

                                      SHA1

                                      d58622bf6b5071beacf3b35bb505bde2000983e3

                                      SHA256

                                      519fceae4d0dd4d09edd1b81bcdfa8aeab4b59eee77a4cd4b6295ce8e591a900

                                      SHA512

                                      8a8fd17eef071f86e672cba0d8fc2cfed6118aff816100b9d7c06eb96443c04c04bc5692259c8d7ecb1563e877921939c61726605af4f969e3f586f0913ed125

                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                      Filesize

                                      2KB

                                      MD5

                                      d85ba6ff808d9e5444a4b369f5bc2730

                                      SHA1

                                      31aa9d96590fff6981b315e0b391b575e4c0804a

                                      SHA256

                                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                      SHA512

                                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      62623d22bd9e037191765d5083ce16a3

                                      SHA1

                                      4a07da6872672f715a4780513d95ed8ddeefd259

                                      SHA256

                                      95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

                                      SHA512

                                      9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      cadef9abd087803c630df65264a6c81c

                                      SHA1

                                      babbf3636c347c8727c35f3eef2ee643dbcc4bd2

                                      SHA256

                                      cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438

                                      SHA512

                                      7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      652B

                                      MD5

                                      13d9387fe4a7c5038e0a6e774f64c5aa

                                      SHA1

                                      2cd65468a021a19cc3ad34f367b7f076324e3ea8

                                      SHA256

                                      fc6561169607fbe029046aadcb9a518b92c6a6f17899d3779da59df70f089770

                                      SHA512

                                      cded81836b8d8e17e19abd1cc55936c8127f845eaff9004f839ce206ac65f76aa1afdedba65c979c04564f28762d2cfef82e8fd00da79234d07eb763313d01f6

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      3a6bad9528f8e23fb5c77fbd81fa28e8

                                      SHA1

                                      f127317c3bc6407f536c0f0600dcbcf1aabfba36

                                      SHA256

                                      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                                      SHA512

                                      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                      Filesize

                                      944B

                                      MD5

                                      d28a889fd956d5cb3accfbaf1143eb6f

                                      SHA1

                                      157ba54b365341f8ff06707d996b3635da8446f7

                                      SHA256

                                      21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                                      SHA512

                                      0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                                    • C:\Users\Admin\AppData\Local\Temp\7hfvN6zFDa.bat

                                      Filesize

                                      219B

                                      MD5

                                      5921e7dd2a3b72396b1c1004c23b3113

                                      SHA1

                                      f67e1dcc3ec22c3cf5a13edb9b647a223399a709

                                      SHA256

                                      ab44102d88960c242c1cdd0a520a2db1832aef9015ac7da76d814483bcaeb662

                                      SHA512

                                      bdbcab22828c5d703c2986b30f17e690dd5f27e4a033db61225fa3290c6d9645eab54bbaa6472482f6ff01775e367eb28a3413f86bd38da1be265f2c6eb6e705

                                    • C:\Users\Admin\AppData\Local\Temp\ATZuYpZxcK.bat

                                      Filesize

                                      219B

                                      MD5

                                      73fa1b550593b9ccacbc20461f091409

                                      SHA1

                                      95836ee12eb80e0b83b376411c10ee124236b625

                                      SHA256

                                      2f6e7ae9111b963156f1a7cfe20e7ea7c269faaaeb02b4c8b0c68d9857b966a1

                                      SHA512

                                      7cbf03f92481cb369bed6aa8242a01146688ed67f4da21b2904edcd02d808e163f7b27b4593b491e81ebaec5d38706b855ffc20823a975ac819d232482db31a4

                                    • C:\Users\Admin\AppData\Local\Temp\GW80Ek08hx.bat

                                      Filesize

                                      219B

                                      MD5

                                      ff9fd98f359ece7e370c953c7d9b90b4

                                      SHA1

                                      73307106eb8cc2784d46b9a92fa71a731356421a

                                      SHA256

                                      0b016e07cbf9897a75815f022e77ff558771e2ae76fef38c94c8797fca30e3d1

                                      SHA512

                                      095dc085679e2187361fce346451bad06c1a31bd0e36b7a6ca4e22bf9164b042527bdfff809fac9c35d2d12f02d56e12e4862e929cd25a7ca4e98c6b2861ffda

                                    • C:\Users\Admin\AppData\Local\Temp\ISA3vp411k.bat

                                      Filesize

                                      219B

                                      MD5

                                      c61611289e4b6ad288e54d244dc22b2a

                                      SHA1

                                      1d7978e057d10a3624e36dd5ab3f630e7713950c

                                      SHA256

                                      3379f10acdb1b5ddb527b6c0a266f7863bb97fefe99408b61ad64c2270483189

                                      SHA512

                                      8595b6d876dfac606f30e3df6bedf3ddce643a805ca150668b8ec914d2a0a00f7ef4a51f9adceed1c267272512c34a1acc03044be58b001224043ae56f8ceb05

                                    • C:\Users\Admin\AppData\Local\Temp\MTMDnLe0ZL.bat

                                      Filesize

                                      219B

                                      MD5

                                      fd4268b644e649070896541d28de5a5e

                                      SHA1

                                      cc00d6e280539bb8484281ac239d9ec5d166f16b

                                      SHA256

                                      aa74b2909dd19f28ed9a9ba8c310de370ecfd509b0e561e5d31cc85722f0b422

                                      SHA512

                                      7d0ad99ce0a232b385d68937a9243688f3ceb512569bf0998d64573e9fccc2397070ef18526c50fc85d92f8a5a7ca5c4c2570e89cee2ca15270ad9dd383cbf38

                                    • C:\Users\Admin\AppData\Local\Temp\MncLDGv9Hr.bat

                                      Filesize

                                      219B

                                      MD5

                                      96e5de81bd7f05867784404ad750ee61

                                      SHA1

                                      17cc0146fa68cbde542995cd8e0954a25b2c6fd6

                                      SHA256

                                      1834d0ba203e9d6a93057e8147bacf88660f7d3e6932fda34056f762c33eeeb9

                                      SHA512

                                      ace7abf74d3e14d4a47495c121aaf6831b8e962ed21b7b98fb54d3c355838dbec5186b504e18026e6afa814a53e9caacd43af2efef27391e26ff5db9a1ec6195

                                    • C:\Users\Admin\AppData\Local\Temp\OPOGTQits7.bat

                                      Filesize

                                      219B

                                      MD5

                                      e964b79126ea24b8fe37a462861afaa4

                                      SHA1

                                      85a1ceb5c54f70f9521f9f1354b85321ad277dc6

                                      SHA256

                                      b3b286348092cb4e9de4efd4c3af0ec19571e7c98145fa2c9ed178671f15506c

                                      SHA512

                                      5ef304b2ff9666e7859af4f267cc3361ed598547df8cabccc89ba800a015e8afa805f37751bcb545d41fb78db47d1be5f8364f56d7adbe4e58f57a3263843fcd

                                    • C:\Users\Admin\AppData\Local\Temp\RBIFf9IaIr.bat

                                      Filesize

                                      219B

                                      MD5

                                      5e8fcd528a2b75065b0dbddcce7610bb

                                      SHA1

                                      0592c62444380fc70b6616d6915decbbb9d6c050

                                      SHA256

                                      2c32fd1ac6fc4b09d596384d8325e9b73d0c44778916721a9ea4b5382706b7e1

                                      SHA512

                                      8976d4d613e4a1a22db76cf70c34e6b3f21c5c8db36bad342b37d2de6125f229a1627ff38c1d9d7d033a6845557ecc8e82ab5db1461762b66a3608700674a478

                                    • C:\Users\Admin\AppData\Local\Temp\UJpHfzfs2i.bat

                                      Filesize

                                      219B

                                      MD5

                                      dce00af02c305f7ec5be3217f1228b1a

                                      SHA1

                                      29e4ce0ce8d3604d2345e78f93d97c4d964aadd3

                                      SHA256

                                      e8c955d067213167dd730245ed389fe9f7be43f98058a749acb781a1c8478e9d

                                      SHA512

                                      20d9fff243071536e86ec177543befc100198b2c7272a618bb59b4eba423e10b456d25422235e96feaf0500fcf426710bc81ab7a94b163a91bc0b2d0fb64f0b7

                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bkfxq0yd.idm.ps1

                                      Filesize

                                      60B

                                      MD5

                                      d17fe0a3f47be24a6453e9ef58c94641

                                      SHA1

                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                      SHA256

                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                      SHA512

                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                    • C:\Users\Admin\AppData\Local\Temp\tfVhKC50lX.bat

                                      Filesize

                                      219B

                                      MD5

                                      f733d4e42a318a767869cedffc708e3c

                                      SHA1

                                      8f703d32aad4eeacbcc3b88c0feb41d33281a8b3

                                      SHA256

                                      3890a9aa0fb85934438538bf30d40520f3fd1d804ced4219098256a1cf6de9c5

                                      SHA512

                                      311cdd1c4d5fe03dd0cd335311304457ba86f42a647b6712f66424acacfe7153dda888241d0514ee5894d75546864c56d91c9aaa18d56f6942a5446e1a864485

                                    • C:\Users\Admin\AppData\Local\Temp\zi4n06VBpB.bat

                                      Filesize

                                      219B

                                      MD5

                                      3046668c59538bd8a9b549208bc3ca5e

                                      SHA1

                                      e7ec9add15d12f82815be1b3df5ea85994bb51f2

                                      SHA256

                                      d408a1ae55d4f8dbd7923e4e36ce82e69a8b053f25711fa5f34da366ab22e4f3

                                      SHA512

                                      17337c4dd534c7af60d326fb090bcfb66cf628e7daa33aef2ececf3b57804f4b85b8441297e784b4b177665ecc4033d9d5800e31fd5fc71661947483f786227c

                                    • C:\providercommon\1zu9dW.bat

                                      Filesize

                                      36B

                                      MD5

                                      6783c3ee07c7d151ceac57f1f9c8bed7

                                      SHA1

                                      17468f98f95bf504cc1f83c49e49a78526b3ea03

                                      SHA256

                                      8ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322

                                      SHA512

                                      c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8

                                    • C:\providercommon\DllCommonsvc.exe

                                      Filesize

                                      1.0MB

                                      MD5

                                      bd31e94b4143c4ce49c17d3af46bcad0

                                      SHA1

                                      f8c51ff3ff909531d9469d4ba1bbabae101853ff

                                      SHA256

                                      b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63

                                      SHA512

                                      f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394

                                    • C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe

                                      Filesize

                                      197B

                                      MD5

                                      8088241160261560a02c84025d107592

                                      SHA1

                                      083121f7027557570994c9fc211df61730455bb5

                                      SHA256

                                      2072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1

                                      SHA512

                                      20d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478

                                    • memory/1376-179-0x0000000002820000-0x0000000002832000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/1952-136-0x00000000029D0000-0x00000000029E2000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/2740-42-0x0000012B208F0000-0x0000012B20912000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/3160-14-0x0000000001740000-0x0000000001752000-memory.dmp

                                      Filesize

                                      72KB

                                    • memory/3160-13-0x0000000000BE0000-0x0000000000CF0000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/3160-15-0x0000000001750000-0x000000000175C000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/3160-12-0x00007FFBF20B3000-0x00007FFBF20B5000-memory.dmp

                                      Filesize

                                      8KB

                                    • memory/3160-16-0x0000000002DD0000-0x0000000002DDC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/3160-17-0x0000000002DE0000-0x0000000002DEC000-memory.dmp

                                      Filesize

                                      48KB

                                    • memory/3372-186-0x0000000002B40000-0x0000000002B52000-memory.dmp

                                      Filesize

                                      72KB