Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 10:45
Behavioral task
behavioral1
Sample
JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe
-
Size
1.3MB
-
MD5
0e82b7d081049f607d2fc1587c6e1cec
-
SHA1
c9e5549f53779ee98675a58177f18d1a5fe95d71
-
SHA256
9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1
-
SHA512
ee233f1476d06a5832bd2fca32fd79a63bbde9d8c2d2343934c6dd90f27a9078cc432f19ac19b33d21af8110678da85203b8a0860672ff2f242104583dd9b22c
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2616 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2216 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2604 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3060 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3064 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 524 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 780 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1368 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2460 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2968 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2580 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2680 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1516 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1744 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2136 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1428 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2276 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2020 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1668 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1496 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1040 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1836 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1076 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1060 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3012 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1600 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1136 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 372 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1876 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 772 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1532 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2448 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2024 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 756 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2328 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1540 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1696 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 556 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 852 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2412 2204 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2160 2204 schtasks.exe 34 -
resource yara_rule behavioral1/files/0x0008000000016855-9.dat dcrat behavioral1/memory/840-13-0x0000000000250000-0x0000000000360000-memory.dmp dcrat behavioral1/memory/1256-71-0x00000000010D0000-0x00000000011E0000-memory.dmp dcrat behavioral1/memory/2052-261-0x00000000013E0000-0x00000000014F0000-memory.dmp dcrat behavioral1/memory/2376-321-0x0000000000330000-0x0000000000440000-memory.dmp dcrat behavioral1/memory/3056-381-0x00000000013A0000-0x00000000014B0000-memory.dmp dcrat behavioral1/memory/568-500-0x0000000000140000-0x0000000000250000-memory.dmp dcrat behavioral1/memory/2716-560-0x0000000000DD0000-0x0000000000EE0000-memory.dmp dcrat behavioral1/memory/1072-679-0x0000000000300000-0x0000000000410000-memory.dmp dcrat behavioral1/memory/2100-739-0x0000000000D30000-0x0000000000E40000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2900 powershell.exe 2684 powershell.exe 1688 powershell.exe 2512 powershell.exe 1756 powershell.exe 2404 powershell.exe 2396 powershell.exe 2372 powershell.exe 548 powershell.exe 1856 powershell.exe 2364 powershell.exe 1108 powershell.exe 1616 powershell.exe 2380 powershell.exe 856 powershell.exe 1308 powershell.exe 1584 powershell.exe -
Executes dropped EXE 12 IoCs
pid Process 840 DllCommonsvc.exe 1256 audiodg.exe 1824 audiodg.exe 2052 audiodg.exe 2376 audiodg.exe 3056 audiodg.exe 1720 audiodg.exe 568 audiodg.exe 2716 audiodg.exe 2360 audiodg.exe 1072 audiodg.exe 2100 audiodg.exe -
Loads dropped DLL 2 IoCs
pid Process 2260 cmd.exe 2260 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
flow ioc 9 raw.githubusercontent.com 27 raw.githubusercontent.com 30 raw.githubusercontent.com 37 raw.githubusercontent.com 4 raw.githubusercontent.com 5 raw.githubusercontent.com 19 raw.githubusercontent.com 23 raw.githubusercontent.com 34 raw.githubusercontent.com 13 raw.githubusercontent.com 16 raw.githubusercontent.com -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\es-ES\f3b6ecef712a24 DllCommonsvc.exe File created C:\Program Files\Windows Defender\de-DE\audiodg.exe DllCommonsvc.exe File created C:\Program Files\Windows Defender\de-DE\42af1c969fbb7b DllCommonsvc.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe DllCommonsvc.exe -
Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\PLA\System\27d1bcfc3c54e0 DllCommonsvc.exe File created C:\Windows\it-IT\sppsvc.exe DllCommonsvc.exe File created C:\Windows\it-IT\0a1fd5f707cd16 DllCommonsvc.exe File created C:\Windows\Help\Help\de-DE\audiodg.exe DllCommonsvc.exe File created C:\Windows\Help\Help\de-DE\42af1c969fbb7b DllCommonsvc.exe File created C:\Windows\Speech\lsass.exe DllCommonsvc.exe File created C:\Windows\Speech\6203df4a6bafc7 DllCommonsvc.exe File created C:\Windows\PLA\System\System.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1548 schtasks.exe 3012 schtasks.exe 372 schtasks.exe 1540 schtasks.exe 852 schtasks.exe 2624 schtasks.exe 780 schtasks.exe 1696 schtasks.exe 1876 schtasks.exe 1532 schtasks.exe 1368 schtasks.exe 2968 schtasks.exe 2580 schtasks.exe 1428 schtasks.exe 2184 schtasks.exe 1040 schtasks.exe 2448 schtasks.exe 2024 schtasks.exe 556 schtasks.exe 524 schtasks.exe 2460 schtasks.exe 1496 schtasks.exe 1600 schtasks.exe 1136 schtasks.exe 772 schtasks.exe 2328 schtasks.exe 2412 schtasks.exe 2616 schtasks.exe 3064 schtasks.exe 2680 schtasks.exe 1744 schtasks.exe 2276 schtasks.exe 1076 schtasks.exe 2672 schtasks.exe 2872 schtasks.exe 2604 schtasks.exe 2020 schtasks.exe 1668 schtasks.exe 1836 schtasks.exe 1060 schtasks.exe 1724 schtasks.exe 2160 schtasks.exe 2216 schtasks.exe 3060 schtasks.exe 1516 schtasks.exe 2136 schtasks.exe 1868 schtasks.exe 756 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 840 DllCommonsvc.exe 840 DllCommonsvc.exe 840 DllCommonsvc.exe 840 DllCommonsvc.exe 840 DllCommonsvc.exe 840 DllCommonsvc.exe 840 DllCommonsvc.exe 1688 powershell.exe 856 powershell.exe 2512 powershell.exe 1856 powershell.exe 1616 powershell.exe 1584 powershell.exe 1756 powershell.exe 2684 powershell.exe 1256 audiodg.exe 1108 powershell.exe 2364 powershell.exe 2396 powershell.exe 548 powershell.exe 2372 powershell.exe 2900 powershell.exe 2380 powershell.exe 1308 powershell.exe 2404 powershell.exe 1824 audiodg.exe 2052 audiodg.exe 2376 audiodg.exe 3056 audiodg.exe 1720 audiodg.exe 568 audiodg.exe 2716 audiodg.exe 2360 audiodg.exe 1072 audiodg.exe 2100 audiodg.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 840 DllCommonsvc.exe Token: SeDebugPrivilege 1688 powershell.exe Token: SeDebugPrivilege 856 powershell.exe Token: SeDebugPrivilege 2512 powershell.exe Token: SeDebugPrivilege 1856 powershell.exe Token: SeDebugPrivilege 1256 audiodg.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeDebugPrivilege 1584 powershell.exe Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeDebugPrivilege 1108 powershell.exe Token: SeDebugPrivilege 2364 powershell.exe Token: SeDebugPrivilege 2396 powershell.exe Token: SeDebugPrivilege 548 powershell.exe Token: SeDebugPrivilege 2372 powershell.exe Token: SeDebugPrivilege 2900 powershell.exe Token: SeDebugPrivilege 2380 powershell.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeDebugPrivilege 2404 powershell.exe Token: SeDebugPrivilege 1824 audiodg.exe Token: SeDebugPrivilege 2052 audiodg.exe Token: SeDebugPrivilege 2376 audiodg.exe Token: SeDebugPrivilege 3056 audiodg.exe Token: SeDebugPrivilege 1720 audiodg.exe Token: SeDebugPrivilege 568 audiodg.exe Token: SeDebugPrivilege 2716 audiodg.exe Token: SeDebugPrivilege 2360 audiodg.exe Token: SeDebugPrivilege 1072 audiodg.exe Token: SeDebugPrivilege 2100 audiodg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 812 wrote to memory of 2500 812 JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe 30 PID 812 wrote to memory of 2500 812 JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe 30 PID 812 wrote to memory of 2500 812 JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe 30 PID 812 wrote to memory of 2500 812 JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe 30 PID 2500 wrote to memory of 2260 2500 WScript.exe 31 PID 2500 wrote to memory of 2260 2500 WScript.exe 31 PID 2500 wrote to memory of 2260 2500 WScript.exe 31 PID 2500 wrote to memory of 2260 2500 WScript.exe 31 PID 2260 wrote to memory of 840 2260 cmd.exe 33 PID 2260 wrote to memory of 840 2260 cmd.exe 33 PID 2260 wrote to memory of 840 2260 cmd.exe 33 PID 2260 wrote to memory of 840 2260 cmd.exe 33 PID 840 wrote to memory of 1856 840 DllCommonsvc.exe 83 PID 840 wrote to memory of 1856 840 DllCommonsvc.exe 83 PID 840 wrote to memory of 1856 840 DllCommonsvc.exe 83 PID 840 wrote to memory of 2512 840 DllCommonsvc.exe 84 PID 840 wrote to memory of 2512 840 DllCommonsvc.exe 84 PID 840 wrote to memory of 2512 840 DllCommonsvc.exe 84 PID 840 wrote to memory of 1756 840 DllCommonsvc.exe 85 PID 840 wrote to memory of 1756 840 DllCommonsvc.exe 85 PID 840 wrote to memory of 1756 840 DllCommonsvc.exe 85 PID 840 wrote to memory of 2364 840 DllCommonsvc.exe 86 PID 840 wrote to memory of 2364 840 DllCommonsvc.exe 86 PID 840 wrote to memory of 2364 840 DllCommonsvc.exe 86 PID 840 wrote to memory of 856 840 DllCommonsvc.exe 87 PID 840 wrote to memory of 856 840 DllCommonsvc.exe 87 PID 840 wrote to memory of 856 840 DllCommonsvc.exe 87 PID 840 wrote to memory of 1308 840 DllCommonsvc.exe 88 PID 840 wrote to memory of 1308 840 DllCommonsvc.exe 88 PID 840 wrote to memory of 1308 840 DllCommonsvc.exe 88 PID 840 wrote to memory of 1584 840 DllCommonsvc.exe 89 PID 840 wrote to memory of 1584 840 DllCommonsvc.exe 89 PID 840 wrote to memory of 1584 840 DllCommonsvc.exe 89 PID 840 wrote to memory of 2900 840 DllCommonsvc.exe 90 PID 840 wrote to memory of 2900 840 DllCommonsvc.exe 90 PID 840 wrote to memory of 2900 840 DllCommonsvc.exe 90 PID 840 wrote to memory of 1688 840 DllCommonsvc.exe 91 PID 840 wrote to memory of 1688 840 DllCommonsvc.exe 91 PID 840 wrote to memory of 1688 840 DllCommonsvc.exe 91 PID 840 wrote to memory of 548 840 DllCommonsvc.exe 92 PID 840 wrote to memory of 548 840 DllCommonsvc.exe 92 PID 840 wrote to memory of 548 840 DllCommonsvc.exe 92 PID 840 wrote to memory of 2372 840 DllCommonsvc.exe 94 PID 840 wrote to memory of 2372 840 DllCommonsvc.exe 94 PID 840 wrote to memory of 2372 840 DllCommonsvc.exe 94 PID 840 wrote to memory of 2404 840 DllCommonsvc.exe 96 PID 840 wrote to memory of 2404 840 DllCommonsvc.exe 96 PID 840 wrote to memory of 2404 840 DllCommonsvc.exe 96 PID 840 wrote to memory of 2380 840 DllCommonsvc.exe 97 PID 840 wrote to memory of 2380 840 DllCommonsvc.exe 97 PID 840 wrote to memory of 2380 840 DllCommonsvc.exe 97 PID 840 wrote to memory of 1616 840 DllCommonsvc.exe 98 PID 840 wrote to memory of 1616 840 DllCommonsvc.exe 98 PID 840 wrote to memory of 1616 840 DllCommonsvc.exe 98 PID 840 wrote to memory of 2396 840 DllCommonsvc.exe 99 PID 840 wrote to memory of 2396 840 DllCommonsvc.exe 99 PID 840 wrote to memory of 2396 840 DllCommonsvc.exe 99 PID 840 wrote to memory of 1108 840 DllCommonsvc.exe 101 PID 840 wrote to memory of 1108 840 DllCommonsvc.exe 101 PID 840 wrote to memory of 1108 840 DllCommonsvc.exe 101 PID 840 wrote to memory of 2684 840 DllCommonsvc.exe 102 PID 840 wrote to memory of 2684 840 DllCommonsvc.exe 102 PID 840 wrote to memory of 2684 840 DllCommonsvc.exe 102 PID 840 wrote to memory of 1256 840 DllCommonsvc.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9e4845ba4a94712ef14dc23ee2e252db3c0b45f59ea3b8734ea39d9fa66083e1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\System\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\de-DE\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\lsm.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Help\Help\de-DE\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\J97QZsi4Oz.bat"6⤵PID:2720
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:27⤵PID:1624
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1824 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jkzlbVqk90.bat"8⤵PID:1536
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:29⤵PID:2788
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KRs2fZV4we.bat"10⤵PID:2776
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:211⤵PID:1916
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\arqkgCRh4V.bat"12⤵PID:2280
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:213⤵PID:2716
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"13⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Pbgl9PPr7s.bat"14⤵PID:3060
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:215⤵PID:1708
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zKs2Tjd9zb.bat"16⤵PID:1804
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:217⤵PID:1596
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\q2cXKRfm9B.bat"18⤵PID:1308
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:219⤵PID:2456
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7FnFm4j3ls.bat"20⤵PID:3024
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:221⤵PID:1132
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hANH4lx1y1.bat"22⤵PID:1836
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:223⤵PID:584
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EUl4QLAvAv.bat"24⤵PID:2080
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:225⤵PID:1960
-
-
C:\Program Files\Windows Defender\de-DE\audiodg.exe"C:\Program Files\Windows Defender\de-DE\audiodg.exe"25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\es-ES\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft Help\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Speech\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Speech\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Windows\Speech\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\PLA\System\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1368
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\Windows\PLA\System\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "DllCommonsvcD" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\DllCommonsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2680
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\de-DE\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\de-DE\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\providercommon\lsm.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\providercommon\lsm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2276
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2184
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1668
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\it-IT\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1040
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Windows\it-IT\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\providercommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1060
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3012
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1136
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\Windows\Help\Help\de-DE\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Windows\Help\Help\de-DE\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:772
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Windows\Help\Help\de-DE\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1532
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2448
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 14 /tr "'C:\Recovery\1f4ba082-69f6-11ef-a143-62cb582c238c\OSPPSVC.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:756
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\providercommon\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\providercommon\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\providercommon\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\providercommon\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:852
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\providercommon\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\providercommon\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588393777e34ab0b3628461a46f81bca3
SHA186ac8180a373b75ee314f23f4ffc8409a3f57fb8
SHA256db9e36f3c4a5e6b11d7802456cbcb6cb01276edd9b0a8425c3741a348e9d48cf
SHA51280d5e1843fda7b8afefbb4c9dfaf0cba64e9db05bdc61d4387fda74719edfec9277db93791289b904751cbc4c0132bbe67a2eb9306e626d347ffcf7ab377f80c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c4ce04e77546640cd6a9ec0072018450
SHA1739084819a29bea10b8c3d0a6f4acfe59cc6a6b8
SHA25644ba6b5965c48ca5b0f2909262940ead913333d8bac9d596db26055143bdb285
SHA51285bd7a4c1019566b4803f893413fedb26bd00718448e23896ab92e4b67714a50102aeb2dbc36df47bed63779b009b556ce795298ff035ee0765a7c0ace5c2d1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cb63915740ea3566fad60cef57f4e0dc
SHA1c64fbefc99b9566add8b3e9a9edf1738398c351f
SHA2562b17321b76f4f198454e1aa625ec382c418b052e004949bae4fea9e71443597f
SHA5121297eff58198434ad0a5e8914941b73ac4cb74e8ff81d4aabb38f2e9a71904f922a9fa9c9af9ded9c80cfca14ab0026e163f51561a8e5282ce76c39b8e9bccee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5705aaf1d8d7402cfcb6facd0d0a7155e
SHA11c4f5f6e538b6c2bd80e0d4d9430cb3e8ec51e9d
SHA256a5b00556e1ea69afc17524338f1e4288662ab777f5f262d092b1c346a1458799
SHA512973d100fa545f85a4aaea5690bbce78d45ee5cb4d75be43444ba07b7a6a930a6380c908164053c4614beac6f4ad679564d81130ea3b6a66b8cafdce4eb784df8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7378d581c83bb958bc50f669912cf44
SHA14fc0f8821b46389e4fb5dac5d45aaa88e15b9834
SHA25698a405f43f6ed1bbad6af6b3d905fbebb916242d02be2f0c744cfc3baad9b21d
SHA51272b2645a0d925f97197823631edb61ca9003bd415ab33dcaaa7b3be8d929f09bde5c95a612b891a2f4947bc37c9d6e1c131cbc9653f9a4b26f6ce015978738fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD507994a1afdc7c33459c81ee43e972d3a
SHA12f13332d3e95d1e10b91f713529c57a35f57812e
SHA25678710b7411e0501ad4abefec5267736ec994487b4b6debc5b11461809344a6e6
SHA512c7a3429ff2e7b5a36f2dff0ec572812d6f85cff42cf32109579b7585f202824e441c5aff33b22604f046c0b563d129fb4908a0c22be13f13f77db40bcedcca3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51057d157cd61490f08b0cb56936577d7
SHA1fe436aabfabdb8c82c376e25266d8699c1d8b5d8
SHA25610eb6308d02cc627b30817ca1c7eb1df9b1ae6dbc2c80b99ea237a5ed9bf4ac1
SHA5125627484d67fca12fd01ebbdf7004ed75948ad8a018cc1237f5e984d8e043b728e66e61bcfd09ae18699ecc88e9adb9d52aa2b25f3790ae1b2175f1db086969a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54197db331c64a9f6ea43449b0d3f0bfa
SHA1ab45c62010850c4c36c5fc0520e64849a56067ae
SHA2568d39609aac8888fbf9b991af59139f63d6cfb6ac570c497f052e7a3d4f43a28e
SHA5128f6d2af244acbf0a511c3be42f0d08200402a10d92cfb35b3f233e82f0a6781621e34fa81114172792ff57f2cb109e5a88f0e7a49b0bd4173baf23c491c2d375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5469c6bd5c737e5b1e8fc093ed9fd47a4
SHA13ee48ee12cfe484c60d103fabddc38ecae89a33a
SHA256e311af551d4f3ba7917dc1bd3eeb72e02e704dcdd1b6de5cec6687492ac9e012
SHA512cbfc95e4025ff660c393a46872dccb28a0fc769a339b7da2be34aa48a44d53d5325f6ad2c9c2cd7e69565d672e0c7d7bba996fee98154180118a7b69b7b9efd7
-
Filesize
216B
MD5eabca5af02a0b0eecde65025e4651878
SHA1e5eb4aea1aab9a1980e23f019615903a16ae2432
SHA256acc71f9edf6101de46cfe25fb139e55046908f9c242de4d5924f775fe8c83f93
SHA512c95a467e855a95d0bc1d90dd6af304fbf3d160ff0513c3f799c05573ce06f8636f584e8ffba0eb3ab095ee8b817187c669fc2140aca8f7b2efa367ef2e63183c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
216B
MD56af168a8c7084c3f1aa54088e85383e4
SHA1d858f505c437591151b73bb76245ce821205323c
SHA256e373253b0f770d92d44461cd9e7502a43e6d874dbe16c1562a4377850ed1ddab
SHA51266e466351be5a28db6039e2fd66709ae59a546b0cbac7be1284f1c49c7aa09e3a7e7473fa299f63ab02142cce66b4b352e0867764ff020a6e49f23d4c8771cb2
-
Filesize
216B
MD5c8c15e6c1c7f647bd9b8866021422a59
SHA1be160e339ff82081cdec0ec838362402b2262d81
SHA256f8a74401d4f10193a405712359ab28f6577170d61abeab77fde0eb3c371a1b02
SHA5122b4bc163c68f4e52b5bdd9d21239673e525c560b703d95f38447800f2f2658646db3dd1afa444de5186e629959de5ff69709441de14d8cbae9df83c31c2b1ccb
-
Filesize
216B
MD546f229d0f376016f7b1d601f043d490b
SHA11bd75359365f9f644d3a14c03f723d65dff822b1
SHA256e9775ed5953947094f023c7f8d81914589f9537bd472ba2bb1d2c2ad50361c30
SHA5121533cbe128bafa89e442b077df8002ec79ce507e48d6e9402b6b3abbc913ed258338ebfeb93007aa9f7a5b02245d0aa7b6b1212bdad81b2af5d119125e3b3e23
-
Filesize
216B
MD581f08d4aae5766bee219c524b3c1cdf1
SHA19d1af76e16ae251eca8f8c5c2ca47a7b80306791
SHA256f1936a84fb00758e424aeaa536d02d2d4391a985a48c303334d8ef4e7555254f
SHA512758837c1fc1a20db26e5d90cd4f6208f2023ef443d77df7f7c3071edb60974ff1556d409fa25d87e7c26cf7a75cf74a0fe838f2d645d756dcf7cf48c2fbfab3e
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
216B
MD56ae87e0a08674b0d0474055d85d2bd16
SHA15f6b06ce698e0c3f68aa0c50b726c6f3f7f89992
SHA256fcf2f61a70d4ece9a45a6ed49677f6c7a362c34383ec66d3cc71c65854b52030
SHA5122d36b85d4a89a73a0480f91cafaf2452219e93f0eca35eeddf3ab2a8f2eb33b2c75e72a6ff79a6fdbf840cf9fc89934e4f6a6eec9319ee22e79d9d93e78ed009
-
Filesize
216B
MD51e93f18f97d74b7a1e02a570a0e00a54
SHA1ae97368824a4c6710327dbb3526aea223785507e
SHA2561e05a9362220bd601f12936404e475cb6adf00f91b1bc66462677b1d4460e137
SHA512f41b964616bc440a86d94feb27e762e00ba38710ef6935f20b09fd13305c618c6d4c81f49900cb4f1c89e01861eda1fb3fe18cd5c675c34bd0cd7323b9522c3f
-
Filesize
216B
MD55621b127bc013021190856fe172ecd7b
SHA168c859334858c0797d1f0af9da3cad30d75d77e7
SHA256265b85ef0957d8d3e56c19e0919da80f968e65b502a3c91aee3e663914f02792
SHA512888d30b3f689978ea5fd943468f48677321c8119081d355398aa5a8b19db4665e1a0c827642a71fec9a8295ce8c6fccdf6fb3a35ceb8581523038aae06f486bd
-
Filesize
216B
MD538279e8460f7c9c819974afa0ef1078e
SHA16d70b3399ce1f29862c79118dda96ebe7056499d
SHA256a4e18a2047d2d2baa9298c097d421534b91f7d898091d110578fb0b31d36c85c
SHA5129a75d6d096fb10d69ba443febea8f983f20ccde1617ff21d92be708cf68b0e640624b91ffcfafae478094651b99a3811b79721a6abd81607bada72f171c47448
-
Filesize
216B
MD57b29cf0d9177755b129a513cfbc4f995
SHA139aaadc7cfce667154c90c1a60f67ce68d489354
SHA256c43ecf40a599c7603469d49f7484bcbbc2a01c343abda4dace8113c97520f8f0
SHA512e4ce1c537e9156ac1d7f0d2edaf8a86e183203019a0c476febc5060cab5e7df64f372bb7906002a30ef45da3297c196bc8bba74ccd1cfc3510167cbd64e36375
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56282f65ff876c73c0c5cef8d33f50917
SHA1f42ef8969f9cfb75060a837d30df480378edc5f7
SHA2564b5a6811f9647f301baedcbc4090917e8415ca0b4e35272ba2db912f6ac43b8e
SHA512e2b23617caf0a01fd19d9b7a27ec90cd66b56d437d510ff6f599676aef57cf95d730247ee41697675932ad6f2c421dbe3d1514ef2233060b56018d7325aece89
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394