Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 10:44
Behavioral task
behavioral1
Sample
JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe
-
Size
1.3MB
-
MD5
34c735dba48810f26ae411f201d29703
-
SHA1
5a79a830aea354f9006a0688c7ea9099e79776db
-
SHA256
d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671
-
SHA512
c554222b3e8f60780a0cf1e92bb8a6cac7f02454e7a2d931d1015a3d7fda508106bd3bf049f899115073dd71a0cb7b4e3ef07aa7741fbbf52104593536b1621c
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 36 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 856 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2684 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5024 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4300 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1692 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2884 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1072 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3688 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1828 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3172 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4540 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2140 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3348 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2608 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2840 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2592 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4296 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3616 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2508 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3288 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4192 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4276 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5088 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2400 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3640 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3960 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2204 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 744 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 464 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2440 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4632 3676 schtasks.exe 88 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4660 3676 schtasks.exe 88 -
resource yara_rule behavioral2/files/0x0008000000023baf-10.dat dcrat behavioral2/memory/1592-13-0x0000000000D40000-0x0000000000E50000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4456 powershell.exe 2556 powershell.exe 1184 powershell.exe 1896 powershell.exe 4808 powershell.exe 1984 powershell.exe 3060 powershell.exe 916 powershell.exe 2604 powershell.exe 3148 powershell.exe 1008 powershell.exe 1084 powershell.exe 3196 powershell.exe -
Checks computer location settings 2 TTPs 15 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation System.exe -
Executes dropped EXE 14 IoCs
pid Process 1592 DllCommonsvc.exe 3156 System.exe 3648 System.exe 2140 System.exe 4568 System.exe 3616 System.exe 4200 System.exe 3172 System.exe 1328 System.exe 4844 System.exe 5008 System.exe 5080 System.exe 2112 System.exe 1192 System.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 45 raw.githubusercontent.com 55 raw.githubusercontent.com 15 raw.githubusercontent.com 20 raw.githubusercontent.com 41 raw.githubusercontent.com 46 raw.githubusercontent.com 51 raw.githubusercontent.com 53 raw.githubusercontent.com 54 raw.githubusercontent.com 56 raw.githubusercontent.com 14 raw.githubusercontent.com 38 raw.githubusercontent.com 40 raw.githubusercontent.com -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Mail\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\Registry.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\ee2ad38f3d4382 DllCommonsvc.exe File created C:\Program Files\ModifiableWindowsApps\taskhostw.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\winlogon.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Portable Devices\cc11b995f2a76d DllCommonsvc.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\SKB\sppsvc.exe DllCommonsvc.exe File opened for modification C:\Windows\SKB\sppsvc.exe DllCommonsvc.exe File created C:\Windows\SKB\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\it-IT\RuntimeBroker.exe DllCommonsvc.exe File created C:\Windows\it-IT\9e8d7a4ca61bd9 DllCommonsvc.exe File created C:\Windows\Boot\SppExtComObj.exe DllCommonsvc.exe File created C:\Windows\Prefetch\lsass.exe DllCommonsvc.exe File created C:\Windows\Prefetch\6203df4a6bafc7 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings System.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 36 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2884 schtasks.exe 3616 schtasks.exe 2400 schtasks.exe 3436 schtasks.exe 464 schtasks.exe 3348 schtasks.exe 3640 schtasks.exe 3960 schtasks.exe 1968 schtasks.exe 1828 schtasks.exe 4540 schtasks.exe 2140 schtasks.exe 2608 schtasks.exe 2840 schtasks.exe 4192 schtasks.exe 1524 schtasks.exe 744 schtasks.exe 2204 schtasks.exe 4660 schtasks.exe 2076 schtasks.exe 1692 schtasks.exe 3688 schtasks.exe 2508 schtasks.exe 5088 schtasks.exe 2684 schtasks.exe 4300 schtasks.exe 3172 schtasks.exe 4296 schtasks.exe 5024 schtasks.exe 2592 schtasks.exe 4632 schtasks.exe 856 schtasks.exe 1072 schtasks.exe 3288 schtasks.exe 4276 schtasks.exe 2440 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 1592 DllCommonsvc.exe 2604 powershell.exe 2604 powershell.exe 3060 powershell.exe 3060 powershell.exe 916 powershell.exe 916 powershell.exe 4456 powershell.exe 4456 powershell.exe 1084 powershell.exe 1084 powershell.exe 1008 powershell.exe 1008 powershell.exe 1184 powershell.exe 1184 powershell.exe 1984 powershell.exe 1984 powershell.exe 2556 powershell.exe 2556 powershell.exe 3196 powershell.exe 3196 powershell.exe 4808 powershell.exe 4808 powershell.exe 1896 powershell.exe 1896 powershell.exe 1084 powershell.exe 3148 powershell.exe 3148 powershell.exe 1984 powershell.exe 3156 System.exe 3156 System.exe 4808 powershell.exe 3060 powershell.exe 2556 powershell.exe 4456 powershell.exe 2604 powershell.exe 1896 powershell.exe 916 powershell.exe 1008 powershell.exe 1184 powershell.exe 3196 powershell.exe 3148 powershell.exe 3648 System.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 1592 DllCommonsvc.exe Token: SeDebugPrivilege 2604 powershell.exe Token: SeDebugPrivilege 3060 powershell.exe Token: SeDebugPrivilege 916 powershell.exe Token: SeDebugPrivilege 4456 powershell.exe Token: SeDebugPrivilege 2556 powershell.exe Token: SeDebugPrivilege 1084 powershell.exe Token: SeDebugPrivilege 1896 powershell.exe Token: SeDebugPrivilege 1008 powershell.exe Token: SeDebugPrivilege 1184 powershell.exe Token: SeDebugPrivilege 1984 powershell.exe Token: SeDebugPrivilege 3196 powershell.exe Token: SeDebugPrivilege 4808 powershell.exe Token: SeDebugPrivilege 3156 System.exe Token: SeDebugPrivilege 3148 powershell.exe Token: SeDebugPrivilege 3648 System.exe Token: SeDebugPrivilege 2140 System.exe Token: SeDebugPrivilege 4568 System.exe Token: SeDebugPrivilege 3616 System.exe Token: SeDebugPrivilege 4200 System.exe Token: SeDebugPrivilege 3172 System.exe Token: SeDebugPrivilege 1328 System.exe Token: SeDebugPrivilege 4844 System.exe Token: SeDebugPrivilege 5008 System.exe Token: SeDebugPrivilege 5080 System.exe Token: SeDebugPrivilege 2112 System.exe Token: SeDebugPrivilege 1192 System.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1376 wrote to memory of 1176 1376 JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe 83 PID 1376 wrote to memory of 1176 1376 JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe 83 PID 1376 wrote to memory of 1176 1376 JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe 83 PID 1176 wrote to memory of 1868 1176 WScript.exe 85 PID 1176 wrote to memory of 1868 1176 WScript.exe 85 PID 1176 wrote to memory of 1868 1176 WScript.exe 85 PID 1868 wrote to memory of 1592 1868 cmd.exe 87 PID 1868 wrote to memory of 1592 1868 cmd.exe 87 PID 1592 wrote to memory of 3148 1592 DllCommonsvc.exe 126 PID 1592 wrote to memory of 3148 1592 DllCommonsvc.exe 126 PID 1592 wrote to memory of 1008 1592 DllCommonsvc.exe 127 PID 1592 wrote to memory of 1008 1592 DllCommonsvc.exe 127 PID 1592 wrote to memory of 1084 1592 DllCommonsvc.exe 128 PID 1592 wrote to memory of 1084 1592 DllCommonsvc.exe 128 PID 1592 wrote to memory of 2604 1592 DllCommonsvc.exe 129 PID 1592 wrote to memory of 2604 1592 DllCommonsvc.exe 129 PID 1592 wrote to memory of 2556 1592 DllCommonsvc.exe 130 PID 1592 wrote to memory of 2556 1592 DllCommonsvc.exe 130 PID 1592 wrote to memory of 916 1592 DllCommonsvc.exe 131 PID 1592 wrote to memory of 916 1592 DllCommonsvc.exe 131 PID 1592 wrote to memory of 3060 1592 DllCommonsvc.exe 132 PID 1592 wrote to memory of 3060 1592 DllCommonsvc.exe 132 PID 1592 wrote to memory of 4456 1592 DllCommonsvc.exe 133 PID 1592 wrote to memory of 4456 1592 DllCommonsvc.exe 133 PID 1592 wrote to memory of 1184 1592 DllCommonsvc.exe 135 PID 1592 wrote to memory of 1184 1592 DllCommonsvc.exe 135 PID 1592 wrote to memory of 1984 1592 DllCommonsvc.exe 136 PID 1592 wrote to memory of 1984 1592 DllCommonsvc.exe 136 PID 1592 wrote to memory of 3196 1592 DllCommonsvc.exe 138 PID 1592 wrote to memory of 3196 1592 DllCommonsvc.exe 138 PID 1592 wrote to memory of 4808 1592 DllCommonsvc.exe 139 PID 1592 wrote to memory of 4808 1592 DllCommonsvc.exe 139 PID 1592 wrote to memory of 1896 1592 DllCommonsvc.exe 141 PID 1592 wrote to memory of 1896 1592 DllCommonsvc.exe 141 PID 1592 wrote to memory of 3156 1592 DllCommonsvc.exe 151 PID 1592 wrote to memory of 3156 1592 DllCommonsvc.exe 151 PID 3156 wrote to memory of 1568 3156 System.exe 154 PID 3156 wrote to memory of 1568 3156 System.exe 154 PID 1568 wrote to memory of 1868 1568 cmd.exe 156 PID 1568 wrote to memory of 1868 1568 cmd.exe 156 PID 1568 wrote to memory of 3648 1568 cmd.exe 160 PID 1568 wrote to memory of 3648 1568 cmd.exe 160 PID 3648 wrote to memory of 928 3648 System.exe 166 PID 3648 wrote to memory of 928 3648 System.exe 166 PID 928 wrote to memory of 4252 928 cmd.exe 168 PID 928 wrote to memory of 4252 928 cmd.exe 168 PID 928 wrote to memory of 2140 928 cmd.exe 174 PID 928 wrote to memory of 2140 928 cmd.exe 174 PID 2140 wrote to memory of 1080 2140 System.exe 178 PID 2140 wrote to memory of 1080 2140 System.exe 178 PID 1080 wrote to memory of 4296 1080 cmd.exe 180 PID 1080 wrote to memory of 4296 1080 cmd.exe 180 PID 1080 wrote to memory of 4568 1080 cmd.exe 183 PID 1080 wrote to memory of 4568 1080 cmd.exe 183 PID 4568 wrote to memory of 1988 4568 System.exe 185 PID 4568 wrote to memory of 1988 4568 System.exe 185 PID 1988 wrote to memory of 464 1988 cmd.exe 187 PID 1988 wrote to memory of 464 1988 cmd.exe 187 PID 1988 wrote to memory of 3616 1988 cmd.exe 189 PID 1988 wrote to memory of 3616 1988 cmd.exe 189 PID 3616 wrote to memory of 4336 3616 System.exe 191 PID 3616 wrote to memory of 4336 3616 System.exe 191 PID 4336 wrote to memory of 5056 4336 cmd.exe 193 PID 4336 wrote to memory of 5056 4336 cmd.exe 193 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d0778fe0a64f40e1d7a820f5ba4c637083082657bfb51fa04de3548cd5f32671.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3148
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SKB\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1008
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\unsecapp.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\RuntimeBroker.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3196
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\Registry.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kRqsvBC5Qb.bat"6⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1868
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AJeLhFiBvb.bat"8⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:4252
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9EVEWoB6gn.bat"10⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:4296
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KteTxDTZHh.bat"12⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:464
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjtq3MYUh4.bat"14⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:5056
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4200 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VoHf0I0Wzs.bat"16⤵PID:4808
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:4456
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3172 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\epFjAgKouK.bat"18⤵PID:636
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2272
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1328 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcLsEvVTrf.bat"20⤵PID:4356
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:5052
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4844 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BAWHCtE00Z.bat"22⤵PID:1632
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:1244
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5008 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\D6YKtyItKL.bat"24⤵PID:4452
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1984
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5080 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"26⤵PID:1628
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:227⤵PID:1592
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4NR89d4K3E.bat"28⤵PID:3592
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:229⤵PID:1768
-
-
C:\Recovery\WindowsRE\System.exe"C:\Recovery\WindowsRE\System.exe"29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\SKB\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\SKB\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\SKB\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\providercommon\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1072
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\Default\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1828
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Users\Default\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\providercommon\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\providercommon\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2592
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\it-IT\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3288
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4192
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5088
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Mail\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\Prefetch\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Prefetch\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4632
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Prefetch\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
Filesize
944B
MD5aaaac7c68d2b7997ed502c26fd9f65c2
SHA17c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA2568724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac
-
Filesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
Filesize
197B
MD53ff90cf159cde091ab752f2687dbc2bd
SHA1d9f9a74d109bdff811ec50ad553a646f1bc4a4c6
SHA256284884013c5689e3cc009f2cfe937d32d3fcd7b1989d0425c067f9a83a2bae93
SHA51257c8534a2bfde123a524f307b30e92652f8c1ee76fdd4337993d20d73ef63d177bbeb23ac691df60f8a96b5ee1afcee7dd35734a9f6885165756f4d8abbb56f6
-
Filesize
197B
MD5bd09677cf1ea4120b012ca0d7486db3e
SHA153f547d6e016ed3cf486b573b0f15255d1f62f73
SHA2565add09395b5d7ca160c28270877596097ea867d4040712a31ed0f7e1a70d132e
SHA512a816c065d50871344d4023deef3562808fcff035e3385fa49e962c9cc2812dfe76f354ef024922b32e812f51d56bc231150b2b122637c3a12a9e8846ca67235f
-
Filesize
197B
MD59672e08b722aaea1572ac5b194e5b7cb
SHA1332ebeabe7fd4efef61c9e748f7514bc1edeef8f
SHA2565eb9aeb9857e964edb60c95ea9262747e70c93a1f421e791d251cea5c95c3e3d
SHA5120c1741cabde9a336e57b630a393f66cddf11290d747ae31e672038c912d0b491ab2ee1a912c2a12b1210a97ca0f525a3f57bbb68b2f4006b68e76eef3b241bf3
-
Filesize
197B
MD5066e850f161f3bd0236cb76794cf253a
SHA1a962ba0e6720d789d68abb777d2e0158fd2eee5c
SHA25661ba56e21c1bf6e90845a6ff37a1ada87a1843ebc0fb4d60062287a23143b1cb
SHA51211b25a9465e08380a801b34929a9a81326b84e61ddd292dd5e9258b89bd7521aa2cc41861ba4da787bf3a9105d0d4af0872dc4c43a1131bf971d307a26ad0291
-
Filesize
197B
MD5c773cfc053afa27740cfd24b67c3ab6d
SHA16f8ee65bdd2c00d8fc56313a3246628115cdf753
SHA256d349f218a3c63ad65a00e53046b5b0cd5280e1efbf0606f77935c12e9c1ca50f
SHA512fc2e0281558f8edfa3214fb7eb40fc2622bbf16f25d5fdb6b6719ededcd1493104c851c10992f0319330a4e761dde9802db474e62be8e0c914421c4ebe653d22
-
Filesize
197B
MD5a26df72c13eb491c7945f2345603d0e1
SHA14716ba9d03e9429f9ced5919e91dea82bf94ff45
SHA256ca15aac88dbef22e4e68d1069d0a36c9cc21cfad3075a1e05413aa9c749c971b
SHA512e5dbd24a8df427c3e79f2a163960479bd1cdb168abbc2cea5bb7ad9e0de4f8e94d14d5cd657b1cd2c890a4bcf2e87ebcfd448c546e48050be201c956a20777b9
-
Filesize
197B
MD5fedf04e57a8fbde394fa6f6888aa602f
SHA1ecbe1c7449652f9d2769890e11d750caff759c1d
SHA256fef99f56f162d74d3d6adee4ec3d5b10251a2eb9aedfa305f2b57d8100fd6600
SHA5120804aafb1d715404e20cb823a8aa8915c2a9b06793452b1ca95aca0afbfaa13d0b9e27db6d955995b37f0e088817ba3ac1585871bdb8e93d616dd40233d8ea2e
-
Filesize
197B
MD5e26053d8f7bd50ce03b644ab9a4dbf59
SHA14bcdf6520ba7c27b0af0d3e3d7c209b3d56ac7d3
SHA2565ee50c78f88002deea8f7361396156fbe489eca6733701f0f53dc0ee4e44a8ec
SHA5125e890026f8741857663240b8d5b201288778886733b305ae70e581965bf8aa3a39593ff0597813b89710db916777805096ccd28929e892d6811d63d55849f4be
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
197B
MD5cc82df366ff0db9857b1eb66f92589d4
SHA1fdf7cd6335bd4f033a82348479f1f03c3a4f9058
SHA25664ee9d384ae802d7207f9ba0b707a4b35a953768475eebcda7385d4c9fa06e89
SHA51251f589f4148f9a2b6a4c13f5f5507729fc6961b3062da56fc29fcb919ff3948dc9eb757f09da815e7b7bbef6538fa1ba75900fa61ffe94f45fbc9aed7cca8423
-
Filesize
197B
MD50f31cc8f0ffb1c333e7e273046228725
SHA1ef10ee9c293825e5016fe10051870668e7615eb2
SHA25682e80c7aaed7dd748d9b206a086957f9cc01691dab400d1dc3994c72faa9b5f0
SHA512f7e0162c2cc040386d840127679254b5b03c6bd8409c8a1241979d794f1ebc3d30f43d7fdf413d00214b3e876f355dcb91febe8903b711b53256609550db22c7
-
Filesize
197B
MD5ff1897ae01224ff96eff22c7fa059927
SHA133f76b8ac1f786cda785f0c6f1a7a7b587201883
SHA25668dca30f251703e14f290eac5c4e83fb4aadfd381769b77784f47c1256c6ceca
SHA51276f45fea908cc3cbcd6f45de8ae8326f33815b9d02deee87dd6a9e250fd88d8a3f542e275fb8e7a5c1eca67248bcba9fca0262d05deaf84d12b975ba9fc9ddf7
-
Filesize
197B
MD5a176d48dd36fb3b3de0bc72a594c830c
SHA18e7fc9f7a0ade046bf376b2fa85d9b6c8590a3ea
SHA25678a90ddfbdbfbb994f2067a456a3de5bdfd149834f348b5df573b6285316187b
SHA5120b4377923993b02dd550555bbee23830e4a29e1af2650845583ce7d974d1baeda2eb962ac40d83f5eef452aa7c86cb18092ab0f44fdf2d11d6304a2b2d69642a
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478