Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 11:24
Behavioral task
behavioral1
Sample
JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe
-
Size
1.3MB
-
MD5
279c172d0c95c31b3ed2ebedfe43215a
-
SHA1
76ccd792a4257ae63b702285526eaedaafaa195f
-
SHA256
e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44
-
SHA512
e606b1615d01b5d0de03b452866ef79d4e40b52c47ee438a04ad1cba774ca6b9e0665b16e9b882a892d0467ff02325798f168b19021b8a652ebaa43dbf27c7b3
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Process spawned unexpected child process 48 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2884 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1964 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2676 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2640 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2692 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2316 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2188 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2024 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 676 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1724 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2968 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2160 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1892 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2952 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2608 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2876 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2660 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 352 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1704 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1508 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2284 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2100 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1624 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 692 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2244 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 596 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1424 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3016 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 708 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 836 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2320 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2800 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 876 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1540 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1440 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1728 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 992 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1612 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 868 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 936 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2260 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2036 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 784 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3032 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2084 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2208 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2520 2916 schtasks.exe 34 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1448 2916 schtasks.exe 34 -
resource yara_rule behavioral1/files/0x0008000000016d21-10.dat dcrat behavioral1/memory/1416-13-0x00000000011D0000-0x00000000012E0000-memory.dmp dcrat behavioral1/memory/956-134-0x0000000000C20000-0x0000000000D30000-memory.dmp dcrat behavioral1/memory/1736-252-0x0000000000FC0000-0x00000000010D0000-memory.dmp dcrat behavioral1/memory/1780-313-0x00000000001D0000-0x00000000002E0000-memory.dmp dcrat behavioral1/memory/1768-374-0x0000000000120000-0x0000000000230000-memory.dmp dcrat behavioral1/memory/540-434-0x00000000011B0000-0x00000000012C0000-memory.dmp dcrat behavioral1/memory/1564-494-0x0000000000090000-0x00000000001A0000-memory.dmp dcrat behavioral1/memory/2536-554-0x0000000000B80000-0x0000000000C90000-memory.dmp dcrat behavioral1/memory/1852-614-0x0000000000CA0000-0x0000000000DB0000-memory.dmp dcrat behavioral1/memory/3020-674-0x0000000000320000-0x0000000000430000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1744 powershell.exe 1980 powershell.exe 2184 powershell.exe 2540 powershell.exe 1936 powershell.exe 2528 powershell.exe 2524 powershell.exe 2556 powershell.exe 1876 powershell.exe 2536 powershell.exe 1532 powershell.exe 2204 powershell.exe 1520 powershell.exe 2352 powershell.exe 2380 powershell.exe 2392 powershell.exe 1924 powershell.exe -
Executes dropped EXE 11 IoCs
pid Process 1416 DllCommonsvc.exe 956 WmiPrvSE.exe 1688 WmiPrvSE.exe 1736 WmiPrvSE.exe 1780 WmiPrvSE.exe 1768 WmiPrvSE.exe 540 WmiPrvSE.exe 1564 WmiPrvSE.exe 2536 WmiPrvSE.exe 1852 WmiPrvSE.exe 3020 WmiPrvSE.exe -
Loads dropped DLL 2 IoCs
pid Process 2328 cmd.exe 2328 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
flow ioc 30 raw.githubusercontent.com 5 raw.githubusercontent.com 12 raw.githubusercontent.com 16 raw.githubusercontent.com 19 raw.githubusercontent.com 23 raw.githubusercontent.com 4 raw.githubusercontent.com 9 raw.githubusercontent.com 26 raw.githubusercontent.com 33 raw.githubusercontent.com 37 raw.githubusercontent.com -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\audiodg.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Sidebar\42af1c969fbb7b DllCommonsvc.exe File created C:\Program Files\Windows Portable Devices\services.exe DllCommonsvc.exe File created C:\Program Files\Windows Portable Devices\c5b4cb5e9653cc DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft Sync Framework\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\6ccacd8608530f DllCommonsvc.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\Migration\WTR\6203df4a6bafc7 DllCommonsvc.exe File opened for modification C:\Windows\Panther\setup.exe\wininit.exe DllCommonsvc.exe File created C:\Windows\Panther\setup.exe\56085415360792 DllCommonsvc.exe File created C:\Windows\Tasks\System.exe DllCommonsvc.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\cmd.exe DllCommonsvc.exe File created C:\Windows\Boot\EFI\es-ES\Idle.exe DllCommonsvc.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\ebf1f9fa8afd6d DllCommonsvc.exe File created C:\Windows\Migration\WTR\lsass.exe DllCommonsvc.exe File created C:\Windows\Panther\setup.exe\wininit.exe DllCommonsvc.exe File created C:\Windows\Tasks\27d1bcfc3c54e0 DllCommonsvc.exe File created C:\Windows\Performance\WinSAT\winlogon.exe DllCommonsvc.exe File created C:\Windows\Performance\WinSAT\cc11b995f2a76d DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2316 schtasks.exe 2608 schtasks.exe 876 schtasks.exe 2520 schtasks.exe 1448 schtasks.exe 2640 schtasks.exe 2692 schtasks.exe 2284 schtasks.exe 992 schtasks.exe 1612 schtasks.exe 2036 schtasks.exe 2208 schtasks.exe 2968 schtasks.exe 1892 schtasks.exe 596 schtasks.exe 1540 schtasks.exe 936 schtasks.exe 2260 schtasks.exe 868 schtasks.exe 2084 schtasks.exe 1964 schtasks.exe 1508 schtasks.exe 2100 schtasks.exe 1624 schtasks.exe 2244 schtasks.exe 708 schtasks.exe 352 schtasks.exe 2320 schtasks.exe 1728 schtasks.exe 1704 schtasks.exe 3032 schtasks.exe 2188 schtasks.exe 2024 schtasks.exe 676 schtasks.exe 1724 schtasks.exe 2160 schtasks.exe 2876 schtasks.exe 1440 schtasks.exe 2884 schtasks.exe 2676 schtasks.exe 2952 schtasks.exe 3016 schtasks.exe 836 schtasks.exe 2800 schtasks.exe 2660 schtasks.exe 692 schtasks.exe 1424 schtasks.exe 784 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1416 DllCommonsvc.exe 2204 powershell.exe 1980 powershell.exe 1744 powershell.exe 1532 powershell.exe 1876 powershell.exe 2184 powershell.exe 2524 powershell.exe 2380 powershell.exe 2352 powershell.exe 2392 powershell.exe 1924 powershell.exe 2528 powershell.exe 2536 powershell.exe 2556 powershell.exe 2540 powershell.exe 1520 powershell.exe 1936 powershell.exe 956 WmiPrvSE.exe 1688 WmiPrvSE.exe 1736 WmiPrvSE.exe 1780 WmiPrvSE.exe 1768 WmiPrvSE.exe 540 WmiPrvSE.exe 1564 WmiPrvSE.exe 2536 WmiPrvSE.exe 1852 WmiPrvSE.exe 3020 WmiPrvSE.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 1416 DllCommonsvc.exe Token: SeDebugPrivilege 2204 powershell.exe Token: SeDebugPrivilege 1980 powershell.exe Token: SeDebugPrivilege 1744 powershell.exe Token: SeDebugPrivilege 1532 powershell.exe Token: SeDebugPrivilege 1876 powershell.exe Token: SeDebugPrivilege 2184 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeDebugPrivilege 2380 powershell.exe Token: SeDebugPrivilege 2352 powershell.exe Token: SeDebugPrivilege 2392 powershell.exe Token: SeDebugPrivilege 1924 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 2536 powershell.exe Token: SeDebugPrivilege 2556 powershell.exe Token: SeDebugPrivilege 2540 powershell.exe Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 1936 powershell.exe Token: SeDebugPrivilege 956 WmiPrvSE.exe Token: SeDebugPrivilege 1688 WmiPrvSE.exe Token: SeDebugPrivilege 1736 WmiPrvSE.exe Token: SeDebugPrivilege 1780 WmiPrvSE.exe Token: SeDebugPrivilege 1768 WmiPrvSE.exe Token: SeDebugPrivilege 540 WmiPrvSE.exe Token: SeDebugPrivilege 1564 WmiPrvSE.exe Token: SeDebugPrivilege 2536 WmiPrvSE.exe Token: SeDebugPrivilege 1852 WmiPrvSE.exe Token: SeDebugPrivilege 3020 WmiPrvSE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2396 2352 JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe 30 PID 2352 wrote to memory of 2396 2352 JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe 30 PID 2352 wrote to memory of 2396 2352 JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe 30 PID 2352 wrote to memory of 2396 2352 JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe 30 PID 2396 wrote to memory of 2328 2396 WScript.exe 31 PID 2396 wrote to memory of 2328 2396 WScript.exe 31 PID 2396 wrote to memory of 2328 2396 WScript.exe 31 PID 2396 wrote to memory of 2328 2396 WScript.exe 31 PID 2328 wrote to memory of 1416 2328 cmd.exe 33 PID 2328 wrote to memory of 1416 2328 cmd.exe 33 PID 2328 wrote to memory of 1416 2328 cmd.exe 33 PID 2328 wrote to memory of 1416 2328 cmd.exe 33 PID 1416 wrote to memory of 1744 1416 DllCommonsvc.exe 83 PID 1416 wrote to memory of 1744 1416 DllCommonsvc.exe 83 PID 1416 wrote to memory of 1744 1416 DllCommonsvc.exe 83 PID 1416 wrote to memory of 2204 1416 DllCommonsvc.exe 84 PID 1416 wrote to memory of 2204 1416 DllCommonsvc.exe 84 PID 1416 wrote to memory of 2204 1416 DllCommonsvc.exe 84 PID 1416 wrote to memory of 1876 1416 DllCommonsvc.exe 85 PID 1416 wrote to memory of 1876 1416 DllCommonsvc.exe 85 PID 1416 wrote to memory of 1876 1416 DllCommonsvc.exe 85 PID 1416 wrote to memory of 1520 1416 DllCommonsvc.exe 87 PID 1416 wrote to memory of 1520 1416 DllCommonsvc.exe 87 PID 1416 wrote to memory of 1520 1416 DllCommonsvc.exe 87 PID 1416 wrote to memory of 1532 1416 DllCommonsvc.exe 88 PID 1416 wrote to memory of 1532 1416 DllCommonsvc.exe 88 PID 1416 wrote to memory of 1532 1416 DllCommonsvc.exe 88 PID 1416 wrote to memory of 1936 1416 DllCommonsvc.exe 90 PID 1416 wrote to memory of 1936 1416 DllCommonsvc.exe 90 PID 1416 wrote to memory of 1936 1416 DllCommonsvc.exe 90 PID 1416 wrote to memory of 1924 1416 DllCommonsvc.exe 91 PID 1416 wrote to memory of 1924 1416 DllCommonsvc.exe 91 PID 1416 wrote to memory of 1924 1416 DllCommonsvc.exe 91 PID 1416 wrote to memory of 2392 1416 DllCommonsvc.exe 92 PID 1416 wrote to memory of 2392 1416 DllCommonsvc.exe 92 PID 1416 wrote to memory of 2392 1416 DllCommonsvc.exe 92 PID 1416 wrote to memory of 2536 1416 DllCommonsvc.exe 93 PID 1416 wrote to memory of 2536 1416 DllCommonsvc.exe 93 PID 1416 wrote to memory of 2536 1416 DllCommonsvc.exe 93 PID 1416 wrote to memory of 2380 1416 DllCommonsvc.exe 94 PID 1416 wrote to memory of 2380 1416 DllCommonsvc.exe 94 PID 1416 wrote to memory of 2380 1416 DllCommonsvc.exe 94 PID 1416 wrote to memory of 2528 1416 DllCommonsvc.exe 95 PID 1416 wrote to memory of 2528 1416 DllCommonsvc.exe 95 PID 1416 wrote to memory of 2528 1416 DllCommonsvc.exe 95 PID 1416 wrote to memory of 2524 1416 DllCommonsvc.exe 96 PID 1416 wrote to memory of 2524 1416 DllCommonsvc.exe 96 PID 1416 wrote to memory of 2524 1416 DllCommonsvc.exe 96 PID 1416 wrote to memory of 2352 1416 DllCommonsvc.exe 97 PID 1416 wrote to memory of 2352 1416 DllCommonsvc.exe 97 PID 1416 wrote to memory of 2352 1416 DllCommonsvc.exe 97 PID 1416 wrote to memory of 2540 1416 DllCommonsvc.exe 98 PID 1416 wrote to memory of 2540 1416 DllCommonsvc.exe 98 PID 1416 wrote to memory of 2540 1416 DllCommonsvc.exe 98 PID 1416 wrote to memory of 2184 1416 DllCommonsvc.exe 100 PID 1416 wrote to memory of 2184 1416 DllCommonsvc.exe 100 PID 1416 wrote to memory of 2184 1416 DllCommonsvc.exe 100 PID 1416 wrote to memory of 1980 1416 DllCommonsvc.exe 101 PID 1416 wrote to memory of 1980 1416 DllCommonsvc.exe 101 PID 1416 wrote to memory of 1980 1416 DllCommonsvc.exe 101 PID 1416 wrote to memory of 2556 1416 DllCommonsvc.exe 102 PID 1416 wrote to memory of 2556 1416 DllCommonsvc.exe 102 PID 1416 wrote to memory of 2556 1416 DllCommonsvc.exe 102 PID 1416 wrote to memory of 676 1416 DllCommonsvc.exe 117 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2bfc7f8f9aabea1e72793f84eed4f81179ad7c7b5683c0e5c5279966e8fbe44.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\setup.exe\wininit.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Tasks\System.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\services.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Performance\WinSAT\winlogon.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\explorer.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\cmd.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\lsass.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\spoolsv.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\kWf52a8ucp.bat"5⤵PID:676
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:2372
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qwBPskakqG.bat"7⤵PID:3008
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:1940
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sPXGbYzrvf.bat"9⤵PID:820
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:210⤵PID:2832
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZES4mQr7Bk.bat"11⤵PID:612
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:212⤵PID:2236
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\rjauxUKpXQ.bat"13⤵PID:936
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:214⤵PID:1920
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"14⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tiHtiEmsSK.bat"15⤵PID:2084
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:216⤵PID:1436
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"16⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\T7QXgceCiI.bat"17⤵PID:2840
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:218⤵PID:2884
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L9j9zErPDE.bat"19⤵PID:1780
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:220⤵PID:2888
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2qVagYZlTM.bat"21⤵PID:3064
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:222⤵PID:1768
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yXZnhMCmO6.bat"23⤵PID:2248
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:224⤵PID:1160
-
-
C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe"24⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\oLfAgN0jmw.bat"25⤵PID:2532
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:226⤵PID:1860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\Panther\setup.exe\wininit.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Panther\setup.exe\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Panther\setup.exe\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2316
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2188
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Windows\Tasks\System.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\Tasks\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Windows\Tasks\System.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2660
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:352
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:596
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\providercommon\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3016
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:708
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\providercommon\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2320
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 14 /tr "'C:\Recovery\20e7eb62-69f6-11ef-be0c-62cb582c238c\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:876
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\cmd.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1540
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1440
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\cmd.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Windows\Migration\WTR\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:992
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Windows\Migration\WTR\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\providercommon\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2260
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\providercommon\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2036
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2084
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c7348e964ce71678a822081bfa9fcb36
SHA190a52bacc55fcb1e40627427e8dd99aa7e99e544
SHA2564a18eab17176c3483ad7d7e1758323bd1950318790410dc01bdb8e894abf77b5
SHA51299015ae51d24e3678fa5461c65e5c7ee0a3c0cd7031fb7da20242051f82275ce23db122df977f8b65ae8140f88c7b56b5873b029b9160981aa18e30ac83edccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5372ed6af5ce1e66acb84c07747e88a9c
SHA1d406cec9afa815ef5c64b2636499983d77ed5e33
SHA256eae55b197a64986a3ec876d1a5b7f0d968ae1fbcbb91aee5b489d22fbc8fb131
SHA51227b6b70e671548df735675853c0c33006565ad99d0735b2a75fb63d954689f525b27fe4b9b9383c80485745d3a29e58fab4b28de51a64819c746c484b2161e9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ffd1cdc9b9a89a8571d5686ed9b02f2f
SHA1041ae3b2fe9765a6b2f9ff2578b8926f68c0770e
SHA25698b7ed7017ac8116503b8dc3b0b00c6f72b5ea412483cfbfc6b34178cb79285e
SHA512057439c1cd74296059becfb6ec9d1345069577e9cda3fe116847d193500b1ef235304b96633dbaf075d0ff4c7b8633a6d4affea9987f515ba7fbd8f68807c1a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5360c8998d71ad76b347a742f5ef16acb
SHA192cc09b1514f7c4e10c6ede4e15b7e28e39467a1
SHA256d9e1d1434491dcc5f351f5cb9930e10e2834c3eca5b997df34e5954fd85aeffd
SHA5127f48b537aa07a0461cb2ba6ffbeb3e7e058e2884d0d30f7986095e5a1c493cd94e0d178eab723ed6455927e388ca0cc769293ce912e5fd80370c56bf6884a1d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5381d78978af094235f6163e6107fbb90
SHA187be534988b81a7f5581996b44e50a364d005daf
SHA256a6a2e48b5a3430e09d8d7642c41f6c4f458b53272932e71a2a25e4f87d27766b
SHA51202d3987067dde801f38e7a3446b5e4d5fb4df9dd738ed3137a5c62c040d295df00814d611dabd14d6f3de539133bfe7b6992c530da6aceb72e4c800d92cbe433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59352de07b7cf5a888c7a6db52ada319e
SHA166dcd79e7964c6ce54b6d236eaff25824bdd123e
SHA256b3c30517228a7e582145bc724eebf6fe74c17f843525e38c1503e4ef261a9fc0
SHA512e6dce132398a1532a63f6ac0907ec253a7f5417c7d628ef52b2c1d1f02186a238aa6b1220bfc2dd081e41b22a6eb4ed41b1e6233953b55f39b13ed027e761d0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6c82fe4941fc17bac1be1fda91f15a5
SHA121cffa3997a14fb80802794d0c423f9dd6b0a50e
SHA256ae84ca31d7a0ccc11efa48ed58032c4ba0a7d41371e32ad1840a68cc2b445a13
SHA512c02c8d47b216a338c094898dfe110aae4583c72886b84fc99a03612b445a275ce9f0dce41d0fc68060dc44be5fb90bc1560f99e3753a5c71ffc4daa0e3b6e89f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD561d3000755b43328191c9b5b3e5b3486
SHA1c7f847d3db412696244f22f0414ffb725ac6d597
SHA256dd7df537f1c9066b6500dd2615195c8a5768d6fde93d132eb0efe42e1d512cb6
SHA512061090784fae25f481ac8a3b99487fb5df9902a1cb715c92a106840ad29c144252a2c7d75ef4c060aac0bbb1e43ee2fe1b0f45db46ee07f18b6079896a798dbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5b11a2692811631b9a61c9d0f34869c
SHA13295e2d71ff7bd1b9a70bb12515b5807d3877505
SHA256a8b2824ce24ea7f89c6e4e9bde7073939c4122bf69efebbd47a316d82ccb13fd
SHA512fd17f07a2d3319115e93bbf70a023560d02bdd923121eb758a1ee7c5497fc643898a3c025b596a08ab754ac63f33a4ea485ca392b7851883da158868c7a53f2e
-
Filesize
253B
MD5599dde993599db69a0ca56e3ead7cdc1
SHA1a1a2920f1058318c80ca1a34e376128330eb3598
SHA2564c7f6b4d4603eac5bbfb9f4ebc1d85b5d659d5ae61563c302bcd4bcc50e530d8
SHA51286fa68ed72e63ed37c0a74e803dbc052f564704e1d8f7ba0a14040cd2d428697a70904325b1e0b96ca73b98319cd61f96aaa35fc814806f6d6a74c89cd1811c3
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
253B
MD561e1b5f86dc88164154439dc455fdb16
SHA1809fa8e5f8b8b3e616004d03947d4719122c52e8
SHA2564c1060e42c7722f05144762cf8017f859fb0f7eb69f033812efb329bd83e528f
SHA51292a3a1951822cc0942f1fb642ebe72f0b3d6b486462f003c8e5efce2398db6453118f524c1137bee6ac1edca2eebfe34f041d1666d9536164ed5ad3c368b3280
-
Filesize
253B
MD58c530fe51335ffdbd3d2f072db8e8265
SHA1794ec5356e017f7b897aadab5f79866549aff4fa
SHA2565648c3ab3146b95ebb1b17f79000df7e27ce081e0ac55ad31344b147c5223c70
SHA512f38b46ba046789cf2a571e1f7722e8f3cedff35289835ead4d9642a25e7a803eddd2ed43b53ebf6d7ef9683bb0b9d22d8264ddc06f69f7af71f1bc18a0f975eb
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
253B
MD5bac7a22c42c81fac336331717c7c6dc0
SHA1b1e8d749313ed371d1cc84707a658c1a5b98a3d6
SHA256ebb340eeb7d942f96b8eb1a5e2563295168d16ecbb0ebe0bf5a29d6fb15ec818
SHA512085fd8f1ebba09224be1337b5de8bc7dd7386c07513c9ef262bfbfc15d95b351aac46da247e90540038e15ee9c82c9a39498c7cd8b8ac8ff9ce77bb899aa3275
-
Filesize
253B
MD5eac0f2ea183640fb8127cb70656cb4b5
SHA13ef03b957e3e8c7ea7808b144c5fb37f7e23cdd7
SHA256759e185764c50d94d1090440afc19c83e1e538ba454f3ead2d56114c51c82c69
SHA512269768bcddc2e367def1f0d205a7ac2646be14e9f1fa01dbc2129ad6260f813186fdd0f5a5ce2158cdcdac8fb2733895211fd5009fd01de536b6cbc569e6b5fe
-
Filesize
253B
MD5eb2eeb9e5f187d1592afc24b39322f7b
SHA17574d47ef63b482f8cc27cb5be2bb3f252a6c3d6
SHA256d4b086a2dd11eb03a4b18041b83a34bd1a0960acf4f27e7de2449bcbcf51b679
SHA512b2f092a3a15674b1fc421ffa1b856e1526db5fc3dbd4d9b11f8101e8c2f40506306fe331084aa31113bbb7b4c7390d2b706a48f8e94e841fc9e6685cb6723d37
-
Filesize
253B
MD5e7f45e5c35ee2c94a53a2c5cbd3cd3c8
SHA1f0996d9cb18566f3f8e1cafee3e61cbe0ed78945
SHA25609c9c132f6ed34b79903c0722ae45e48e6bbe56ff34f12f42f15aa5c6ad38400
SHA5129f9139ea4e30ce68d6a65ad9194c5c9b42b954242305f25d0ac4d0f80be24798c0fde3adae71a0264149f27caea789897b4db74b597339e91a4c0a6b3757a4be
-
Filesize
253B
MD589ec7801d9d1f7900c89dfe233c94bf8
SHA1587ded43e596fe5319102ac6ee5d4026635148e8
SHA256de4789519a1d29afd237d616ed16bcb0c93060dee7bdea8eaf9482f6b946ac3d
SHA5126a365fb1c00704a236af04973bc6dfce87e8523f971cbecf481adf3017cea59e0ebe5a2a60484ee791168e8e79cf00b65e03c40c33f52d4fdc2e306185dbc1ab
-
Filesize
253B
MD57382e7e3c03d8f6fbe25efc3dd6cdac6
SHA12e70ef14e9a9317211968941f4e60f54555d9180
SHA256bd94b21794e141c39346f5cfa835d192f3055ec658d6fac53f9e15fd894bd3f5
SHA512eb804c693ff161418a14ef62c1557fc99f0865a8f2b8354d1dd3848ff9f25d73a9c125473c2a23c396ec4e0dabb61bb3ee5ef2608d29d52dfad06495d87c6b4f
-
Filesize
253B
MD54653722f21f09a25b89544ff0f7fbf27
SHA14d97b65f8e55324dfbf96fd0f68d4f58e75ee24b
SHA256c2a3587e1a3ff8fc4c443edbff7808a0301cbef70f30d49a6b86d7e6440bbf15
SHA51241ab23250468c987b3ef26fb10e84fa3786638a1842c73a0b678f0ff0bd05f75d1791362c21f68531e1dc58782250f201dba5f7fb7dab66fbb01380cc1ba77ef
-
Filesize
253B
MD54fb1c47ccfe6175728f5a9fb4d8a1d5e
SHA173ca9926cc97ac31aafb9df0d32b85d35a561853
SHA2568e7f9d79c23a3048ce5f46ca40f35547adf9b092c5615b928373dc5cbc104212
SHA512e5d2408300c0388e61afc0acf65085f7bec162095476dd54c146e2e326c94e3a1acfe3970ea4db6fffe98be2c5f633aec4b01fbe5af70349e226f306663b8209
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5cd4da950218c93330764e942d2f369b6
SHA12ce306392c882addd252f5967ec1aed51aed8ee1
SHA256c606839eb8f523104bac9325fa50ed32942d8ebb7254d019eb238c667ec3f0a3
SHA51249387c7255529757309d1c212dc4f6709a10426a67ab57cb3964729817f0cd591855e7479ef9608caa8d8d5fbd726a77351f634b9ff8218544095b2ec22fd957
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478